72-38
Cisco ASA 5500 Series Configuration Guide using ASDM
Chapter72 Configuring Clientless SSL VPN
Understanding How KCD Works
Figure72-8 ASA DNS Configuration Example
Configuring the ASA to Join the Active Directory Domain
This section outlines configuration procedures necessary to enable the ASA to act as part of the Active
Directory domain. KCD requires the ASA to be a member of the Active Directory domain. This
configuration enables the functionality necessary for constrained delegation transactions between the
ASA and the KCD server.
Step1 From ASDM, navigate to Configuration > Remote Access VPN > Clientless SSL VPN Access >
Advanced > Microsoft KCD Server, as shown in Figure72-9.
Step2 Click New to add a Kerberos Server Group for Constrained Delegation and configure the following
(see Figure 72-9):
•Server Group Configuration
–
Server Group Name—Define the name of the constrained delegation configuration on the ASA,
such as MSKCD, which is the default value. You can configure multiple server groups for
redundancy; however, you can only assign one server group to the KCD server configuration
used to request service tickets on behalf of VPN users.
–
Reactivation Mode—Click the radio button for the mode you want to use (Depletion or Timed).
In Depletion mode, failed servers are reactivated only after all of the servers in the group are
inactive. In Timed mode, failed servers are reactivated after 30 seconds of down time. Depletion
is the default configuration.
–
Dead Time—If you choose the Depletion reactivation mode, you must add a dead time interval.
Ten minutes is the default configuration. The interval represents the duration of time, in
minutes, that elapses between the disabling of the last server in a group and the subsequent
re-enabling of all servers.
–
Max Failed Attempts—Set the number of failed connection attempts allowed before declaring
an unresponsive server to be inactive. Three attempts is the default.