Trying to setup role mapping based on hostname- help

[mauriceben_]

Hi guys,

I'm trying to setup a role mapping rule based on a custom expression to get either the hostname of the machine connecting to our VPN on our SA6500 or the MAC of the device connecting.

I used the policy tracing to find out that there's a variable that contains the MAC but I can't seem to be able to use it in an expression...

Variable callingStationId = "xx-xx-xx-xx-xx-xx" 

I don't see that variable listed when I'm trying to create a custom expression...

Any of you guys have an idea how this could be done?

Thanks

[kalagesan_]

Hi Maurice Ben,

I understand your requirement , I hope you are using Radius as authentication and Accounting server in your testing.

If you are using radius server, you can use rolemapping based on user attribute instead of custom expressions since user attributes list for radius server will list all standard radius attributes including Calling-Station-ID, Called-Station-ID  etc.

You can make rolemapping based on  user attribute and use  Calling-Station-ID attribute, either you can use complete  mac address or part of MAC address added with wildcard * if you need to allsow set of mac address having similar values in the mac address.

Hope this helps.

Note: If I have answered your questions, you could mark this post as accepted solution, that way it could help others as well. Kudo will be a bonus thanks!

Regards,
Kannan

[mauriceben_]

Hi Kannan,

Thanks for your answer, but I'm using an LDAP auth server setup...

I can see the user attributes when setting up a Radius auth server, but right now I'm not using this...

Do you know if there's a way to do this using an LDAP auth server?

Thanks.

Luc

[kalagesan_]

Hi Luc,

I don't think LDAP server can support "calling-Station-ID" , you need to use radius server as authenticaton server since "Calling-Station-ID" is a radius attribute and it is not a LDAP attribute

Regards,

Kannan