Secure Firewall RAVPN: Dynamic Group Policy Assignment with LDAP

Good morning, everyone.04:24And welcome to the Cisco cyber Caption. My name is Luca Chicarollo and I am security customer success specialist at Cisco. Today, we are going to talk about secure firewall remote access VPN and specifically how to perform dynamic group policy assignments.04:26With LDAP. We will start with a remote access VPN overview and then I will show you a demo about the configuration. Let's start with the general overview.04:44We have a remote host trying to connect to some private internal corporate resources or applications over the public internet. The remote users starts a VPN connection by using Cisco secure client.05:00Via SSL or IPsec IP two protocol. The firewall will authenticate the user and depending on the identity will apply a different group policy granting specific application access. To leverage remote access VPN, we need secure.05:15Client licenses. These licenses depend on the number of users leveraging the VPN services. VPN only licenses offer basic VPN functionalities and they are ideal for organizations with unpredictable number of users.05:35Advantage and Premier, they include more features and they are counted per unique user. There are two important configuration concepts we need to understand when configuring remote access VPN.05:54The connections profiles and the group policy. The connections profiles define how to connect and authenticate to the VPN server. The group policies define the specific access and authorization to each user or group of users.06:10The recommendations here is to dynamically assign group policy to a VPN connection by using LDAP, radius or SAML attributes which are part of the authentication response.06:30At the very high level, step one, the user initiates a VPN connections via TLS DTLS or IPsec IP two. The FTD will select the active connections profile and will authenticate the user.06:49At step three, depending on the authentication methods and results, a group policy is dynamically assigned, including information such as the IP address pool, the DNS, and the split tunneling policy.07:06For the remote user. Step four, once the group policy is assigned, we can control explicitly, we can control the traffic explicitly via the access control policy or by allowing it by default.07:22I hope this video has been helpful for you and I would like to thank you for viewing. Okay, let's now go to the demo. As part of this demo today, I want to show you how to configure the remote access VPN with a dynamic group policy assignment.07:38As a result of the LDAP.07:58Authentication method. This is my FMC, I will go to remote access VPN and create a new VPN configuration. I will give a name and I will select my firewall.08:00Here is where I have my new connection profile. As an authentication method, I will select my active directory server and later on I will show you this feature. I will select an IP address pool, and I will create new group policies.08:22The 1st group policy, I will call it access denied because by default, I want users not belonging to any active Directory group, not to access my VPN services. I will configure zeros.08:41Zero as the simultaneous login per user parameter and click on save. Now I will create two new group policy. 1st, going to be TAC group policy for my TAC users. I will assign.08:57An address pool for tag people, put it abonder, welcome to the tag group policy. Configure the DNS for the connection, and for the speed tunneling policy.09:14I will allow the TAC users to access only the ICE server and for the next request, only request to my private domain will be redirected through the tunnel.09:33This is the group policy for TAC users. I will do the same for contractors, I will assign a dynamic, an IP address pool.09:51Welcome to the contractor group policy DNS, and the state tunneling policy. Now, for contractors.10:08I want my contractors only to access my application named app one and the DNS request must go through the tunnel only for the specific domain. By default.10:25I want this specific VPN connections profile to apply the access denied policy. And now I will show you how we can assign dynamic group policy by using the LDAP attribute map feature.10:41So my real is my active directory server and I want here to map the LDAP attribute name with the Cisco attribute name. So in my case, I want to map the attribute member off.10:58With a specific group policy. Now, for the value maps attribute value, I have my active directory here where I have two users. My user Luca, is member of.11:16Tag group. This tag group Active Directory Group has a specific distinguished name. I will copy this distinguished name as part of my LDAP attribute value.11:32And I will map this attribute value to the group policy named TAC GP. I have a different user in Active directory.11:48Name Lorenza, and this user is a member of contractor group. This active Directory group is named contractor group and comes with this distinguished name.12:04So, as well as before, I will copy this distinguished name for my group and that will dynamically back to my contractor group policy. I will click on next. I will see, I will select the secure client image.12:20And informations about the network interface for the incoming VPN access, the FTD identity certificates, and I will select the bypass access control policy for VPN traffic.12:39