topic Re: Internal User Identity Group as an ASA Class Value in Network Access Control

Internal User Identity Group as an ASA Class Value

scamarda — Wed, 11 May 2016 14:50:50 GMT

ISE 2.0 with AnyConnect RA VPN. I am trying to use the internal user's identity group as the Class attribute to assign a group policy on the ASA. I've tried both IdentityGroup:Name and InternalUser:IdentityGroup in my Authorization Profile:

Access Type = ACCESS_ACCEPT

Class = IdentityGroup:Name

Both configurations end up including the attribute title along with the attribute value:

Result

State ReauthSession:c0a800fe000a100057331935

Class User Identity Groups:Contractor

If I use the AD Department value, all that is returned is the attribute value, not the attribute title

Result

State ReauthSession:c0a800fe00095000573234a5

Class IT

How can I use the Internal User Identity Group to assign the Class Value to the ASA for Group-Policy?

Re: Internal User Identity Group as an ASA Class Value

Timothy Abbott — Thu, 12 May 2016 13:55:52 GMT

Hi,

Are you trying for the following in an authorization profile?

Access Type = ACCESS_ACCEPT

Class = Contractor

Regards,

-Tim

Re: Internal User Identity Group as an ASA Class Value

scamarda — Tue, 17 May 2016 10:13:51 GMT

Yes. I am getting the whole string but only need the value. I am getting "User Identity Groups:Contractor". The ASA is expecting "Contractor". How do I strip off "User Identity Groups"?

Re: Internal User Identity Group as an ASA Class Value

Timothy Abbott — Tue, 17 May 2016 14:38:59 GMT

I don't believe you can strip that part of the attribute. Would it be possible to create group policy on the ASA that matches the Class value returned? For example:

Auth Profile:

Access Type = ACCESS_ACCEPT

Class = IdentityGroup:Contractor

ASA Group Policy:

IdentityGroup:Contractor

Regards,

-Tim

Re: Internal User Identity Group as an ASA Class Value

scamarda — Tue, 17 May 2016 15:48:27 GMT

I can try that as a workaround. Is there another way to accomplish what I am trying to do?

Re: Internal User Identity Group as an ASA Class Value

hslai — Tue, 17 May 2016 17:19:48 GMT

I believe you may use a value of a regular attribute (built-in or customized) for an internal user.