Cisco Systems Configuring the Active Directory Agent Using RADIUS, Creating the ASA as a Client on the AD Agent Server, Creating a Link Between the AD Agent and DCs, Testing the AD Agent, Configuring the Identity Options on the ASA, Configuring the User Identity Options and Enabling Granular Reporting

25-21
Cisco ASA Series Firewall CLI Configuration Guide
Chapter25 Configuring the ASA for Cisco Cloud Web Security
Configuration Examples for Cisco Cloud Web Security
Configuring the Active Directory Agent Using RADIUS
The following example shows how to configure the Active Directory Agent on your ASA using
RADIUS:
hostname(config)# aaa-server adagent protocol radius
hostname(config-aaa-server-group)# ad-agent-mode
hostname(config-aaa-server-group)# aaa-server adagent (inside) host 192.168.116.220
hostname(config-aaa-server-host)# key cisco123
hostname(config-aaa-server-host)# user-identity ad-agent aaa-server adagent
Creating the ASA as a Client on the AD Agent Server
The following example shows how to create the ASA as a client on the Active Directory agent server:
c:\IBF\CLI\adacfg client create -name ASA5520DEVICE -ip 192.168.116.90 -secret cisco123
Creating a Link Between the AD Agent and DCs
The following example shows how to create a link between the Active Directory Agent and all DCs for
which you want to monitor logon/logoff events:
c:\IBF\CLI\adacfg.exe dc create -name DCSERVER1 -host W2K3DC -domain
W2K3DC.asascanlab.local -user administrator -password Password1
c:\IBF\CLI\adacfg.exe dc list
Running the last command should show the status as “UP.”
For the AD_Agent to monitor logon/logoff events, you need to ensure that these are logged on ALL DCs
that are actively being monitored. To do this, choose:
Start > Administrative Tools > Domain Controller Security Policy
Local policies > Audit Policy > Audit account logon events (success and failure)
Testing the AD Agent
The following example shows how to configure the test Active Directory Agent so that it can
communicate with the ASA:
hostname# test aaa-server ad-agent adagent
Server IP Address or name: 192.168.116.220
INFO: Attempting Ad-agent test to IP address <192.168.116.220> (timeout: 12 seconds)
INFO: Ad-agent Successful
See also the following command: show user-identity ad-agent.
Configuring the Identity Options on the ASA
The following example shows how to configure the identity options on the ASA:
hostname(config)# user-identity domain ASASCANLAB aaa-server AD
hostname(config)# user-identity default-domain ASASCANLAB
Configuring the User Identity Options and Enabling Granular Reporting
The following example shows how to configure the user identity options that send user credentials to the
ASA and enable granular user reporting from the proxy server: