Cisco VPN :: Specific Tunnel-group With User On ASA 5510?

May 13, 2011

I would like to ask some question about VPN clinet and SSL VPN, on my ASA 5510 i have many tunnel-group it have around 5 tunnel-group and i have one SSL VPN,i also have user 20 user. let me show you that:
1- tunnel-group Staff-VPN remote-access
2- tunnel-group Manager-VPN remote-access
3- tunnel-group normalstaff-VPN remote-access
4- tunnel-group guest-VPN remote-access
5- tunnel-group other-VPN remote-access
and tunnel-group sslgroup type remote-access
and i have user around 20 user and i want to specific user to tunnel-groups like this
1- tunnel-group Staff-VPN remote-access
username AAA password AAA
username AAA01 password AA01
2- tunnel-group Manager-VPN remote-access
username BBB password BBB
username BBB01 password BBB01
3- tunnel-group normalstaff-VPN remote-access
username CCC password CCC
username CCC01 password CCC01
5- tunnel-group other-VPN remote-access
username DDD password DDD
username DDD01  password DDD01
So, How can i manag tunel-groups with user?

View 3 Replies


Cisco VPN :: ASA 5520 / Restricting End User To One Specific Group With AnyConnect?

Feb 6, 2013

I just started configuring AnyConnect with ASA 5520 that uses Cisco SecureACS to pass radius authentication.  I configured two profiles with different split tunnel restrictions and what I discovered is that when the client connects to the ASA, they are provided a choice of these two groups (I guess there is no way to restrict this) and I can log into either one with any user account.  How do I restrict this so that the user can only use one profile?  Currently users capable of VPN would be placed in one specific AD group so that is what SecureACS checks.  Is there a sample configuration guide to handle multiple profiles with different levels of access?

View 3 Replies View Related

Cisco VPN :: PIX515e / 713060 / Tunnel Rejected / User Not Member Of Group

Dec 17, 2011

I just configure VPN for end users in PIX515e with IOS 8 and get stuck with "Tunnel Rejected: User (msveden) not member of group (VPN-shared), group-lock check failed.". tell me how I add user to my VPN group?

View 1 Replies View Related

Cisco Firewall :: ASA 5510 - Authenticate Users Of Specific LDAP Group

Apr 19, 2010

I'm actually require authentication for users who are coming from the PublicVLAN (the vlan associated with the wireless hotspot) to authenticate themself to the LDAP server via my firewall ASA 5510

View 12 Replies View Related

Cisco VPN :: 5510 - Authenticate One User In Only 1 Group?

Oct 20, 2011

I have two tunnel groups using WEBVPN , I have local users at ASA 5510 version 7.2.

How can I authenticate one user in only one group?Now with local users I can loggin in both tunnel groups

View 1 Replies View Related

Cisco Firewall :: ASA 5510 Security For One Specific User

Jan 18, 2013

We have an ASA 5510 version 8.3 (2) that we accept VPN users via a radius server. Is there a way to lock down a specific user that connects to the ASA as a SSL client or IPSEC VPN user? If the specific user were to connect to the ASA, we would want the user to have minimal to not access to our system.

View 1 Replies View Related

Cisco VPN :: 5510 - IPsec Tunnel Going Down At Specific Times

Dec 5, 2011

i have a Ipsec tunnel between a ASA 5510 (Uk) & a router (France) that seems to be going down a specific times during the day. I have attached the sys log as well.
I cannot seem to copy & paste the config onto here for some reason so i have attched the configs, Ipsec details & syslog details from the asa.

View 3 Replies View Related

Cisco AAA/Identity/Nac :: 5510 Assigning A User Group Using RSA Secure ID RADIUS Server

Feb 3, 2007

We have several ASA 5510 firewalls which are being used as VPN gateways.RSA SecurID is the authentication mechanism using native SDI connectivity. No ACS server is being used.Is it possible to assign user Group and other attributes (such as ACL), using the SecurID RADIUS server? I know this is what the Cisco ACS is for, but is it possible using the RSA RADIUS server itself?

View 11 Replies View Related

Cisco VPN :: ASA 5510 - How To Enforce User Internet Traffic To Tunnel

Jun 4, 2011

here is my situation:
home users ------ internet ------ ASA 5510----- CORP LAN
we have anyconnect VPN and remote Ipsec VPN, i think the solution should works on both of them. my question is : "How to enforce home user internet traffic to VPN tunnel ?" we have "split tunnel" to pass only ""interesting traffic" to VPN tunnel access CORP LAN. but now , i need enforce all user traffic (internet +CORP LAN) pass through VPN tunnel. so far , i did what i know :

1. remove "split tunnle" from group-policy

2. the address in "remote VPN user address pool" are could be NAT/PAT through ASA5510

but i don't get that why it doesn't work.

View 9 Replies View Related

Cisco VPN :: ASA 5520 / Define Specific IKE Proposal For Specific L2L Tunnel?

May 24, 2011

ASA 5520 running 8.0.4
ASDM v.6.1
Need assistance understanding how in ASDM/Configuration/Site-to-Site VPN/Connection Profiles/ "Any Entry" I can specify that I only want to offer an IKE Proposal of pre-share-aes-256-sha?
The IKE Proposal field has a number of possible options including: pre-share-aes-256-md5, pre-share-3des-md5, pre-share-aes-256-sha, pre-share-aes-192-sha, pre-share-3des-md5, pre-share-aes-sha and pre-share-3des-sha.
I am able to pick a specific IPSec Proposal w/o issue but when I attempt to do the same for the IKE Proposal, and click OK the choice does not "stick" but rather returns to the entire list as defined above.

View 2 Replies View Related

Cisco Firewall :: 5510 - Display User Message When User Connects Using AnyConnect Client?

Apr 20, 2009

We are using an ASA 5510 and remote access (SSL VPN) using the AnyConnect client.
Is it possible to display a user message when a user connects using the AnyConnect client, matching a specific dynamic access policy?  Can the message be displayed when the action is "Continue" rather than "Terminate"?  I can't seem to get this to work and wondered if there was a LUA function to do this.
We have a DAP which gives a restricted ACL when the user's anti-virus is out of date, and I wanted to notify the user to update their anti-virus and reconnect.

View 4 Replies View Related

Cisco Firewall :: Internet Access Through ASA 5540 For Specific Network Object Group

May 2, 2011

I have a 5540, and i am trying to allow access to internet for an specific network object group, who has inside a bunch of users, who needs direct internet access without any restrictions, i have tried with dynamic NAT, but that configuration ask for a specific IP o a Network range, and is not permitted to configure an  object group as a source
The group is located in LAN zone, so a permission from one zone to another zone is needed i think, but i can allow the internet acess to that group Is there another way to get that , different from NAT ?

View 5 Replies View Related

Cisco :: LMS 4.0 User Defined Group

Aug 3, 2011

I'am a novice with LMS 4.0.I create 4 device group in Group Management, I restarted my server and since this reboot, I haven't any device in my groups. I would like to use the archive synchronization but I can't see my device in my groups.

View 6 Replies View Related

Cisco Switching/Routing :: 2560 Create Dynamic VLAN For Specific Group Of Users

Feb 6, 2012

We have Cisco Cat4503 series L3 Switch and Cisco L2 2560 Series Switches, some of the users want to have a dynamic VLAN membership, and connecting with the network as mobile users,
can it possible and create dynamic VLAN for specific group of users.

View 6 Replies View Related

Cisco AAA/Identity/Nac :: ACS 4.2 User Group Mapping?

Sep 12, 2012

We are using ACS with patch 8 on ACS 1113 SE box.
Our requirement is to assign ACS loal group to user on basis of windows Nt group. Which means I dont wants to create individual users in ACS rather when user will login, the auth request will be forwarded to AD(remote database). Depeneding on the remote database group the user should be mapped to local database.
For this I have configured "database group mapping" according to following cisco guide. [URL] 
However when ever my AD users are authenticating they are getting the membership of default group as configured in "Default" profile. I am using TACACS+ protocol in my routers and switches for authentication.
whether "Group mapping by External user database"  works with TACACS+ or only with RADIUS protocol. If it works with TACACS+ what else configuration need to be done so that my ACS can map users to proper groups instead of default group.

View 4 Replies View Related

Cisco AAA/Identity/Nac :: ACS 5.2 - Delete Specific Log For User X

Jun 25, 2012

on the acs 5.2 , how to delete specific log for user X, ?

View 3 Replies View Related

Block Multimedia Stream Per User Group?

Oct 1, 2012

I need to block the multimedia streaming to a certain group of users accessing my wireless connection.I'm using squid as my proxy server and the users are registered on a LDAP database. A RADIUS server provides authentication.

View 1 Replies View Related

Cisco :: LMS 4.0.1 Authenticate User On Group Base And Assign Different Privilege?

Sep 7, 2011

having LMS 4.0.1 is it possible to authenticate user on a group base and assign different privilege to different groups?. The user's group are available in the LDAP server.Do I have to use a TACACS/RADIUS server between the Ciscoworks LMS and the LDAP repository?

View 1 Replies View Related

Cisco AAA/Identity/Nac :: ACS 4.1- Shell Command Works Under User But Not Group

Jul 27, 2011

This question might actually belong under tacacs server but it's only happening with the ACE.  I've configured tacacs on the 4710 and configured the tacacs server per the documentation. If I enter the shell:<context>*Admin default-domain under the group settings when I login with my tacacs ID my role is set to Network-Monitor.  If I set the shell in my specific tacacs ID I'm assigned the correct role as Admin.  We're running ACS ver 4.1 and the ACE is A4(1.1)

View 1 Replies View Related

AAA/Identity/Nac :: ISE 1.0.4 Machine / User ActiveDirectory Group Retrieving

Mar 6, 2012

We are migrating our ACS 5.1 to ISE 1.0.4.
- On ACS we were doing 802.1x Authentification over an Activedirectory, assigning Vlan according to computer/user group. In some case the user vlan could be different from the computer vlan (ex admin account connecting to a user account). This works great with ACS.I tested the same function with ISE and the behaviour is a bit different :
- When the computer boot, I can see the computer account being authenticated on ISE. The logs show the AD groups the computer belongs to and the Authorization profile is well applied according to the AD group.
- When the user login, I can see the user account being authenticated on ISE, BUT the logs show the AD groups of the previous authentication, the one belonging to the computer not the user. So the authorization profile is the one from the computer not the user.
It seems that the AD group attributes are not well updated :

- AD logs show the second authentication doesn't engage a new group parsing from AD
- Shutting down the switch port when user is logged engage a new authentication a AD group are well updated.
- Bug toolkit reference the same bug but for WLC CSCto83897 so I suspect it's present in other case.

View 0 Replies View Related

Cisco VPN :: Automatic Tunnel Group Selection Through Radius On ASA 5.3?

Aug 20, 2012

I try to let Cisco ASA automatic select a tunnel group for users, after user input username and password. I try to do this without user selection a connection profile on login page. Authentication on ASA<>ACS 5.3<>MS AD. How i can will do this? Radius attribute class=group_policy don't work.

View 1 Replies View Related

Cisco VPN :: 1921 - Specific Way To Bring Up Tunnel?

Aug 2, 2011

I am trying to configure an IPSEC tunnel on a 1921 router.  What I hope to accomplish is that using a IP SLA that the IPSEC tunnel will only be brought up  IF the normal WAN connection is not responding.  My thoughts were to route the traffic that needed to come back to corporate through a loopback interface but I havent found a way to do that.

View 1 Replies View Related

ASA5505 - Tunnel A Specific Traffic Via VPN

May 20, 2012

I have a number of sites in China, they have decent inter-country connectivity but poor connectivity when going overseas.

We have a single site in China witha dedicated 1:1 leased line that has good conectivity both inside and outside of China.

All the sites in China have ASA5505 firewalls

One of our Citrix farms is hosted in the UK and although the main site with the leased line is fine accessing the farm the other sites are not. I would like to try and tunnel just the citrix connectivity via a VPN to the China head office then use their connection to get out to the farm.

how to tunnel all traffic but not just specific traffic over the VPN.

View 3 Replies View Related

Cisco :: 6506 Switch - SNMPv3 User Without Group Setting Showing

Sep 4, 2012

Why is it that when SNMPv3 user "TestV3-User" was added to my SNMPv3 implementation on my 6506 switch, the group/MD5/Emcryption settings are missing for this user (See "sh snmp user" output)???
router#sh snmp user
User name: TestV3-User
Engine ID: 80000009030000249706EFC0
storage-type: nonvolatile        active access-list: test


View 3 Replies View Related

Cisco VPN :: 5505 - Can Single Local User Belong To 2 Group-policies

Jan 13, 2013

I have a Cisco ASA 5505 that I've setup with an SSL VPN. This is for personal use, and I therefore don't have need for anything more than local authentication. [code]
I'd like to have one profile/policy where I only encrypt data going to my split-tunnel ACL, and I'd like to have one profile/policy where I encrypt all traffic.
The issue ive been fighting is - it doesn't seem like its possible to associate more than one group policy per user. If it IS possible - can you tell me how I associate both groups to my local account?

View 1 Replies View Related

Cisco WAN :: 10008 - PPPOE Setup / How To Show Specific User

Dec 17, 2012

Working on setting up a Cisco 10008 with PPPOE and it seems like we kind of have it working but only one user can get on.
Here is part of the config:
Cisco-10008#show run
Building configuration...
Current configuration : 4134 bytes
version 12.2
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption

Also is there a way to show a specific user once they are connected with PPPOE? I'm currently using "show aaa sessions", but was thinking it would be "show pppoe something"

View 9 Replies View Related

Home Network :: Setting Up A Wireless User Group In Town

Aug 29, 2011

We want to set up a wireless user group in our town between a few friends and new people who are interested to join. As far as I heard I don't need a ICASA License for the 5.8GHz Frequency if we are using it for a non profit orginization, so we may use that.

1 x Routerboard
3 x Radio Plugin Boards
3 x 120degree Antennas

to set up a 360degree HS (Highsite).Then at each person's house we will need:

1 x Routerboard
1 x Radio Plugin Board
1 x Whichever Antenna

Is that correct? Then also if we wanto run VoIP on our network, how do I do that? Basicly we want to use it for gaming, file sharing and VoIP. No Internet of anything else.

View 2 Replies View Related

NSA 2400 - Tool To Monitor Web Traffic For One Specific User?

Feb 5, 2013

I am trying to find a tool that will monitor the web traffic for one specific user. If it is capable of bundling it into a report that would also be a benefit. I have searched, but not come up with much aside from broad network monitoring tools. All that is really needed is to capture all the activity from http traffic for this one specific user/PC (since she uses the same PC all the time). We have a Sonicwall NSA 2400 as our internet filter, but I was not able to locate anything on there for specific user reporting.

View 2 Replies View Related

Cisco Firewall :: ASDM Access Through S2s Tunnel Group On ASA5510

Feb 7, 2012

For years now we've had an ASA5510 running an old version of ASA/ASDM (7.0/5.0) and couldn't access ASDM through a modern system with a recent JRE, so we didn't bother with this.
However, we've recently upgraded ASA/ASDM for purposes of adding failover and want to be able to access ASDM through our site to site tunnel. The site to site tunnel gives us access to the VLAN that the firewall is the gateway for, but not access to the firewall itself.
This side of the network is the subnet, and that side of the network is the subnet. I can ping devices on the subnet, but not the firewall, (not that I really need to) and devices can ping me back. I can access ASDM through RDP or ssh into a server on the subnet, but not directly from the subnet.
This is the current config relative to the subnet:
access-list trust_nat0_outbound extended permit ip
access-list untrust_cryptomap_600 extended permit ip


As far as I'm aware, the tunnel comes into the firewall through the untrust (public) interface, because that is the destination of the tunnel on the subnet side.
What am I missing here that would allow asdm access through the untrust interface for the subnet?

View 27 Replies View Related

Cisco VPN :: To Match Tunnel Group With ASA 8.2 And VPN Client IPSec Authorization

Apr 15, 2010

I have configured a lab for RA VPNs with a ASA5510 software version 8.2 and VPN Client 5 using digital certificates with Microsoft CA on a Windows 2003 server. I did the configuration based on this document from Cisco website: URL
Now the vpn works just fine, but now I need to configure different tunnel-groups so I can provide different services to different users. The problem I have now is that I don't know how to configure it so the certificate matches the tunnel-group name. If i do a debug crypto isakmp on ASA I get this error messages:
%ASA-7-713906: IP =, Trying to find group via OU...%ASA-3-713020: IP =, No Group found by matching OU(s) from ID payload:   Unknown%ASA-7-713906: IP =, Trying to find group via IKE ID...%ASA-3-713020: IP =, No Group found by matching OU(s) from ID payload:   Unknown%ASA-7-713906: IP =, Trying to find group via IP ADDR...%ASA-7-713906: IP =, Trying to find group via default group...%ASA-7-713906: IP =, Connection landed on tunnel_group DefaultRAGroup

So basically when using certificates I always connect the RA VPN only with the default group DefaultRAGroup. Do I need to use a different web enrollment template for certificate request instead of the user template??? How can I define the OU on the User certificate so it matches the tunnel-group???

View 3 Replies View Related

Cisco AAA/Identity/Nac :: ACS5.2 - Establish Independent User Group / Only VPN Username And Password

Mar 28, 2012

My question is on ASA and ACS5.2 users.Have my ASA SSL VPN and IPSEC VPN, the my ACS5.2 many users, for example, wireless user.I would now like to establish an independent user group, only the VPN user name and password, while both the ASA VPN can only allow users in this independent group of ACS5.2 VPN login, how to configure?

View 1 Replies View Related

Remove Start Menu User Link - Windows 7 Group Policy?

Sep 29, 2011

I'm running a Windows Server 2008 Enterprise Edition server that is currently the domain controller, and a Windows 7 Ultimate client. I have a 'Test' user for messing around with group policy - anyway, on the client Start Menu it has 'Test User' which leads to some form of libraries folder. Is it possible to restrict the link without removing their name?

View 3 Replies View Related

Cisco AAA/Identity/Nac :: Use Radius On ASA 5505 To Block Outgoing User Access By Username In Group

Jan 15, 2012

Can I use AAA Radius on a ASA 5505 to block outgoing user access by user name in a group?

View 2 Replies View Related

Copyrights 2005-15, All rights reserved