Try to use; reply:class := "Name_of_VPNgroup_in_ASA" In examle: if (LDAP-Group == "SSL-VPN-Visma-web") { update { reply:Class := "Visma-web_Grp" } } else { update { reply:Class := "NoAccess" } regards, Lasse On Mon, Oct 30, 2017 at 6:00 AM, Satish Patel <satish.txt@gmail.com> wrote:
I am configuring freeradius for Cisco ASA VPN and i have create multiple Group Policy on ASA now i want to send those group name back to NAS using Class Attributes #25 as per following document (they are using Windows IAS)
http://www.dasblinkenlichten.com/using-radius-attributes- during-webvpn-logon/
Same setup i want to do in Linux Freeradius so where should i definite that attribute? Should i use that in /etc/raddb/user or /etc/raddb/sites-enabled/default file in post-auth section? I did following and i am getting following result but not sure i am doing it right or not
post-auth { update reply { Class := OU=Group_VPN; } }
Sent Access-Request Id 40 from 0.0.0.0:35534 to 127.0.0.1:1812 length 76 User-Name = "user1" User-Password = "password1" NAS-IP-Address = 10.5.3.31 NAS-Port = 1812 Message-Authenticator = 0x00 Cleartext-Password = "password1" Received Access-Accept Id 40 from 127.0.0.1:1812 to 0.0.0.0:0 length 35 Class = 0x4f553d47726f75705f56504e3b - List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html