topic Re: Prescriptive guide for ISE VPN in Network Access Control

Prescriptive guide for ISE VPN

Madura Malwatte — Sat, 06 Apr 2019 04:51:41 GMT

Just wondering if there is detailed guide/document for deploying VPN access (AnyConnect) with ISE, similar to the prescriptive deployment guides for wired/wireless/byod etc?

This is the only document I could find so far - https://community.cisco.com/t5/security-documents/how-to-configure-posture-with-anyconnect-compliance-module-and/ta-p/3647768#toc-hId-837352845

but doesn't show the group-policy config on ISE or how to match tunnel-group conditions. I'm looking for something more thorough.

Re: Prescriptive guide for ISE VPN

Francesco Molino — Sat, 06 Apr 2019 06:00:30 GMT

Hi

If you're looking for anyconnect vpn and ise, you have a lot of documentation on Cisco website. However, there are some good videos at Labminutes available on YouTube. Check this out: https://m.youtube.com/watch?v=HcMf3q_lmYo

There's a doc taking about asa coa:
https://community.cisco.com/t5/security-documents/how-to-ise-and-asa-integration-using-coa-for-posture/ta-p/3630938

But not sure there are configuration guides like the one you mentioned.

Re: Prescriptive guide for ISE VPN

Jason Kunst — Mon, 08 Apr 2019 15:48:11 GMT

Very well put. I have asked our experts to step in as well and see if they have other resources

@pcarco

Re: Prescriptive guide for ISE VPN

pcarco — Mon, 08 Apr 2019 19:33:41 GMT

Just curious are you trying to create a posture policy based on the connection profile/Tunnel-group and Group-Policy on the ASA similar to the way we do it today with host scan and Dynamic-Access-Policies (DAP)? Unless something has changed on ISE this is not possible as we don't pass this along as part of the ACIDEX exchange. You could however use Radius IETF 25 and put the users in the ASA group-policy you wish during authentication/authorization to ISE from the ASA.

Best regards

Paul

AnyConnect TME

Re: Prescriptive guide for ISE VPN

Madura Malwatte — Wed, 10 Apr 2019 01:40:18 GMT

Hi Francesco, thanks for the doc.

Re: Prescriptive guide for ISE VPN

Madura Malwatte — Wed, 10 Apr 2019 01:46:58 GMT

No, was just looking for a deployment guide that's recent and updated with Anyconnect VPN and ISE.

Re: Prescriptive guide for ISE VPN

Francesco Molino — Wed, 10 Apr 2019 02:16:52 GMT

You're welcome