Important Notice: Our web hosting provider recently started charging us for additional visits, which was unexpected. In response, we're seeking donations. Depending on the situation, we may explore different monetization options for our Community and Expert Contributors. It's crucial to provide more returns for their expertise and offer more Expert Validated Answers or AI Validated Answers. Learn more about our hosting issue here.

How do I configure the VPN user group-lock feature on the ASA or PIX?

April 26, 2017ASA configure feature Pix user VPN

0

Posted

How do I configure the VPN user group-lock feature on the ASA or PIX?

1 Answer

0

Posted

A. In order to configure group lock, send the group policy name in the class attribute 25 on the Remote Authentication Dial-In User Service (RADIUS) server and choose the group in order to lock the user within the policy. For example, in order to lock the Cisco 123 user into the RemoteGroup group, define the Internet Engineering Task Force (IETF) attribute 25 class OU=RemotePolicy for this user on the RADIUS server. Refer to this configuration example in order to configure group lock on an Adaptive Security Appliance (ASA)/PIX: group-policy RemotePolicy internal group-policy RemotePolicy attributes dns-server value x.x.x.x group-lock value RemoteGroup tunnel-group RemoteGroup type ipsec-ra tunnel-group RemoteGroup general-attributes address-pool cisco authentication-server-group RADIUS-Group default-group-policy RemotePolicy Note: OU sets the group policy, and the group policy locks the user into the preferred tunnel-group. In order to set up your Cisco Secure ACS for Windows, RADIUS s