This Help topic provides instructions for creating LDAP configurations in Access Control that provide authentication and authorization for network end users and host machines via Active Directory.
In Access Control, you can create an Advanced AAA configuration that contains one mapping rule for your host machines and two mapping rules for your users. These mappings are the same except for their LDAP configuration. You need to create two LDAP configurations: one for the hosts mapping and one for the users mapping. The LDAP configurations are identical except for the User Search Attribute. When you have completed these instructions, Access Control uses the new AAA configuration to authenticate both end users and host machines via your Active Directory server.
- Select Control > Access Control > Configuration tab.
- In the left-panel tree, select the AAA tab to open the AAA Configuration window to the right.
- Select the Add button in the AAA Configuration panel create a new AAA Configuration.
- Select LDAP Configuration in the left-panel tree to open the LDAP Configuration window.
- Create an LDAP configuration for use with end users that authenticate to the
network using the sample below as
a guide. Select Save.
- Open the Add LDAP
Configuration window to add another LDAP configuration that will be used
for host machines that authenticate to the network
using the sample below as a guide. Note that the only difference between the two LDAP configurations is the User Search Attribute. Select Save.
- In the left-panel tree, select an AAA Configuration to open the Advanced AAA Configuration window.
- In the Authentication Rules panel of the Advanced AAA Configuration window, select the Add button to open the Add User to Authentication Mapping window.
- Create your first mapping rule
to capture machine authentications using the sample below as a
guide. In the example below, host/*.nac2003.com captures the machine
authentications for the NAC2003 active directory domain. Be sure to select the host LDAP Configuration you create. Select OK.
- Create your second mapping rule to capture end user authentications using the sample below as a
guide. In the example below, *@nac2003.com captures all users logging in to
the NAC2003 active directory domain when they authenticate with their username
in the format <username>@<domain>. Be sure to select the end user LDAP Configuration you create. SelectOK.
- Create your third mapping rule to capture other end user authentications using the sample below as a guide. In the example below, NAC2003\* captures all users logging in to the NAC2003 active directory domain when they authenticate with their username in the format <domain>\<username>. Be sure to select the end user LDAP Configuration you create. Select OK.
- In the left-panel tree, select an AAA Configuration to open the Advanced AAA Configuration window. Use the Up and Down buttons to move your new mappings above the "Any" mappings in the list of mappings. Select Save.
You can configure your LDAP policy mappings and/or LDAP user groups based on the attributes from either your host or user LDAP configurations.
For information on related help topics: