I'm trying to do a quick and dirty add to a 9.1(3) ASA running WebVPN to allow a contractor in without having to create them an account on our main directory server. In IOS land, I could specify local auth before a server group and it would work fine. It seems that in ASA land you can only specify local auth after a server group fails.
I tried to create a specific group policy for the user, but it doesn't seem to wanna work. ! group-policy DfltGrpPolicy attributes vpn-tunnel-protocol ssl-client ssl-clientless split-tunnel-policy tunnelspecified split-tunnel-network-list value SPLITTUNNEL gateway-fqdn value foo.bar.com address-pools value SSLVPN group-policy LocalAuthOnly internal group-policy LocalAuthOnly attributes group-lock value LocalAuthOnly username contractor password mEkEo2tG2a/HS2Ah encrypted username contractor attributes vpn-group-policy LocalAuthOnly group-lock value LocalAuthOnly service-type remote-access tunnel-group DefaultRAGroup general-attributes authentication-server-group CORPRADIUS LOCAL tunnel-group DefaultWEBVPNGroup general-attributes authentication-server-group CORPRADIUS LOCAL tunnel-group LocalAuthOnly type remote-access tunnel-group LocalAuthOnly general-attributes default-group-policy LocalAuthOnly ! Is there another way that I'm missing? Thanks in advance. _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
