topic Why don't I see VPN endpoints in my context visibility? in Network Access Control

Why don't I see VPN endpoints in my context visibility?

Josh Morris — Tue, 29 Oct 2019 01:07:35 GMT

I have just started to use ISE to auth VPN endpoints from my Cisco ASAs. AAA is working beautifully. I see the endpoint come through in the livelog with the Endpoint ID of the public address of the VPN client. I see the client's username. There is no MAC address and no endpoint profile.

When I look in the context visibility for this endpoint, I can't find it. I'm interested in if I see the ACIDEX attributes since I'm using Anyconnect.

Am I missing something on trying to find this endpoint in CV?

Re: Why don't I see VPN endpoints in my context visibility?

howon — Tue, 29 Oct 2019 07:34:16 GMT

Make sure to enable RADIUS accounting on ASA for the client connection.

Re: Why don't I see VPN endpoints in my context visibility?

Josh Morris — Tue, 29 Oct 2019 13:29:23 GMT

Thanks, I believe it is based on what I'm seeing. Is this not correct to get accounting info to ISE?

Re: Why don't I see VPN endpoints in my context visibility?

howon — Tue, 29 Oct 2019 15:44:46 GMT

That is correct. I assume RADIUS profiling is enabled on the PSN? I suggest enabling packet capture to see if it is being received. This is example of ACIDEX in the RADIUS accounting: