Cisco 5510 - ASA SSL / IPsec VPN Edition Configuration Guide

B-16
Cisco ASA 5500 Series Configuration Guide using ASDM
OL-20339-01
Appendix B Configuring an External Server for Authorization and Authentication
Configuring an External LDAP Server
Table B-5 lists the tokens for the Cisco-AV-pair attribute:
Active Directory/LDAP VPN Remote Access Authorization Use Cases
This section presents example procedures for configuring authentication and authorization on the
adaptive security appliance using the Microsoft Active Directory server. It includes the following use
cases:
• User-Based Attributes Policy Enforcement, page B-18
• Placing LDAP users in a specific Group-Policy, page B-20
• Enforcing Static IP Address Assignment for AnyConnect Tunnels, page B-22
• Enforcing Dial-in Allow or Deny Access, page B-25
• Enforcing Logon Hours and Time-of-Day Rules, page B-28
Other configuration examples available on Cisco.com include the following TechNotes:
• ASA/PIX: Mapping VPN Clients to VPN Group Policies Through LDAP Configuration Example at:
Table B-5 Security Appliance-Supported Tokens
Token Syntax Field Description
ip:inacl#Num= N/A (Identifier) (Where Num is a unique integer.) Starts all AV pair access control lists. Enforces
access lists for remote IPSec and SSL VPN (SVC) tunnels.
webvpn:inacl#Num= N/A (Identifier) (Where Num is a unique integer.) Starts all clientless SSL AV pair access control
lists. Enforces access lists for clientless (browser-mode) tunnels.
deny Action Denies action. (Default)
permit Action Allows action.
icmp Protocol Internet Control Message Protocol (ICMP)
1 Protocol Internet Control Message Protocol (ICMP)
IP Protocol Internet Protocol (IP)
0 Protocol Internet Protocol (IP)
TCP Protocol Transmission Control Protocol (TCP)
6 Protocol Transmission Control Protocol (TCP)
UDP Protocol User Datagram Protocol (UDP)
17 Protocol User Datagram Protocol (UDP)
any Hostname Rule applies to any host.
host Hostname Any alpha-numeric string that denotes a hostname.
log Log When the event is hit, a filter log message appears. (Same as permit and log or
deny and log.)
lt Operator Less than value
gt Operator Greater than value
eq Operator Equal to value
neq Operator Not equal to value
range Operator Inclusive range. Should be followed by two values.

Cisco 5510 - ASA SSL / IPsec VPN Edition Specifications

General

Brand	Cisco
Model	5510 - ASA SSL / IPsec VPN Edition
Category	Firewall
Language	English