Cisco ASA 5505 - Manual (Page 1447)

67-21
Cisco ASA 5500 Series Configuration Guide using the CLI
Chapter 67 Configuring Connection Profiles, Group Policies, and Users
Configuring Connection Profiles
The authentication-server-group name identifies a previously configured authentication server or group
of servers. Use the aaa-server command to configure authentication servers. The maximum length of
the group tag is 16 characters.
You can also configure interface-specific authentication by including the name of an interface in
parentheses before the group name. The following interfaces are available by default:
• inside—Name of interface GigabitEthernet0/1
• outside— Name of interface GigabitEthernet0/0
Other interfaces you have configured (using the interface command) are also available. The following
command configures interface-specific authentication for the interface named outside using the server
servergroup1 for authentication:
hostname(config-tunnel-general)# authentication-server-group (outside) servergroup1
hostname(config-tunnel-general)#
Step 3 Optionally, specify the name of the authorization-server group, if any, to use. If you are not using
authorization, go to Step 6. When you configure this value, users must exist in the authorization database
to connect:
hostname(config-tunnel-general)# authorization-server-group groupname
hostname(config-tunnel-general)#
Use the aaa-server command to configure authorization servers. The maximum length of the group tag
is 16 characters.
For example, the following command specifies the use of the authorization-server group FinGroup:
hostname(config-tunnel-general)# authorization-server-group FinGroup
hostname(config-tunnel-general)#
Step 4 Specify whether to require a successful authorization before allowing a user to connect. The default is
not to require authorization.
hostname(config-tunnel-general)# authorization-required
hostname(config-tunnel-general)#
Step 5 Specify the attribute or attributes to use in deriving a name for an authorization query from a certificate.
This attribute specifies what part of the subject DN field to use as the username for authorization:
hostname(config-tunnel-general)# authorization-dn-attributes {primary-attribute
[secondary-attribute] | use-entire-name}
For example, the following command specifies the use of the CN attribute as the username for
authorization:
hostname(config-tunnel-general)# authorization-dn-attributes CN
hostname(config-tunnel-general)#
The authorization-dn-attributes are C (Country), CN (Common Name), DNQ (DN qualifier), EA
(E-mail Address), GENQ (Generational qualifier), GN (Given Name), I (Initials), L (Locality),
N (Name), O (Organization), OU (Organizational Unit), SER (Serial Number), SN (Surname),
SP (State/Province), T (Title), UID (User ID), and UPN (User Principal Name).
Step 6 Optionally, specify the name of the accounting-server group, if any, to use. If you are not using
accounting, go to Step 7. Use the aaa-server command to configure accounting servers. The maximum
length of the group tag is 16 characters.:
hostname(config-tunnel-general)# accounting-server-group groupname
hostname(config-tunnel-general)#
For example, the following command specifies the use of the accounting-server group comptroller: