C-16
Cisco ASA 5500 Series Configuration Guide using the CLI
AppendixC Configuring an External Server for Authorization and Authentication
Configuring an External LDAP Server
Active Directory/LDAP VPN Remote Access Authorization Examples
This section presents example procedures for configuring authentication and authorization on the ASA
using the Microsoft Active Directory server. It includes the following topics:
•User-Based Attributes Policy Enforcement, pageC -16
•Placing LDAP Users in a Specific Group Policy, pageC-18
•Enforcing Static IP Address Assignment for AnyConnect Tunnels, pageC-20
•Enforcing Dial-in Allow or Deny Access, page C-22
•Enforcing Logon Hours and Time-of-Day Rules, page C-25
Other configuration examples available on Cisco.com include the following TechNotes.
•ASA/PIX: Mapping VPN Clients to VPN Group Policies Through LDAP Configuration Example at
the following URL:
http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a008089149
d.shtml
•PIX/ASA 8.0: Use LDAP Authentication to Assign a Group Policy at Login at the following URL:
http://www.cisco.com/en/US/partner/products/ps6120/products_configuration_example09186a008
08d1a7c.shtml

User-Based Attributes Policy Enforcement

You can map any standard LDAP attribute to a well-known Vendor-Specific Attribute (VSA) as well as
map one or more LDAP attribute(s) to one or more Cisco LDAP attributes.
The following example shows how to configure the ASA to enforce a simple banner for a user configured
on an AD LDAP server. On the server, use the Office field in the General tab to enter the banner text.
This field uses the attribute named physicalDeliveryOfficeName. On the ASA, create an attribute map
that maps physicalDeliveryOfficeName to the Cisco attribute Banner1. During authentication, the ASA
retrieves the value of physicalDeliveryOfficeName from the server, maps the value to the Cisco attribute
Banner1, and displays the banner to the user.
This example applies to any connection type, including the IPsec VPN client, AnyConnect SSL VPN
client, or clientless SSL VPN. In the example, User1 connects through a clientless SSL VPN connection.
To configure the attributes for a user on the AD or LDAP Server, perform the following steps:
Step1 Right-click a user.
The Properties dialog box appears (see Figure C-3).
gt Operator Greater than value
eq Operator Equal to value
neq Operator Not equal to value
range Operator Inclusive range. Should be followed by two values.
TableC-5 ASA-Supported Tokens (continued)
Token Syntax Field Description