Cisco FirePOWER ASA 5500 series User Manual

30-17
Cisco Security Appliance Command Line Configuration Guide
OL-10088-01
Chapter 30 Configuring Tunnel Groups, Group Policies, and Users
Configuring Tunnel Groups
Configuring WebVPN Tunnel-Group General Attributes
To configure or change the tunnel group general attributes, specify the parameters in the following steps.
Step 1 To configure the general attributes, enter tunnel-group general-attributes command, which enters
tunnel-group general-attributes configuration mode. Note that the prompt changes:
hostname(config)# tunnel-group tunnel_group_name general-attributes
hostname(config-tunnel-general)#
To configure the general attributes for TunnelGroup3, created in the previous section, enter the following
command:
hostname(config)# tunnel-group TunnelGroup3 general-attributes
hostname(config-tunnel-general)#
Step 2 Specify the name of the authentication-server group, if any, to use. If you want to use the LOCAL
database for authentication if the specified server group fails, append the keyword LOCAL:
hostname(config-tunnel-general)# authentication-server-group groupname [LOCAL]
hostname(config-tunnel-general)#
For example, to configure the authentication server group named test, and to provide fallback to the
LOCAL server if the authentication server group fails, enter the following command:
hostname(config-tunnel-general)# authentication-server-group test LOCAL
hostname(config-tunnel-general)#
The authentication-server-group name identifies a previously configured authentication server or group
of servers. Use the aaa-server command to configure authentication servers. The maximum length of
the group tag is 16 characters.
You can also configure interface-specific authentication by including the name of an interface in
parentheses before the group name. The following interfaces are available by default:
• inside—Name of interface GigabitEthernet0/1
• outside— Name of interface GigabitEthernet0/0
Other interfaces you have configured (using the interface command) are also available. The following
command configures interface-specific authentication for the interface named outside using the server
servergroup1 for authentication:
hostname(config-tunnel-general)# authentication-server-group (outside) servergroup1
hostname(config-tunnel-general)#
Step 3 Optionally, specify the name of the authorization-server group, if any, to use. If you are not using
authorization, go to Step 6. When you configure this value, users must exist in the authorization database
to connect:
hostname(config-tunnel-general)# authorization-server-group groupname
hostname(config-tunnel-general)#
Use the aaa-server command to configure authorization servers. The maximum length of the group tag
is 16 characters.
For example, the following command specifies the use of the authorization-server group FinGroup:
hostname(config-tunnel-general)# authorization-server-group FinGroup
hostname(config-tunnel-general)#
Step 4 Specify whether to require a successful authorization before allowing a user to connect. The default is
not to require authorization.

Cisco FirePOWER ASA 5500 series Specifications

General

Brand	Cisco
Model	FirePOWER ASA 5500 series
Category	Firewall
Language	English