Identity Firewall Step by Step Configuration on ASA 5510
Saturday, January 7, 2012, 06:36 PM -
CiscoPosted by Administrator
Identity Firewall Step by Step Configuration on ASA 5510
Steps to be carried out on the ASA 5500
aaa-server domainRAD protocol radius (Here we will create a Radius Group which will act as ad-agent mode- domain is given as reference, you can give any name here)
ad-agent-modeaaa-server domainRAD (IN10) host 10.0.0.21 (Here the IP address of the ADagent has to be given where Adagent is installed)
key ***** (the same key has to be given which is given on the ADagent server)
aaa-server domainAD protocol ldap (Here we will create ldap group-domain is given as a reference and you can give any name like "organizationAD")
aaa-server domainAD (IN10) host 10.0.0.21 (The same Ip address has to be given here of the ADagent)
server-port 389 (port is defined as 389 which is the default port)
ldap-base-dn DC=WHALE,DC=COM (where WHALE is a domain name used in your network)
ldap-scope subtree ldap-login-password ***** (Enter the administrator password)
ldap-login-dn whale\administrator (the administrator username has to be given or any username with administrative priviliges,one thing I noticed that if you gie only username then groups does not get imported and the authentication also does not get successful
server-type microsoft (define the server type as microsoft)
user-identity domain whale aaa-server domainAD (the domain netbios name has to be mentioned here and we have to give the AD agent group name which we have created earlier
user-identity default-domain whale (the netbios name has to be given)
user-identity ad-agent aaa-server domainRAD (Here we are giving the radius group for the authentication)
This completes the configuration on the ASA and we have to give the commands on Windows agent server.
The adagent software you have to get from the cisco site only and the CCO login is required for the same.The procedure for ADagent is given on this URL.
https://supportforums.cisco.com/docs/DOC-20366Some test commands to test your configuration
show user-identity user all list
show user-identity user active user domain\user-name list detail
test aaa-server ad-agent adagent
Other categories
Cisco Jokes Photos Tutorials Voip Goa
Bookmark this on Delicious
Home