Cisco 5505 - ASA Firewall Edition Bundle, Руководство по настройке CLI

Страница: 546 / 2164

1-12
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring Objects
Configuring Objects
The ASA sends an LDAP query to the Active Directory server for user groups globally defined in the
Active Directory domain controller. The ASA imports these groups for identity-based rules. However,
the ASA might have localized network resources that are not defined globally that require local user
groups with localized security policies. Local user groups can contain nested groups and user groups that
are imported from Active Directory. The ASA consolidates local and Active Directory groups.
A user can belong to local user groups and user groups imported from Active Directory.
Prerequisites
See Chapter 1, “Configuring the Identity Firewall,” to enable IDFW.
Detailed Steps
Command Purpose
Step 1
object-group user user _ group_name
Example:
hostname(config)# object-group user users1
Defines object groups that you can use to control access with the
Identity Firewall.
Step 2
Add one or more of the following group members:
user domain_NetBIOS_name \ user_name
Example:
hostname(config-user-object-group)# user
SAMPLE\users1
Specifies the user to add to the access rule.
The user_name can contain any character including [a-z], [A-Z],
[0-9], [!@#$%^&()-_{}. ]. If domain_NetBIOS_name \ user _ name
contains a space, you must enclose the domain name and user
name in quotation marks.
The user _ name can be part of the LOCAL domain or a user
imported by the ASA from Active Directory domain.
If the domain_NetBIOS_name is associated with a AAA server,
the user _ name must be the Active Directory sAMAccountName,
which is unique, instead of the common name (cn), which might
not be unique.
The domain_NetBIOS_name can be LOCAL or the actual domain
name as specified in user - identity domain
domain_NetBIOS_name aaa - server aaa _ serve r_ group _ tag
command.
group-object group_id
Example:
hostname(config-network)# group-object
Engineering_groups
Adds an existing object group under this object group. The nested
group must be of the same type.
Step 3
description text
Example:
hostname(config-protocol)# description New
Group
(Optional) Adds a description. The description can be up to 200
characters.