topic Re: Location based authorization in Network Access Control

Location based authorization

wileong — Sun, 16 Dec 2018 23:10:35 GMT

Hi there,

A customer with requirement to return different AUTHZ policy in ISE based on location from ASA remote VPN.

What is the best way to achieve this?

Thanks

Wing Churn

Re: Location based authorization

hslai — Sun, 16 Dec 2018 23:33:22 GMT

In case the location is that of an ASA headend, then we may set the NAD to a specific location in ISE configuration and use that info for authorization.

In case the location is the geo-location of a remote access VPN session, we may use the calling-station-ID RADIUS attribute as conditions. ISE is not currently supporting to perform a lookup for geo-location info of a remote access client so the conditions would likely need set explicitly.

Additionally...

Marvin Rhoads mentioned a solution using IPS -- The new model ASA (5500-X - Cisco Community

Karsten Iwen suggested using DAP -- Re: Can CISCO ASA locate anyconnect geo... - Cisco Community

Re: Location based authorization

wileong — Wed, 19 Dec 2018 08:09:48 GMT

Hi Hsing,

Thanks for the tip, follow up question on the suggestion. Is calling-station-ID appear as private IP of the AnyConnect real client IP in ISE or the egress IP of the client?

Thanks

Wing Churn

Re: Location based authorization

Surendra — Wed, 19 Dec 2018 15:37:17 GMT

It should be client's physical NIC ip (or mac address?) since the VPN connection is not complete and the tunnel IP would not have been assigned.

Re: Location based authorization

hslai — Sat, 22 Dec 2018 00:41:22 GMT

It's the external gateway IP address, usually the one from the ISP, that used to contact the RA-VPN head-end.

For example, in [ client -- home router -- Internet -- RA-VPN ], the internet facing IP address of the home router.