Cisco ASA Series Cli Configuration Manual page 900

Task Flow for Configuring the Identity Firewall
AAA Rule and Access Rule Example 2
hostname(config)# access-list listenerAuth extended permit tcp any any
hostname(config)# aaa authentication match listenerAuth inside ldap
hostname(config)# aaa authentication listener http inside port 8888
hostname(config)# access-list 100 ex permit ip user SAMPLE\user1 any any
hostname(config)# access-list 100 ex deny ip user SAMPLE\user2 any any
hostname(config)# access-list 100 ex permit ip user NONE any any
hostname(config)# access-list 100 ex deny any any
hostname(config)# access-group 100 in interface inside
hostname(config)# aaa authenticate match 200 inside user-identity
In this example, the following guidelines apply:
•
In access-list commands, "permit user NONE" rules should be written before the "access-list 100
ex deny any any" to allow unauthenticated incoming users trigger AAA Cut-Through Proxy.
•
In auth access-list command, "permit user NONE" rules guarantee only unauthenticated trigger
Cut-Through Proxy. Ideally they should be the last lines.
VPN Filter Example
Some traffic might need to bypass the Identity Firewall.
The ASA reports users logging in through VPN authentication or a web portal (cut-through proxy) to the
AD Agent, which distributes the user information to all registered ASA devices. Specifically, the IP-user
mapping of authenticated users is forwarded to all ASA contexts that contain the input interface where
HTTP/HTTPS packets are received and authenticated. The ASA designates users logging in through a
VPN as belonging the LOCAL domain.
There are two different ways to apply IDFW rules on VPN users.
•
Apply VPN-Filter with bypassing access-list check disabled
•
Apply VPN-Filter with bypassing access-list check enabled
Configuration Example -- VPN with IDFW Rule -1
By default, "sysopt connection permit-vpn" is enabled and VPN traffic is exempted from access-list
check. In order to apply regular interface based ACL rules for VPN traffic, VPN traffic access-list
bypassing needs to be disabled.
In the this example, if the user logs in from outside interface, the IDFW rules will control what network
resource he can access. All VPN users are be stored under domain LOCAL. Therefore, it is only
meaningful to apply the rules over LOCAL users or object-group containing LOCAL users.
! Apply VPN-Filter with bypassing access-list check disabled
no sysopt connection permit-vpn
access-list v1 extended deny ip user LOCAL\idfw any 10.0.0.0 255.255.255.0
access-list v1 extended permit ip user LOCAL\idfw any 20.0.0.0 255.255.255.0
access-group v1 in interface outside
Configuration ExampleVPN with IDFW Rule -2
By default, "sysopt connection permit-vpn" is enabled, with VPN traffic access bypassing enabled.
VPN-filter can be used to apply the IDFW rules on the VPN traffic. VPN-filter with IDFW rules can be
defined in CLI username and group-policy.
In the example, when user idfw logs in, he is able to access to network resources in 10.0.00/24 subnet.
However, when user user1 loggs in, his access to network resources in 10.0.00/24 subnet will be denied.
Note that all VPN users will be stored under domain LOCAL. Therefore, it is only meaningful to apply
the rules over LOCAL users or object-group containing LOCAL users.
Note: IDFW rules can only be aplpied to vpn-filter under group-policy and are not available in all the
other group-policy features.
Cisco ASA Series CLI Configuration Guide
1-20
Chapter 1 Configuring the Identity Firewall
>> Control VPN user based on regular IDFW ACLs