Authentication by group in LDAP for VPN without DAP? Is there a way to allow access to SSLVPN services based on groups in AD without configuring DAP? I know with DAP you can easily do this - however - the company that manages the firewall would have to create a 'service exception' for this type of config - which takes a long time and the asking party would like to move ahead with a solution rapidly, so I'm looking for alternatives.

Would using Radius be an option? You can differentiate AD groups using radius attribute 25 (class). Full walk through from Jeff Boyer on the Cisco forums may be found at:

<