Default group with AnyConnect

I've stumped myself, and think I've been staring at this too long. I have our ASA configured so that when an AnyConnect client connects, before any username or password is entered, the correct group is selected for the client in the "Group" field. If someone selects another group from the dropdown, it will reset back to the correct one BEFORE they enter any credentials. We don't care from what IP or source network the connection originates. Nothing complex happens about the decision making. One group for everyone, and the other group choices are for my own testing. What I can't seem to recall is how I did this--and it was actually on purpose. Now I need this disabled so I can do some testing with those other group choices.
How did I make Anyconnect use the correct group before any authentication is done? No certificates are being used to authenticate, nothing at all at this stage. A clean, freshly installed client that has never connected will select the correct group after the user enters our ASA's hostname & clicks connect (or enter).
I must be missing something so simple, although I do sometimes find unique approaches to a solution and may have done something unusual to accomplish this. I hope someone will see this and say "you did this....". I've looked at the config dozens of times, can't find any rules or policies to explain this. It could be this was accomplished simply by disabling something on the other profiles, but I can't find what that might be. All are configured for both clientless & SSL connections. All have aliases & show in the client.
Feeling 'toopid here. ASAs are running 8.4(7)3. AnyConnect is 3.1.05152
Hope this somehow makes sense to someone.

Not quite as deliberate as I thought. Told you I'd looked at it too long.
Turns out it appears I've discovered a bug in 3.1.05152. I went back to 2.5.6005 and I could pick any group I wanted & it would stick. Removed that and installed 3.1.04066--worked fine. Went back to 3.1.05152 and it will only let me select the first group unless I manually edit the .anyconnect file (in Linux) and type in another group name there.
I've repeated this with both Windows & Linux 64-bit OS versions. It might be related to our environment & the fact that we don't use customized profiles or certificates for auth, but in the most simple authentication config it seems reproducable.
Banged my head on the wall for hours chasing this, and it's a likely bug!

Similar Messages

Restricting end user to one specific group with anyconnect

Hello all
I just started configuring AnyConnect with ASA 5520 that uses Cisco SecureACS to pass radius authentication. I configured two profiles with different split tunnel restrictions and what I discovered is that when the client connects to the ASA, they are provided a choice of these two groups (I guess there is no way to restrict this) and I can log into either one with any user account. How do I restrict this so that the user can only use one profile? Currently users capable of VPN would be placed in one specifc AD group so that is what SecureACS checks. Is there a sample configuration guide to handle multiple profiles with different levels of access?

Alternatively, you can use Radius authorization to place user into a specific group-policy:
- Configure the Group-Policy attribute under Radius to be OU=
http://www.cisco.com/en/US/docs/security/asa/asa91/configuration/vpn/vpn_extserver.html#wp1605475
On the ASA, just configure 1 tunnel-group, and depending on the authentication, the user will be placed into the correct group-policy specified under the ACS server.

Set a default group and permissions on upload.

All I need is for any new files uploaded to the server's sharepoint be set to a certain default group with certain default permissions (admin, r/w). I can change files manually, but I don't want to have to be doing this every few hours.
I am familiar with the concept of permissions, but I have never been successful in finding anything that would set default permissions.

Ever used inherited permissions?
Files and folders can be made to inherit permissions from the folder you put them in...

Physical interface Default Gateway connecting VPN with AnyConnect

When I connect vpn with AnyConnect, I can't see default gateway on Physical Interface.
before connect vpn
==========================================
C:\WINDOWS\system32>ipconfig
Windows IP Configuration
Ethernet adapter Local Area
        Connection-specific DNS Suffix . :
        IP Address. . . . . . . . . . . . : 10.1.1.100
        Subnet Mask . . . . . . . . . . . : 255.255.255.0
        Default Gateway . . . . . . . . . : 10.1.1.10
after connect vpn with anyconnect
==========================================
C:\WINDOWS\system32>
C:\WINDOWS\system32>ipconfig
Windows IP Configuration
Ethernet adapter Local Area
        Connection-specific DNS Suffix . :
        IP Address. . . . . . . . . . . . : 10.1.1.100
        Subnet Mask . . . . . . . . . . . : 255.255.255.0
        Default Gateway . . . . . . . . . :'Can't see default gateway'
Is this the specification of Anyconnect?

Nyanko,
This will happen when you are using tunnel all as the split tunneling policy, the computer will encrypt all the traffic so the default gateway will be removed from the physical connection and placed into the virtual adapter. If you take a look at the routing table you will see that what really happens is that the original default route's metric will be changed so that it is higher than the one injected by the virtual adapter, once you disconnect it should go back to normal.
Further information on split tunneling:
http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080975e83.shtml
HTH
Jonnathan

Group Policy For 2008 Terminal Server Users Default Open With Not Working

I'm trying to change the default open with behavior for jpg files on my terminal server. I created a Group Policy that changed it to MS Paint to Office 2010 Picture Manager. The policy appears to apply correctly but jpg files still open in
Paint. When a user is logged on, if they look at the properties of a jpg, it shows Photo Gallery as the program to open it but when opened, it opens in Paint.
Has anyone seen this behavior before?
Orange County District Attorney

> did. It would be helpful to know where the changes actually go in the
> registry to see if they did or now.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts
Martin
Mal ein
GUTES Buch über GPOs lesen?
NO THEY ARE NOT EVIL, if you know what you are doing:
Good or bad GPOs?
And if IT bothers me - coke bottle design refreshment :))

What is the default group id/ home /shell while adding new account with useradd without specifying these parameters?

What is the default group id/ home /shell while adding new account with useradd without specifying these parameters?
reagrds

Hi,
You can check the default values from the below file
/usr/sadm/defadduser
and from this command
#useradd -D

Vpn-framed-ip-address not working with anyconnect

Hi Folks, please help me to verify if this case is a bug or a "not valid scenario".
Scenario:
ASA 5520, OS 9.1, SSL VPN with Anyconnect v3.x, static ip address for the client, and RSA token authentication (all the users/pin/passwords are in the RSA server, not in the ASA, but i need to create some users in the ASA in order to apply the vpn-framed-ip-address attribute for specific users).
In fact the anyconnect ssl vpn with RSA auth works fine, the ssl connection works, the user is authenticated, the anyconnect works, traffic passing, BUT.. the anyconnect its getting an ip address from the ip local pool INSTEAD of the static ip defined with the vpn-framed-ip-address command.
I'm trying to assign a static ip address for a user (defined locally on the ASA) that performs auth via RSA (aaa-server), by using the vpn-framed-ip-address command as an attribute for this local user. But it seems the command is not working.
Already I´ve tried to resolve (with no success) by entering the
no vpn-addr-assign aaa
no vpn-addr-assign dhcp
vpn-addr-assign local
Also i´ve tried by removing the pool from tunnel-group in order to force all the connection session to use the static ip address, but in this case, the anyconnect sends a message "No Address Available for SVC Connection". Meaning the ASA simply is ignoring the vpn-framed-ip-address command.
Its supposed the ASA implement the policies in this order, DAP > User policy > UserGrp policy > ConnProfile > DefGrpPolicy, and according to this, the vpn-framed-ip-address command should take effect first since its specified as User policy, overriding everything else. But its not working.
At this point i think the issue is... since the user is locally defined but its password its being authenticated via RSA (not local), the user attributes (static ip) are being ignored by the ASA because its not expecting to receive an ip address from the aaa server (RSA), so jumps to the next policies falling to the pool. Anyway the user policies attributes SHOULD work according to cisco.
Please your advise, or tell if its a bug? or a not valid scenario for this command to work with the ASA.
This is the current config:
ip local pool PoolSSL 192.168.229.10-192.168.229.19 mask 255.255.255.0
aaa-server RSA protocol sdi
aaa-server RSA (inside) host 192.168.12.1
retry-interval 5
no vpn-addr-assign aaa
no vpn-addr-assign dhcp
group-policy GroupPolicyABC internal
group-policy GroupPolicyABC attributes
wins-server none
dns-server value 192.168.61.1 192.168.61.2
vpn-tunnel-protocol ssl-client
group-lock value TunnelGroupABC
split-tunnel-policy tunnelspecified
split-tunnel-network-list value ServersDB
default-domain value my.domain.com
split-tunnel-all-dns disable
webvpn
anyconnect ask none default anyconnect
username USER1 password xHhacRZ56Uadqoq encrypted
username USER1 attributes
vpn-framed-ip-address 192.168.229.7 255.255.255.0
group-lock value TunnelGroupABC
tunnel-group TunnelGroupABC type remote-access
tunnel-group TunnelGroupABC general-attributes
address-pool PoolSSL
authentication-server-group RSA
default-group-policy GroupPolicyABC
tunnel-group TunnelGroupABC webvpn-attributes
group-alias AccessToDB enable
I´ll wait for your answers, regards!

https://tools.cisco.com/bugsearch/bug/CSCtf71671/
you need AAA assignment, or at least you needed to have it a couple of years back.

Two groups with the same name in File and LDAP realms

Hi,
I configured WLS 6.0 SP1 to use an LDAP caching realm
as default one. In the LDAP server (Netscape Directory)
I have a group called Administrators. There is a group
with the same name in WLS own File Realm. When I click
on the Groups menu item in the administration console
I only get the Administrators group from the File Realm
listed. Is that expected? What will happen if I protect
a resource ti the Administrators group? Which one will
prevail - the one from the LDAP or the one from File
Realm? Or maybe the two will be merged?
Regards,
Plamen Petrov
AstraZeneca
Sweden

Hi
First of all I want to know that where you created your class, In SE24 or in any programm.
if in SE24, then go to se24 open that class go to methods tab and check if that method name accurs at two places, if not, then
click on that method and check the code.
or if in a program.
then you must have defined like
class <class name> definition.
public section
method <method name>
endclass.
class <class name> implementation.
method <method name>
code for that method.
endclass.
It might be possible you have set the implementation part twice for that particular method, So please check and delete one implementation for that method.
Thanks
Lalit Gupta

HOW CAN I CREATE A GROUP WITH MY CONTACTS FOR TEXTING

HOW CAN I CREATE A GROUP WITH MY CONTACTS FOR TEXTING

Olga, this is not a default feature in iPhone. You need a 3rd party application. I have created a free one, Easy Group, for group texting and group emailing.
http://itunes.apple.com/fr/app/easy-group/id461469079?mt=8
Rémi
Note: I may receive some form of compensation, financial or otherwise,from my recommendation or link.

How to create a transaction code for a function group with screen 100 as st

Hello ,
I have requirement where I need to create a function group and create screen 100, 200, 300 and include the function in the screens.
Customer asked me to create a transaction with the screen 100 as the starting screen.
Can you please let me know how to create a transaction code for a function group with screen 100 as starting screen.
[ It is not a module pool program ].
Thanks
Prashanth.
Moderator message - Please ask a specific question and do not ask the forum to do your work for you - post locked
Edited by: Rob Burbank on Jun 2, 2009 11:49 AM

Go to transaction SE93, enter a transaction code that you want and click on "create". Enter a text and select the "Transaction with Parameters" button. In the Default Values section, enter START_REPORT in the transaction field. Check the "skip initial screen" box. In the Name of Screen field section enter the following lines:
Name of screen field:                               Value
D_SREPOVARI-REPORTTYPE                RW
D_SREPOVARI-REPORT                        ZPCA
Save and transport accordingly.

How to set default group in EXS24 patch?

Hi,
This question is about the EXS24 sampler in MainStage 3. I'm in no way an EXS24 expert, so I'm hoping this is an easy one - I can't find it in the manual anywhere though. I'm working with some EXS24 patches that have been supplied to me for a live project, reproducing the recorded version using those patches. They are set up with keyswitches to select sample groups to allow the use of different articulations. The question I have is how to set the default group - so that every time the patch loads (for example) it selects the legato articulation group, instead of defaulting to staccato as it does at present. I've thought about scripting MainStage to send the keyswitch on load of the patch but that seems like a lot of effort to fix something that surely must be an easy fix I'm missing. From what I can tell, the last group defined is the one that loads automatically - but I can't find any way of changing the order of the groups - I can sort the view, but that makes no difference to the behaviour.

Hello Gaurav,
If I understood correctly, Your requirement is to update People Group segments based on employee category.
Basically you need to update people group values based on employee category before insert into assignment table.
You can acheive this using Dynamic Trigger on Assignment Table.
you need to change the new.people_group_id along with other segment values in this trigger logic.
Following articles will help you steps on how to create dyanamic triggers.
http://oracle.anilpassi.com/dynamic-triggers-in-hrms-payroll-demo.html
http://apps2fusion.com/apps/oracle-hrms/oracle-hr/204-triggers-in-oracle-hrms-and-payroll
Regards,
Saurabh

Some of the build-in panels are grouped with my plugin's panel in InDesign CC

My settings for PanelList look like this:
resource LocaleIndex (kSDKDefPanelResourceID)
{ kViewRsrcType,
{ kWildFS, k_Wild, kSDKDefPanelResourceID + index_enUS }
/* PanelList definition.
resource PanelList (kSDKDefPanelResourceID)
    // 1st panel in the list
    kSDKDefPanelResourceID, // Resource ID for this panel (use SDK default rsrc ID)
    kMyPluginID, // ID of plug-in that owns this panel
    kIsResizable,
    kMTPanelWidgetActionID, // Action ID to show/hide the panel
    "MyPlugin:Test", // Shows up in the Window list.
    "", // Alternate menu path of the form "Main:Foo" if you want your palette menu item in a second place
    0.0, // Alternate Menu position Alternate Menu position for determining menu order
    kMyImageRsrcID, kMyPluginID, // Rsrc ID, Plugin ID for a PNG icon resource to use for this palette (when not active)
    c_Panel
resource MTPanelWidget(kSDKDefPanelResourceID + index_enUS)
__FILE__, __LINE__,     // Localization macro
kMTPanelWidgetID,       // WidgetID
kPMRsrcID_None,         // RsrcID
kBindAll,              // Binding (0=none)
0, 0, 320, 386,         // Frame: left, top, right, bottom.
kTrue, kTrue,           // Visible, Enabled
kTrue,                 // Erase background
kInterfacePaletteFill, // Erase to color
kMTPanelTitleKey,       // Panel name
"MyPlugin" // Popup menu name (internal)
The problem is that when I click Window->MyPlugin->Test the built-in panels Articles, Liquid Layout and CrossReferences are also opened and grouped with my panel. I can't understand what I am doing wrong. The situation is the same with all sdk samples that have panels. Please help. 10x in advance.

Hi, I had the same problem with mine. I've managed to partially fix it by using a workspace extension.
This is the documentation for it:
Remove the InDesign preferences folder. This ensures that changes made to the workspace extensions appear when InDesign is launched.
Launch InDesign with your plug-ins loaded, so your panels are available in the user interface.
Organize the panels as you want your user to see them for the first time.
Exit InDesign normally.
Locate the “Essentials_CurrentWorkspace.xml” file in the InDesign preferences folder. Duplicate the file and rename the duplicate to the name that you want to use for this workspace extension.
Distribute/Copy the workspace-extension XML file in the InDesign Workspace Extension folder (<app folder>/Presets/InDesign Workspaces/en_US/Workspace Extensions). If the “Workspace Extensions” folder does not exist, create it. The easiest way to distribute the workspace-extension XML file might be in the same installer used to install your plug-ins.
I followed that, and my panels appeared in their own group, as I had laid them out.
However, if I didn't delete my user preferences, the ordering and position was different to how I'd laid them out.
Launch InDesign - move standard panels to make a custom user layout - install plugin - relaunch InDesign - launch plugin panels:
The panels seemed to appear in a random position and order, but in their own tab group - no longer bundled with Artices etc
Then delete user prefs - relaunch InDesign - launch plugin panels:
My custom panel layout appears exactly correct over the default workspace layout.
Obviously, you don't want the user to have to delete their preferences and lose their custom layout, so it's not perfect, but at least it got rid of Articles etc. If your plugin is a single panel, it might just do what you need.
I expect there's a way to solve the random position/order too - I just haven't found it!

Show groups with zero in crosstab

Post Author: JustinP
CA Forum: Crystal Reports
I am trying to get my crosstab to show groups with zeros in it, instead of suppressing it like it is doing. Any ideas?
Thanks in advance!

Post Author: DesertRecluse
CA Forum: Crystal Reports
I don't think Crystal suppresses 0 totals by default. Did you check the field format?

What are default group permissions supposed to look like?

I'm struggling with permissions under Leopard (I understand many others are as well). My quick and dirty question is: what are the default user & group ID numbers for a fresh leopard client install?
I've only done archive & installs lately so no longer have a test bed to compare from. Currently on one machine user id and group id (GID) are BOTH 501. I think Leopard has moved the default user IDs to 1000 (on up) and the default group ID to 20 (staff).
When moving files between machines at one installation the group is coming across as "Unknown" from a Leopard server. Trying to Get Info on these files and unlocking the padlock in Get Info window will crash the Finder!! So I guess i'd like to change the group IDs so they're consistent on all machines. Didn't have this problem with Tiger.
Thanks for any help!
-MD

OK, so followed the instructions in <http://docs.info.apple.com/article.html?artnum=307128> and things were fine until i updated to 10.5.2. Now if I choose Get Info on a file in any external drive there is no longer a padlock under Sharing & Permissions. It only says "You can read and write" and that's it. No list of owner (Me), groups, everyone. they're not even listed anymore and the padlock is GONE!
ls -l in Terminal gets me lists like
drwxr-xr-x 6 steve _steve 204 Dec 8 2004 Hüsker Dü
and ls -ln returns:
drwxr-xr-x 6 501 501 204 Dec 8 2004 Hüsker Dü
i don't think i like the 501 501 thing. i'd prefer 501 20 .
anything i should be aware of before changing the group across the board to 20? (i'd also like to change the user folder from 501 501 to 501 20). should i use the dscl command, i used to try to get out of this mess before, somehow?
Permissions under 10.5 has sadly become a real mess! reminds me of 10.0 days...

Where is the default group information stored for a portal user?

Hello -
There is a field in the WWSEC_PERSON$ table called DEFAULT_GROUP, and it is populated with an ID from the WWSEC_GROUP$ table but it seems like there is more to the overall picture here.
If I try to manually update a users group via SQL,
UPDATE WWSEC_PERSON$ SET DEFAULT_GROUP = 318 WHERE USER_NAME = 'XXXXXXX'
Then check the portal profile for the user 'XXXXXXX' I do not see their 'Default Group' as being updated. (However the default group is in effect because these users are sent to the correct group when they log in.
What do I need to modify for the group name to show up for the user on their profile page?

Yannick -
Thank you for the reply. Do you know which table is used in OID? Basically why I need to do this is we hire many new employees every week and create accounts in AD. We sync AD -> OID but the people who create the new users never inform me that they have been created so they never get a default group assigned. This causes them to go to the 'Portal Builder' page when they login to the portal.
To fix this issue Im writing a powershell script to automatically update the default group of all employees that do not have a default group assigned. Do you know if a better method I can accomplish this for bulk OID records automatically? I'm very much open new/better ideas this was the best method I could think of currently.
Thanks again.

Default group with AnyConnect

Similar Messages

Maybe you are looking for