topic Re: ISE Easy Connect with AnyConnect in Network Access Control

ISE Easy Connect with AnyConnect

gsheppar — Wed, 07 Feb 2018 16:05:58 GMT

Hi Team,

Is there a way to leverage Easy Connect with AnyConnect VPN? The thought was to use a machine certificate for authentication with AnyConnect/ASA and then pull the machine name from the CN to do authorization against ISE. At this point Easy Connect could provide the passive identity and then we could do a CoA against the ASA to place it in a different authorization group.

Regards,

Graham

Re: ISE Easy Connect with AnyConnect

Jason Kunst — Wed, 07 Feb 2018 16:09:07 GMT

Anyconnect has nothing to do with easy connect.

Why not machine certificate plus CWA portal. This is known as CWA chaining.

Re: ISE Easy Connect with AnyConnect

gsheppar — Wed, 07 Feb 2018 16:12:10 GMT

Jason I know easy connect does not today since it uses MAB with wired and wireless but was trying to see if there was a way to combine them to help with passive user identity. The end user does not want to have any popup that requires them to enter credentials. Was thinking maybe since ASA supports COA there could be a way to leverage it.

Re: ISE Easy Connect with AnyConnect

Jason Kunst — Wed, 07 Feb 2018 16:16:55 GMT

No unfortunately not going to work because we need to see the user login. The only way I would think about this working would be if the anyconnect VPN tunnel with machine cert came up before the user logs into the machine. Then they logged in and WMI or AD agent event saw the login. This hasn’t been tested but might work.

Re: ISE Easy Connect with AnyConnect

gsheppar — Wed, 07 Feb 2018 16:28:04 GMT

Thanks Jason sounds like something I should try test. I don't see why it would not work the same way. You say the tunnel coming up prior to the users logging in but I would assume it would work the same way as if a user that plugs in a laptop to an ethernet port. Once network or in this case corporate VPN connection is made Windows would do a WMI login to AD which ISE could then see for passive identity. Other idea if it does not work the way I am thinking would be to have a post script on AnyConnect to generate a WMI login. What you think? I might try to build this out if we think its theoretically possible.

Re: ISE Easy Connect with AnyConnect

Jason Kunst — Wed, 07 Feb 2018 16:33:00 GMT

AFAIK you would need to login to windows after connected to the network for it to work otherwise you are stuck at a MAB state without a WMI login. If my machine was already logged into the domain its not going to do it again just because I switched network ports. That’s what dot1x is for ☺

I think it would work in theory but will rely on my counterpart hslai on Easyconnect to respond

Re: ISE Easy Connect with AnyConnect

hslai — Wed, 07 Feb 2018 17:31:14 GMT

How To: ISE and ASA Integration using CoA for Posture shows RA VPN can use certificate auth against ASA and then authorize-only with ISE. That's supported for a long time and a better solution.

What you asked might work but why complicating the use case when our teams have not vetted it.

Re: ISE Easy Connect with AnyConnect

gsheppar — Wed, 07 Feb 2018 17:38:22 GMT

Thanks hslai only issue is the customer does not want to deploy user certificates or ask for credentials which is the only way that would work to get user identity. Sounds like what I am saying might work but never been tested.

Is there any other way you can think of to get user identity without prompting the user for their information or leveraging a user certificate with AnyConnect? Could posture possibly provide the user identity?

Re: ISE Easy Connect with AnyConnect

hslai — Wed, 07 Feb 2018 18:58:24 GMT

Unfortunately, not really. Unless the username is in a field of the computer certificate and ASA is configured to send that to ISE instead of the computer's.

Re: ISE Easy Connect with AnyConnect

gsheppar — Wed, 07 Feb 2018 18:59:48 GMT

Thanks hslai I might try test out passive identity with ISE and AnyConnect CoA