need help with sending group policy attribute to ASA
Hello, I am trying to find out the correct way to send group policy attribute to Cisco ASA for remote access vpn users. I am running Freeradius version 3.0.17, and Cisco ASA version 9.8.3(18). Any help is appreciated. Thanks, Rong Wang -- Rong Wang Senior Network Engineer Address | 500 El Camino Real, Santa Clara, CA 95053 Phone | (408)551-7107 Email | rzwang@scu.edu Website | https://www.scu.edu/is/it
Rong Wang, Do you mean ASA group policy attributes? If so, I do this sort of thing by adding clauses in my /etc/raddb/sites-enabled/site post-auth section. I do an if(){} clause with an LDAP-Group check to see if the user is a member. If true, then I include within the "if{}" an "update reply {}" clause and set the attribute I want to the value I want (either fixed supported VALUEs by name, or arbitrary values, as appropriate). Take a look in dictionary.cisco.asa provided with, and loaded by, FreeRADIUS. If the attributes you want to set are in there, you can use them. On my CentOS-7 systems with CentOS-supplied FreeRADIUS RPMs, the dictionaries are in /usr/share/freeradius. On 7/11/2019 12:59 PM, Rong Wang wrote:
Hello,
I am trying to find out the correct way to send group policy attribute to Cisco ASA for remote access vpn users. I am running Freeradius version 3.0.17, and Cisco ASA version 9.8.3(18). Any help is appreciated.
Thanks, Rong Wang
-- Douglas C. Stephens | Network Systems Analyst Information Technology | Phone: (515) 294-6102 Ames Laboratory, US DOE | Email: stephend@ameslab.gov
Hi Douglas, Thank you! I tried to set attribute "ASA-Group-Policy" under "update reply", ASA didn't take it. I also tried to set it under "update request", it also didn't work. I am able to create a group with group attribute, and set Cisco AVpair for the group in raddb/mod-config/file/authorize, but I never had the luck to make ASA-Group-Policy attribute work with ASA. Any other thought? Thanks, Rong On Thu, Jul 11, 2019 at 11:46 AM Douglas C. Stephens <stephend@ameslab.gov> wrote:
Rong Wang,
Do you mean ASA group policy attributes?
If so, I do this sort of thing by adding clauses in my /etc/raddb/sites-enabled/site post-auth section. I do an if(){} clause with an LDAP-Group check to see if the user is a member. If true, then I include within the "if{}" an "update reply {}" clause and set the attribute I want to the value I want (either fixed supported VALUEs by name, or arbitrary values, as appropriate).
Take a look in dictionary.cisco.asa provided with, and loaded by, FreeRADIUS. If the attributes you want to set are in there, you can use them. On my CentOS-7 systems with CentOS-supplied FreeRADIUS RPMs, the dictionaries are in /usr/share/freeradius.
On 7/11/2019 12:59 PM, Rong Wang wrote:
Hello,
I am trying to find out the correct way to send group policy attribute to Cisco ASA for remote access vpn users. I am running Freeradius version 3.0.17, and Cisco ASA version 9.8.3(18). Any help is appreciated.
Thanks, Rong Wang
-- Douglas C. Stephens | Network Systems Analyst Information Technology | Phone: (515) 294-6102 Ames Laboratory, US DOE | Email: stephend@ameslab.gov
-- Rong Wang Senior Network Engineer Address | 500 El Camino Real, Santa Clara, CA 95053 Phone | (408)551-7107 Email | rzwang@scu.edu Website | https://www.scu.edu/is/it
On Jul 11, 2019, at 10:47 PM, Rong Wang <rzwang@scu.edu> wrote:
Thank you! I tried to set attribute "ASA-Group-Policy" under "update reply", ASA didn't take it.
What does that mean? Does the ASA documentation say that it accepts that attribute in the Access-Accept packet?
I also tried to set it under "update request", it also didn't work.
Because you're updating the *input* packet. You can't just make random changes and hope that it magically works. Understanding things is the key.
I am able to create a group with group attribute, and set Cisco AVpair for the group in raddb/mod-config/file/authorize, but I never had the luck to make ASA-Group-Policy attribute work with ASA. Any other thought?
See the ASA documentation for what attributes it expects in an Access-Accept, and what it does with those attributes. Then, configure FreeRADIUS to send those attributes. Alan Dekok.
Thank you Alan and Douglas for your help! It works! I made a mistake earlier so it didn't work then. All I need to do is to "update reply" with correct format. Appreciate both of your help. Rong On Thu, Jul 11, 2019 at 1:52 PM Alan DeKok <aland@deployingradius.com> wrote:
On Jul 11, 2019, at 10:47 PM, Rong Wang <rzwang@scu.edu> wrote:
Thank you! I tried to set attribute "ASA-Group-Policy" under "update reply", ASA didn't take it.
What does that mean?
Does the ASA documentation say that it accepts that attribute in the Access-Accept packet?
I also tried to set it under "update request", it also didn't work.
Because you're updating the *input* packet.
You can't just make random changes and hope that it magically works. Understanding things is the key.
I am able to create a group with group attribute, and set Cisco AVpair for the group in raddb/mod-config/file/authorize, but I never had the luck to make ASA-Group-Policy attribute work with ASA. Any other thought?
See the ASA documentation for what attributes it expects in an Access-Accept, and what it does with those attributes.
Then, configure FreeRADIUS to send those attributes.
Alan Dekok.
- List info/subscribe/unsubscribe? See https://urldefense.proofpoint.com/v2/url?u=http-3A__www.freeradius.org_list_...
-- Rong Wang Senior Network Engineer Address | 500 El Camino Real, Santa Clara, CA 95053 Phone | (408)551-7107 Email | rzwang@scu.edu Website | https://www.scu.edu/is/it
participants (3)
-
Alan DeKok -
Douglas C. Stephens -
Rong Wang