topic Re: Cisco ISE VPN posture with ASA in Network Access Control

Cisco ISE VPN posture with ASA

M.Jallad — Mon, 11 Mar 2019 06:12:39 GMT

Hi,

We have a ISE 1.4 deployment in which we are doing posture assessment for VPN users connecting through ASA version 9.3(3). users are connecting normally , authentication and authorization are done succesffuly , however, when nac agent pops up anyconnect vpn client disconnects and the following message appears :

The secure gateway has terminated the VPN connection.
The following message was received from the secure gateway: COA initiated

How could we keep the CoA initiation from disconnecting VPN client.

Appreciate your help ,

Best Regards,

Muayad Jallad,

Hi ,

M.Jallad — Tue, 03 Nov 2015 15:47:21 GMT

Hi ,

Just wanted to update that problem was resolved successfully , it was TACACS command authorization defined on ASA that was preventing the DACL from being configured on ASA which was triggering anyconnect VPN termination.

it was resolved after configuring device administration autorization policy on ACS to give ISE authorization on ASA.

Best Regards,

Muayad Jallad,

Hello Muayad,

santiago.jem — Wed, 27 Apr 2016 10:56:38 GMT

Hello Muayad,

May I ask if this has affected all or just one of your anyconnect users?

I have a similar issue but just on one user.

Any advice is greatly appreciated.

Thank you.

Jem

Re: Cisco ISE VPN posture with ASA

snicklas — Wed, 23 Aug 2017 20:36:28 GMT

Not using ACS, its all ISE/RADIUS now in this enviroment, but the dACL was originally imported from ACS. The dACL that ISE pushes to the ASA for the VPN session needs to use subnet mask format instead of wildcard format for dACL lines that reference networks.