topic Re: Validating AnyConnect Identity Extensions (ACIDex) attributes against external DB in Network Access Control https://community.cisco.com/t5/network-access-control/validating-anyconnect-identity-extensions-acidex-attributes/m-p/3567476#M530593 <HTML><HEAD></HEAD><BODY><P>please reach out to ISE-PM mailer for the use case as they handle the requests</P></BODY></HTML> Mon, 27 Mar 2017 20:33:24 GMT Jason Kunst 2017-03-27T20:33:24Z Validating AnyConnect Identity Extensions (ACIDex) attributes against external DB https://community.cisco.com/t5/network-access-control/validating-anyconnect-identity-extensions-acidex-attributes/m-p/3567472#M530579 <HTML><HEAD></HEAD><BODY><P><SPAN style="font-size: 10pt;">Hi all,</SPAN></P><P></P><P><SPAN style="font-size: 10pt;">does someone know if it is possible to validate <SPAN style="color: #666666; font-family: Arial;">AnyConnect Identity Extensions (like device ID) against an external DB? I know it's possible by using ASA DAP, but customer would like to do it centrally on ISE. Could not find a way (tried to do it with authorization rules).</SPAN></SPAN></P><P></P><P>Thanks in advance.</P><P>Roland</P></BODY></HTML> Fri, 24 Mar 2017 11:00:26 GMT https://community.cisco.com/t5/network-access-control/validating-anyconnect-identity-extensions-acidex-attributes/m-p/3567472#M530579 rmueller@cisco.com 2017-03-24T11:00:26Z Re: Validating AnyConnect Identity Extensions (ACIDex) attributes against external DB https://community.cisco.com/t5/network-access-control/validating-anyconnect-identity-extensions-acidex-attributes/m-p/3567473#M530581 <HTML><HEAD></HEAD><BODY><P>Having our experts <A href="https://community.cisco.com//u1/148562">pcarco</A> chime in as well</P></BODY></HTML> Fri, 24 Mar 2017 13:51:00 GMT https://community.cisco.com/t5/network-access-control/validating-anyconnect-identity-extensions-acidex-attributes/m-p/3567473#M530581 Jason Kunst 2017-03-24T13:51:00Z Re: Validating AnyConnect Identity Extensions (ACIDex) attributes against external DB https://community.cisco.com/t5/network-access-control/validating-anyconnect-identity-extensions-acidex-attributes/m-p/3567474#M530584 <HTML><HEAD></HEAD><BODY><P>ACIDEX attributes are mainly for profiling at present. Please present your use case to our product management team.</P></BODY></HTML> Sat, 25 Mar 2017 00:52:52 GMT https://community.cisco.com/t5/network-access-control/validating-anyconnect-identity-extensions-acidex-attributes/m-p/3567474#M530584 hslai 2017-03-25T00:52:52Z Re: Validating AnyConnect Identity Extensions (ACIDex) attributes against external DB https://community.cisco.com/t5/network-access-control/validating-anyconnect-identity-extensions-acidex-attributes/m-p/3567475#M530587 <HTML><HEAD></HEAD><BODY><P>The use case here is to validate if the device which is connecing via VPN actually a company-owned device. To check that, they would like to validate the device id which AnyConnect is sending to ISE against Database (LDAP/AD probably). The operating system in question here is MacBook. In most cases, you would do that by checking a certificate during authentication, but the customer in question here is not allowed to install certificates on MacBooks as they fear that the certificate can get compromised.</P><P></P><P>I know that this can be currently done via DAPs and LUA-scripts on ASA, but customer prefers ISE to do this job centrally for all VPN gateways.</P><P></P><P>Roland</P></BODY></HTML> Mon, 27 Mar 2017 09:38:15 GMT https://community.cisco.com/t5/network-access-control/validating-anyconnect-identity-extensions-acidex-attributes/m-p/3567475#M530587 rmueller@cisco.com 2017-03-27T09:38:15Z Re: Validating AnyConnect Identity Extensions (ACIDex) attributes against external DB https://community.cisco.com/t5/network-access-control/validating-anyconnect-identity-extensions-acidex-attributes/m-p/3567476#M530593 <HTML><HEAD></HEAD><BODY><P>please reach out to ISE-PM mailer for the use case as they handle the requests</P></BODY></HTML> Mon, 27 Mar 2017 20:33:24 GMT https://community.cisco.com/t5/network-access-control/validating-anyconnect-identity-extensions-acidex-attributes/m-p/3567476#M530593 Jason Kunst 2017-03-27T20:33:24Z Re: Validating AnyConnect Identity Extensions (ACIDex) attributes against external DB https://community.cisco.com/t5/network-access-control/validating-anyconnect-identity-extensions-acidex-attributes/m-p/3567477#M530596 <HTML><HEAD></HEAD><BODY><P>This thread may also help on similar query: <A href="https://community.cisco.com/thread/79338">Machine + User Auth for MAC OSX</A></P></BODY></HTML> Wed, 29 Mar 2017 23:19:19 GMT https://community.cisco.com/t5/network-access-control/validating-anyconnect-identity-extensions-acidex-attributes/m-p/3567477#M530596 Craig Hyps 2017-03-29T23:19:19Z