VPN into network with only AD OU account

[billyj1900]

I have a setup ACS authentication setup but now I want to only allow certain people in a specified OU in active directory to be able to log in using VPN. Does anyone know if there is a way to setup authentication to active directory using a specific OU.

 

[unclerico]

i don't know of any way to do it by OU, but why not use an AD group instead??

I hate all Uppercase... I don't want my groups to seem angry at me all the time! =)
- ColdFlame (vbscript forum)

 

[billyj1900]

Can you explain the AD group.

 

[North323]

yes you can do this in ACS. have you set up an external database in the ACS application?

 

[billyj1900]

Yes I have a windows database

 

[North323]

ok then you can define what group is allow to access the vpn. what you will need to do is create the group. go to your external database in ACS and map it to that group and either allow or deny access.

 

[billyj1900]

Does restarting the service affects production ie 802.1x

 

[North323]

no, while restarting, new users will not be able to authenticate but will not kick off existing users

 

[billyj1900]

Created a NT group in AD, added one user, setup a new group in ACS, mapped that NT group to the ACS group. I can still log into the VPN client with another AD account besides the one I put into the NT group.

 

[North323]

where you did that mapping..there is an option to map another group or 'deny access' or something like that or deny all others so it should look something like

ADGroupYoucreated VPN Access
Deny Everyone else

 

[billyj1900]

I have no deny access in the mapping group. I am trying to see how to deny access in the group setup.

 

[North323]

what version ACS are you using? Windows right?

 

[billyj1900]

4.1

 

[North323]

ok then its possible..its on the mapping part of the menu

 

[North323]

http://www.cisco.com/en/US/docs/net...rol_server_for_windows/4.0/user/guide/qg.html

 

[billyj1900]

Ok finally got it. In the Per Group defained network access restrictions on the TAC+ACS I had to check the box define IP-based access restrictions, denied call/point, and choose the NDG * *. I also had to check the box to define CLI/DNIS, denied calling/point choose teh NDG * *.