1-35
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring Connection Profiles, Group Policies, and Users
Configuring Connection Profiles
During authentication, the RADIUS server presents access challenge messages to the ASA. Within these
challenge messages are reply messages containing text from the SDI server. The message text is different
when the ASA is communicating directly with an SDI server than when communicating through the
RADIUS proxy. Therefore, in order to appear as a native SDI server to the AnyConnect client, the ASA
must interpret the messages from the RADIUS server.
Also, because the SDI messages are configurable on the SDI server, the message text on the ASA must
match (in whole or in part) the message text on the SDI server. Otherwise, the prompts displayed to the
remote client user may not be appropriate for the action required during authentication. The AnyConnect
client may fail to respond and authentication may fail.
“Configuring the Security Appliance to Support RADIUS/SDI Messages” section on page 70-35
describes how to configure the ASA to ensure successful authentication between the client and the SDI
server.
Configuring the Security Appliance to Support RADIUS/SDI Messages
To configure the ASA to interpret SDI-specific RADIUS reply messages and prompt the AnyConnect
user for the appropriate action, perform the following steps:
Step 1
Configure a connection profile (tunnel group) to forward RADIUS reply messages in a manner that
simulates direct communication with an SDI server using the
proxy-auth sdi
command from
tunnel-group webvpn configuration mode. Users authenticating to the SDI server must connect over this
connection profile.
For example:
hostname(config)#
tunnel-group sales webvpn attributes
hostname(tunnel-group-webvpn)#
proxy-auth sdi
Step 2
Configure the RADIUS reply message text on the ASA to match (in whole or in part) the message text
sent by the RADIUS server with the
proxy-auth_map sdi
command from tunnel-group webvpn
configuration mode.
The default message text used by the ASA is the default message text used by
Cisco Secure Access Control Server (ACS). If you are using Cisco Secure ACS, and it is using the
default message text, you do not need to configure the message text on the ASA. Otherwise, use the
proxy-auth_map sdi
command to ensure the message text matches.
Table 70-3
shows the message code, the default RADIUS reply message text, and the function of each
message. Because the security appliance searches for strings in the order that they appear in the table,
you must ensure that the string you use for the message text is not a subset of another string.
For example, “new PIN” is a subset of the default message text for both new-pin-sup and
next-ccode-and-reauth. If you configure new-pin-sup as “new PIN”, when the security appliance
receives “new PIN with the next card code” from the RADIUS server, it will match the text to the
new-pin-sup code instead of the next-ccode-and-reauth code.
Table 1-3
SDI Op-codes, Default Message Text, and Message Function
Message Code
Default RADIUS Reply
Message Text
Function
next-code
Enter Next PASSCODE
Indicates the user must enter the NEXT tokencode
without the PIN.
new-pin-sup
Please remember your
new PIN
Indicates the new system PIN has been supplied and
displays that PIN for the user.
Содержание 5505 - ASA Firewall Edition Bundle
Страница 28: ...Glossary GL 24 Cisco ASA Series CLI Configuration Guide ...
Страница 61: ...P A R T 1 Getting Started with the ASA ...
Страница 62: ......
Страница 218: ...1 56 Cisco ASA Series CLI Configuration Guide Chapter 1 Managing Feature Licenses Feature History for Licensing ...
Страница 219: ...P A R T 2 Configuring High Availability and Scalability ...
Страница 220: ......
Страница 358: ...1 22 Cisco ASA Series CLI Configuration Guide Chapter 1 Information About Failover Failover Messages ...
Страница 403: ...P A R T 2 Configuring Interfaces ...
Страница 404: ......
Страница 499: ...P A R T 2 Configuring Basic Settings ...
Страница 500: ......
Страница 516: ...1 16 Cisco ASA Series CLI Configuration Guide Chapter 1 Configuring Basic Settings Monitoring DNS Cache ...
Страница 533: ...P A R T 2 Configuring Objects and Access Lists ...
Страница 534: ......
Страница 558: ...1 4 Cisco ASA Series CLI Configuration Guide Chapter 1 Information About Access Lists Where to Go Next ...
Страница 601: ...P A R T 2 Configuring IP Routing ...
Страница 602: ......
Страница 632: ...1 8 Cisco ASA Series CLI Configuration Guide Chapter 1 Defining Route Maps Feature History for Route Maps ...
Страница 680: ...1 48 Cisco ASA Series CLI Configuration Guide Chapter 1 Configuring OSPF Feature History for OSPF ...
Страница 745: ...P A R T 2 Configuring Network Address Translation ...
Страница 746: ......
Страница 780: ...1 34 Cisco ASA Series CLI Configuration Guide Chapter 1 Information About NAT Where to Go Next ...
Страница 844: ...1 32 Cisco ASA Series CLI Configuration Guide Chapter 1 Configuring Twice NAT Feature History for Twice NAT ...
Страница 845: ...P A R T 2 Configuring AAA Servers and the Local Database ...
Страница 846: ......
Страница 859: ...1 13 Cisco ASA Series CLI Configuration Guide Chapter 1 Configuring AAA Servers and the Local Database Configuring AAA ...
Страница 871: ...1 25 Cisco ASA Series CLI Configuration Guide Chapter 1 Configuring AAA Servers and the Local Database Configuring AAA ...
Страница 981: ...P A R T 2 Configuring Access Control ...
Страница 982: ......
Страница 994: ...1 12 Cisco ASA Series CLI Configuration Guide Chapter 1 Configuring Access Rules Feature History for Access Rules ...
Страница 1028: ...1 34 Cisco ASA Series CLI Configuration Guide Chapter 1 Configuring Management Access Feature History for Management Access ...
Страница 1054: ...1 26 Cisco ASA Series CLI Configuration Guide Chapter 1 Configuring AAA Rules for Network Access Feature History for AAA Rules ...
Страница 1060: ...1 6 Cisco ASA Series CLI Configuration Guide Chapter 1 Configuring Web Cache Services Using WCCP Feature History for WCCP ...
Страница 1061: ...P A R T 2 Configuring Service Policies Using the Modular Policy Framework ...
Страница 1062: ......
Страница 1093: ...P A R T 2 Configuring Application Inspection ...
Страница 1094: ......
Страница 1191: ...P A R T 2 Configuring Unified Communications ...
Страница 1192: ......
Страница 1333: ...P A R T 2 Configuring Connection Settings and QoS ...
Страница 1334: ......
Страница 1370: ...1 20 Cisco ASA Series CLI Configuration Guide Chapter 1 Configuring QoS Feature History for QoS ...
Страница 1379: ...P A R T 2 Configuring Advanced Network Protection ...
Страница 1380: ......
Страница 1448: ...1 20 Cisco ASA Series CLI Configuration Guide Chapter 1 Configuring Threat Detection Configuration Examples for Threat Detection ...
Страница 1474: ...1 18 Cisco ASA Series CLI Configuration Guide Chapter 1 Configuring Filtering Services Monitoring Filtering Statistics ...
Страница 1475: ...P A R T 2 Configuring Modules ...
Страница 1476: ......
Страница 1504: ...1 28 Cisco ASA Series CLI Configuration Guide Chapter 1 Configuring the ASA IPS Module Feature History for the ASA IPS module ...
Страница 1528: ...1 24 Cisco ASA Series CLI Configuration Guide Chapter 1 Configuring the ASA CX Module Feature History for the ASA CX Module ...
Страница 1548: ...1 20 Cisco ASA Series CLI Configuration Guide Chapter 1 Configuring the ASA CSC Module Feature History for the CSC SSM ...
Страница 1549: ...P A R T 2 Configuring VPN ...
Страница 1550: ......
Страница 1592: ...1 42 Cisco ASA Series CLI Configuration Guide Chapter 1 Configuring IPsec and ISAKMP Supporting the Nokia VPN Client ...
Страница 1612: ...1 20 Cisco ASA Series CLI Configuration Guide Chapter 1 Configuring L2TP over IPsec Feature History for L2TP over IPsec ...
Страница 1796: ...1 6 Cisco ASA Series CLI Configuration Guide Chapter 1 Configuring the PPPoE Client Using Related Commands ...
Страница 1965: ...P A R T 2 Configuring Logging SNMP and Smart Call Home ...
Страница 1966: ......
Страница 1988: ...1 22 Cisco ASA Series CLI Configuration Guide Chapter 1 Configuring Logging Feature History for Logging ...
Страница 2002: ...1 14 Cisco ASA Series CLI Configuration Guide Chapter 1 Configuring NetFlow Secure Event Logging NSEL Feature History for NSEL ...
Страница 2036: ...1 34 Cisco ASA Series CLI Configuration Guide Chapter 1 Configuring SNMP Feature History for SNMP ...
Страница 2059: ...P A R T 2 System Administration ...
Страница 2060: ......
Страница 2098: ...1 8 Cisco ASA Series CLI Configuration Guide Chapter 1 Troubleshooting Viewing the Coredump ...
Страница 2099: ...P A R T 2 Reference ...
Страница 2100: ......