topic Re: ASA Anyconnect return ACL/VPN Filter in Network Access Control

ASA Anyconnect return ACL/VPN Filter

Bram Van den Bosch — Thu, 12 Jul 2018 06:30:48 GMT

Hi All,

Would it be possible to return a ACL name to be used as 'VPN Filter'?

I know it is possible to return a DACL or Group policy, but I want to return the name of an ACL that is configured on the ASA to be used as the VPN Filter.

Using 'ACL (Filter-ID)' in the authorisation profile does not seem to work.

Thanks for your help!

Re: ASA Anyconnect return ACL/VPN Filter

Craig Hyps — Thu, 12 Jul 2018 15:05:20 GMT

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/113449-asa-vpn-acs-00.ht…

https://supportforums.cisco.com/t5/vpn/vpn-filter-attribute-for-radius-server/td-p/1993224

Re: ASA Anyconnect return ACL/VPN Filter

Bram Van den Bosch — Thu, 12 Jul 2018 18:22:40 GMT

Hi Craig,

Originally I tried the filter ID, using the "ACL (Filter-ID)" field in the authorization profile.

This resulted on the following entry:

Access Type = ACCESS_ACCEPT

Filter-ID = MYACLNAME.in

ISE automatically ads the ".in" after the ACL name, resulting in not even passing authentication on Anyconnect

Just a side question: Why the ".in"?

When I manually added the Radius:Filter-ID [11] it works like a charm!

Access Type = ACCESS_ACCEPT

Filter-ID = MYACLNAME

Re: ASA Anyconnect return ACL/VPN Filter

Craig Hyps — Thu, 12 Jul 2018 19:51:17 GMT

The .in is a directive for "Inbound" ACL and would be interpreted correctly by wired switch. Since ASA not accepting, adding under Advanced attributes to avoid any undesired extensions is correct option.