topic Re: ISE Result - Customized Error Message On AnyConnect in Network Access Control

ISE Result - Customized Error Message On AnyConnect

Phi Yim — Fri, 18 Mar 2016 05:39:49 GMT

ISE experts,

My customer has the following AuthZ rule in ISE:

If Cisco-VPN3000:CVPN3000/ASA/PIX7.x-Tunnel-Group-Name=internal + authentication is EAP-TLS, then permit. If an employee uses AnyConnect with their personal device without a valid client certificate, the end user sees the “Certificate Validation Failure”. Please see screen capture below.

Is it possible for ISE to have AnyConnect display another message such as: “AnyConnect has detected that this machine is out of compliance”?

Re: ISE Result - Customized Error Message On AnyConnect

Timothy Abbott — Fri, 18 Mar 2016 16:53:04 GMT

Unfortunately, no. ISE doesn't play a roll in the AnyConnect messaging for VPN authentication. If AnyConnect were doing posture assessment, then you would have the ability to customize the posture messaging to the end user.

Regards,

-Tim

Re: ISE Result - Customized Error Message On AnyConnect

Phi Yim — Fri, 18 Mar 2016 20:29:53 GMT

Thanks for getting back to me Tim!

Re: ISE Result - Customized Error Message On AnyConnect

lnemec — Mon, 24 Jul 2017 15:08:28 GMT

Hi, sure, you can customize Anyconnect client error messages on ASA via ASDM.

Regards,

Laci,.