Forum Discussion

Saskia_81056's avatar
Saskia_81056
Icon for Nimbostratus rankNimbostratus
Mar 12, 2015

APM VPN:Assign split-tunnel settings dynamically via RADIUS

Hi there,

 

is it possibly to dynamically assign included split-tunnel networks (included, so only those subnets will be routed through the VPN tunnel) by using a RADIUS attribute?

 

Like this I could dynamically assign different split-tunnel networks to different users (I know, this is a very exclusive scenario, but about ~50 different settings are needed within our deployment)

 

Regards, Saskia

 

BIG-IP Access Policy Manager (APM)
security

1 Reply

  • kunjan's avatar
    kunjan
    Icon for Nimbostratus rankNimbostratus
    Mar 14, 2015

    Probably you can try to do a variable assignment after NA resource assignment in VPE

     

    • Define the following Configuration Variable:

       

      Type: Network Access

       

      Name: NAname(Select)

       

      Property: address_space_include_dns_name(Referring to split tunnel included Subnets)

       

       

       

    • Assign it the following value,

       

      Agent Type : RADIUS

       

      Attribute Type: Use RADIUS attribute

       

      Radius attribute name : attribute_name_var(Specify)

       

       

    Value accepted is in 10.0.0.0/255.0.0.0 format.

     

     

     

    This doc also might help https://support.f5.com/kb/en-us/solutions/public/13000/000/sol13024

     

    If this radius attribute is under VSA attribute, currently APM doesn't support it.