Endpoint VPN authentication with AD is not happening

[Blason_R]

Hi Team

I have R80.10 Firewall as well as Mgmt server and its Integrated with AD. Previously Remote Access VPN users were configured locally. Later we decided to integrate with AD hence IA enabled. The issue in R80.10 is -

I need to give access to particular group from AD to Remote Access VPN.

Hence in R80.10; do I just need to configire Access Role and import it in Rule base?

If so, then Remote Access community does not support adding Acces Role and it only supports Groups.

So, in this case I need to configure Access role and put that in Group and then that group put it in RA Community?

Or do I need to use LDAP groups instead? like CN=VPN, CN=Users, CN=example, CN=com? And then put this group in RA community?

Again being R80.10 it does not support Adding Legacy User Objects like g_LDAP_Group@Any

What is the best way to implement Endpoint VPN then?

TIA 

blason R

[Norbert_Bohusch]

In the RA community you need the Legacy LDAP groups. 

In rulebase you can use Access roles.

You could even use legacy user acces in rulebase if you are using only FW blade in your layer/policy. With unified policy, you are right, legacy user access is not supported anymore in the rulebase.