topic Try this and see if it works in Network Access Control

Assign static IP address to ASA VPN clients by ISE

y.lo — Mon, 11 Mar 2019 03:52:47 GMT

We are going to integrate ASA remote access VPN service with a new ISE 1.2.

The authentication is done against Active directory. After the authentication, can static IP address be assigned to a specific VPN user by ISE?

That means the same VPN user will always get the same IP address. Thanks.

Assign static IP address to ASA VPN clients by ISE

Marcin Latosiewicz — Tue, 10 Sep 2013 08:17:09 GMT

Daniel,

You can assign IETF-Radius-Framed-IP-Address in authorization policy.

However if I may make a suggestion:

Unless you have only a handful of users to do it for, it may make sense to assign address-pool from ISE or perform LDAP attribute mapping on ASA itself.

In the latter case the IP addresses are maintained on LDAP server as a attributes and ASA will map it IP address. You don't want to maintain IP address DB in multiple places.

Assign static IP address to ASA VPN clients by ISE

Jatin Katyal — Tue, 10 Sep 2013 14:33:01 GMT

I agree with Marcin. ISE supports the return of standard RADIUS attributes such as Framed-IP-Address and Framed-IP-Netmask. There is an enhancement request filed support fetching a static IP attribute from Active Directory and sending to the end client.

CSCud10560 ISE: Need support for static IP AD attribute

Symptom:

ISE currently does not support fetching static IP attribute from Active Directory to send to a client in an Authorization Result.

~BR
Jatin Katyal

**Do rate helpful posts**

Assign static IP address to ASA VPN clients by ISE

Muhammad Munir — Thu, 12 Sep 2013 06:53:39 GMT

The DNS probe in your Cisco ISE deployment, when enabled, allows the profiler to lookup an endpoint, and get the fully qualified domain name (FQDN) of that endpoint. A DNS lookup tries to determine the endpoint fully qualified domain name. Upon an endpoint detection on your Cisco ISE enabled network, a list of endpoint attributes is collected from the NetFlow, DHCP, DHCP SPAN, HTTP, RADIUS, or SNMP probes. For a DNS lookup, one of the following probes must be started along with the DNS probe: DHCP, DHCP SPAN, HTTP, RADIUS, or SNMP.

The following list shows the specific endpoint attribute, and the probe that collects the attribute:

• The dhcp-requested-address attribute—an attribute collected by the DHCP, and DHCP SPAN probes

• The SourceIP attribute—an attribute collected by the HTTP probe

• The Framed-IP-Address attribute—an attribute collected by the RADIUS probe

• The cdpCacheAddress attribute—an attribute collected by the SNMP probe

The Cisco ISE implements an ARP cache in the profiling service, so that you can reliably map IP addresses and MAC addresses of endpoints. For the ARP cache to function, you must enable either the DHCP probe or the RADIUS probe. The DHCP and RADIUS probes carry IP addresses and MAC addresses of endpoints in the payload data. The dhcp-requested address attribute in the DHCP probe and the Framed-IP-address attribute in the RADIUS probe carry the IP addresses of endpoints, along with their MAC addresses, which can be mapped and stored in the ARP cache.

Assign static IP address to ASA VPN clients by ISE

y.lo — Thu, 12 Sep 2013 07:31:12 GMT

I successfully accomplished this using the method you suggested. Thanks a lot.

I would also like to assign IP address to VPN clients using an address pool in the ISE. There is RADIUS attribute Framed-Pool. However, how does it know which address has been used in the pool? Can this attribute be used this way?

Assign static IP address to ASA VPN clients by ISE

Marcin Latosiewicz — Thu, 12 Sep 2013 08:08:49 GMT

Daniel,

When RADIUS sends pool name ASA will just use that pool, it's up to the ASA to maintain pool's free IP addresses etc.

There is no feedback towards authentication server (ISE or any RADIUS for that matter) in regards to which IP address has been assigned.

If you want to know which addresses were assigned to each user you can still poll via SNMP (if that helps).

Have a look at https://supportforums.cisco.com/docs/DOC-13299

(or you can extarct that info via CLI "show vpn-sessiondb ..." )

Assign static IP address to ASA VPN clients by ISE

y.lo — Thu, 12 Sep 2013 08:13:05 GMT

What we really want to achieve is to maintain the IP address pool in ISE, but not in ASA. Is that doable?

No, ISE does not have a

jan.nielsen — Thu, 20 Mar 2014 00:12:53 GMT

No, ISE does not have a concept of an ip pool, like a dhcp server or an ASA. Only assigning the name of a local ip pool on the ASA or a static hardcoded ip is possible from ise.

Also, getting the ip from AD

jan.nielsen — Thu, 20 Mar 2014 00:16:34 GMT

Also, getting the ip from AD is supported if you put the ip address in another field than the regular ip address one (which is some weird formatted form of a string that ise doesnt understand), that is under every user, as long as the field is a string.

Where (as in what part of the

mburrell5 — Mon, 02 Jun 2014 22:19:39 GMT

Where (as in what part of the config) can the ip pool name (located on ASA) be assigned in ISE?

Try this and see if it works

Jatin Katyal — Mon, 02 Jun 2014 22:32:39 GMT

Try this and see if it works:

Policy > Policy Elements > Dictionaries > System > Radius > RADIUS Vendors > Cisco-VPN3000

Add

Attribute Name: CVPN3000/ASA/PIX7x-Group-Based-Address-Pools

Data Type: String

Direction: Both

ID: 217

Regards,

Jatin Katyal

** Do rate helpful posts **

Thanks, what I really want to

mburrell5 — Mon, 02 Jun 2014 23:42:12 GMT

Thanks, what I really want to use is IETF Attribute 88 Framed-Pool but it is not present in the IETF dictionary. My mention of ASA was really just to get the concept across.

I have a Telstra Radius proxy that I need to authenticate remote users with using RADIUS and issue the users IP addresses. At present this works happily using IETF Attribute 88 Framed-Pool authenticating to ACS, but struggling to find support for this on ISE 1.2. I dont think ISE supports RFC2869 (which is what Attribute 88 is part of)

https://supportforums.cisco

Jatin Katyal — Tue, 03 Jun 2014 05:54:26 GMT

https://supportforums.cisco.com/discussion/12220321/ise-12-ietf-attribute-88-framed-pool-not-available

Hi Marcin,Is there a way of

purva.kate — Sat, 13 Sep 2014 10:27:22 GMT

Hi Marcin,

Is there a way of Mapping remote users MAC address to username in LDAP server ?

I have a client who wants to restrict VPN access to firewall based on MAC address of the client or end user vpn client access restriction in any way. Basically we want to only allow remote users connect with their work laptop and not from their home PC for instance.

Jatin, Just wanted to let

mleiby — Wed, 22 Jul 2015 13:24:43 GMT

Jatin,

Just wanted to let you know that I used your suggestion to use ISE 1.4 to assign the proper IP Pool to an Authorization Profile. Worked great. Thank you for posting.

Thanks,

Matt

Hi,

rchockeelopez — Wed, 05 Apr 2017 21:54:12 GMT

Hi,

This is the topology.

Users are connecting via AnyConnect VPN and are getting authorized with ISE and AD. Windows DHCP Server is giving dynamically IP addreses. The customer wants to assign static MAC-IP binding in the DHCP Server so they can use the firewall to filter based on the VPN IP addresses.

Internet ----- ASA ------ LAN --- ISE and Windows DHCP Server.

Can you provide more information how can I assign MAC-IP binding in a Windows DHCP Server through AnyConnect VPN and ISE.

Thanks.