Configure AAA settings for a remote access VPN policy

In Authentication, Authorization & Accounting (AAA), you can configure the AAA parameters for the remote access VPN policy. You can configure authentication alone, or with authorization and accounting.

Before you begin

Configure the protocols and devices, and the connection profile for a remote access VPN policy as described in Configure a remote access VPN policy.

Procedure

Step 1	From the Authentication Method drop-down list, choose an authentication method. Authentication is the way a user is identified before being allowed access to the network and network resources. Authentication requires valid user credentials, a certificate, or both. AAA Only—Each user is authenticated using LOCAL authentication, RADIUS, AD, or LDAP servers. SAML—Each user is authenticated using a SAML single sign-on (SSO) server. For more information, see Authenticate remote access VPN users using SAML SSO. Client Certificate Only—Each user is authenticated using a client certificate. For more information, see Authenticate remote access VPN users using client certificates. Client Certificate & AAA—Each user is authenticated using client certificates and AAA methods such as LOCAL authentication, RADIUS, AD, and LDAP servers. Client Certificate & SAML—Each user is authenticated using client certificates and a SAML SSO server. You can also configure secondary authentication in addition to primary authentication to provide more security for VPN sessions. It applies only to AAA-only and Client Certificate & AAA authentication methods. For more information, refer to Authenticate remote access VPN users using secondary authentication.
Step 2	From the Authentication Server drop-down list, choose an authentication server. You can click + to configure a LOCAL realm, LDAP realm, AD realm, or a RADIUS server group. LOCAL—Configure LOCAL user settings using this realm. You can define users directly on the device and not use an external server. To configure LOCAL authentication, Firewall Threat Defense must be Version 7.0 and later. Active Directory/LDAP—Configure Microsoft Active Directory or LDAP server as an external authentication source using this realm. For more information, refer to Create an LDAP realm or an Active Directory realm and realm directory. RADIUS Server Group—Add a RADIUS server group object with one or more RADIUS servers. For more information, refer to Add a RADIUS server group.
Step 3	(Optional) Check the Fallback to LOCAL Authentication check box to enable authentication of users using the LOCAL database if the AAA server group is unavailable, provided that the LOCAL database is configured. When you check this option, choose a LOCAL realm from the LOCAL Realm drop-down list.
Step 4	From the Authorization Server drop-down list, choose an authorization server. Once authentication is complete, authorization determines which services and commands each authenticated user can access. Authorization functions by gathering a set of attributes that define the user's permitted actions, capabilities, and any restrictions. Without authorization, all authenticated users have the same level of access. Authorization always requires authentication. For more information about authorization attributes, refer to Manage user authorization attributes in remote access VPN policies. When you set up a RADIUS server for user authorization, you can define multiple authorization attributes on the server for individual users or user groups. After a successful authentication, the specific authorization attributes are pushed to the Firewall Threat Defense device. For more information about RADIUS authorization attributes, refer to Appendix B: RADIUS server attributes for Firewall Threat Defense devices.
Step 5	From the Accounting Server drop-down list, choose a RADIUS server group object as the accounting server. Accounting tracks the services users access and the network resources they consume. When AAA accounting is enabled, the network access server sends user activity details such as session start and stop times, usernames, bytes transferred, services used, and session durations to the RADIUS server. You can use this data for network management, billing, and auditing. You can use same or different RADIUS servers for AAA.