topic Re: Using endpoint IP address as an AuthZ condition in Network Access Control

Using endpoint IP address as an AuthZ condition

bperciac — Thu, 07 Apr 2016 19:38:00 GMT

I am looking for a way to use the IP address of the endpoint in an AuthZ policy. I could use Radius-Framed-IP-Address, but the only option is "Equals" or "Not Equal To" and does not give me things like "Starts with". Network Access - Device IP Address has the same issue.

How would we go about using the endpoint address in a policy? The particular use case is around internal vs external VPN connections and using the source address as the way to determine the origin of the VPN connection.

Any guidance is appreciated.

Thanks!

Bob

Re: Using endpoint IP address as an AuthZ condition

howon — Fri, 08 Apr 2016 15:10:23 GMT

Robert, it is not possible with current condition set on ISE as you described. Have you looked into whether ASA can define different profiles or VLANs based on their source IP address?

Hosuk

Re: Using endpoint IP address as an AuthZ condition

gbekmezi-DD — Fri, 08 Apr 2016 16:50:10 GMT

Hi Bob, have you considered using tunnel groups on the ASA use case instead of IP address? That way you can match on Tunnel-Group-Name in the AuthZ policy to provide differentiated results.

Sample:

George

Re: Using endpoint IP address as an AuthZ condition

vibobrov — Fri, 08 Apr 2016 18:51:12 GMT

Public IP address of the client is sent by the ASA in Calling-Station-ID attribute. You will be able to use all the normal operands on that in ISE.

Framed-IP-Address stores the assign IP address from the VPN pool.