Cisco ASA: Group-Lock WARNING

KB ID 0001423


You will see this error if you are pasting configuration into a Cisco firewall. This week I was manually converting an old 8.2 version firewalls configuration, to run on a modern (version 9) firewall, when I saw this;

Petes-ASA(config)# username fred.bloggs attributes
Petes-ASA(config-username)# group-lock value SOME-VALUE
WARNING: tunnel-group SOME-VALUE does not exist


The reason you are seeing this error is because you are working your way through the config, (from top to bottom), and you have just told the firewall to use a tunnel-group, and that tunnel group is further down in the config, so you have not created it yet on the target firewall!

For the uninitiated: A group-lock is used to define different tunnel-groups for different users.

So on the source configuration, locate the appropriate tunnel-group and put that in first, then retry;

Petes-ASA(config-username)# tunnel-group SOME-VALUE type remote-access
Petes-ASA(config)# tunnel-group SOME-VALUE general-attributes
Petes-ASA(config-tunnel-general)#  address-pool VPN-POOL
Petes-ASA(config-tunnel-general)#  default-group-policy SOME-VALUE-POLICY
Then try again!

Petes-ASA(config-tunnel-general)# username fred.bloggs attributes
Petes-ASA(config-username)# group-lock value SOME-VALUE


Related Articles, References, Credits, or External Links


Author: PeteLong

Share This Post On

Submit a Comment

Your email address will not be published. Required fields are marked *