72-39
Cisco ASA 5500 Series Configuration Guide using ASDM
Chapter72 Configuring Clientless SSL VPN
Understanding How KCD Works
•Server Configuration
–
Interface Name—Choose the interface on which the server resides. In general, authentication
server deployments reside on the internal corporate network, typically via the inside interface.
–
Server Name—Define the hostname of the domain controller, such as ServerHostName.
–
Timeout—Specify the maximum time, in seconds, to wait for a response from the server. Ten
seconds is the default.
•Kerberos Parameter
–
Server Port—88 is the default and the standard port used for KCD.
–
Retry Interval—Choose the desired retry interval. Ten seconds is the default configuration.
–
Realm—Enter the domain name of the DC in all uppercase (such as EXAMPLEDC.COM). The
KCD configuration on the ASA requires the realm value to be in uppercase. A realm is an
authentication domain. A service can accept authentication credentials only from entities in the
same realm. The realm must match the domain name which the ASA joins.
Figure72-9 KCD Server Group Configuration
Step3 Click OK to apply your configuration and then configure the Microsoft KCD Server to request service
tickets on behalf of the remote access user (see Figure 72-9). The Microsoft KCD Server configuration
window appears upon clicking OK.
Configuring Kerberos Server Groups
The Kerberos Server Group for Constrained Delegation, MSKCD, is automatically applied to the KCD
Server Configuration. You can also configure Kerberos Server groups and manage them under
Configuration > Remote Access VPN > AAA/Local User > AAA Server Groups.