topic Re: Can you more attribute for assign Frame IP to Cisco ISE and ASA in Network Access Control

Can you more attribute for assign Frame IP to Cisco ISE and ASA

jewfcb001 — Tue, 27 Dec 2022 06:16:58 GMT

Hi All ,

The configuration on Active Directory can assign frame IP Address to Cisco ISE for VPN connection .

But If need more frame ip address on User can assign another attribute aside from msRADIUSFramedIPAddress ? Please suggest me.

Re: Can you more attribute for assign Frame IP to Cisco ISE and ASA

Rob Ingram — Tue, 27 Dec 2022 09:07:52 GMT

@jewfcb001 well you can use dynamic variables on ISE to query an AD attribute, which could contain an IP address.

Example of dynamic variables - https://integratingit.wordpress.com/2018/12/01/ise-dynamic-variables-from-ad/

What is your scenario, why is msRADIUSFramedIPAddress not enough?

Re: Can you more attribute for assign Frame IP to Cisco ISE and ASA

jewfcb001 — Tue, 27 Dec 2022 11:03:59 GMT

@Rob Ingram

Thank you for reply.

I understand in your point. But My scenario is the customer they need more than fix ip address from AD.

As your link can I use another attribute to map ip address for VPN connection or not ?

Re: Can you more attribute for assign Frame IP to Cisco ISE and ASA

Rob Ingram — Wed, 28 Dec 2022 08:03:39 GMT

@jewfcb001 yes

You can use also apply custom user and endpoint attributes, example:- https://www.youtube.com/watch?v=nCD7LiX-XZU&t=301s

then use Radius > Framed-IP-Address--[8] in the authorisation rule and reference the custom attribute (that has the static IP)

Re: Can you more attribute for assign Frame IP to Cisco ISE and ASA

MHM Cisco World — Tue, 27 Dec 2022 11:20:06 GMT

there are default attribute and optional, what exactly attribute you looking for?

Re: Can you more attribute for assign Frame IP to Cisco ISE and ASA

jewfcb001 — Wed, 28 Dec 2022 03:03:05 GMT

@MHM Cisco World

Hi MHM ,

I looking for any attribute can assign fix ip address from client . I need more than 1 ip address from client .

Re: Can you more attribute for assign Frame IP to Cisco ISE and ASA

jewfcb001 — Wed, 28 Dec 2022 08:46:51 GMT

@Rob Ingram

Thank you for information . I understand that cisco ise can custom attribute for user , but now all user

it's handle by active directory. i understand AD can send IP by (msRADIUSFramedIPAddress) but i need more than 1 ip for fix to the client from AD . Please suggest me.

Re: Can you more attribute for assign Frame IP to Cisco ISE and ASA

Rob Ingram — Wed, 28 Dec 2022 09:57:40 GMT

@jewfcb001 why do you need to assign more than 1 IP address to the anyconnect client? I don't see how that will work or why you need to do that, unless you want to apply an IPv4 and IPv6 address to the same user?

Why don't you explain you scenario a bit better so we can understand why.

Re: Can you more attribute for assign Frame IP to Cisco ISE and ASA

MHM Cisco World — Wed, 28 Dec 2022 10:53:40 GMT

fix IP from client or fix IP to client ?

Re: Can you more attribute for assign Frame IP to Cisco ISE and ASA

jewfcb001 — Wed, 28 Dec 2022 13:40:27 GMT

Fix IP from Client Because As picture below If client go to FW Site A User will get fix ip address for FW Site A from AD so client go to FW Site B User will get fix ip address from AD for FW Site B.That's requirement from the customer. They need 2FA from Azure AD.

Re: Can you more attribute for assign Frame IP to Cisco ISE and ASA

jewfcb001 — Wed, 28 Dec 2022 13:41:47 GMT

@Rob Ingram

Because As picture below If client go to FW Site A User will get fix ip address for FW Site A from AD so client go to FW Site B User will get fix ip address from AD for FW Site B.That's requirement from the customer. They need 2FA from Azure AD.

Re: Can you more attribute for assign Frame IP to Cisco ISE and ASA

MHM Cisco World — Wed, 28 Dec 2022 13:47:15 GMT

OK, this is only one user or it multi user that you need to assign static IP ?

Re: Can you more attribute for assign Frame IP to Cisco ISE and ASA

Rob Ingram — Wed, 28 Dec 2022 13:54:57 GMT

@jewfcb001 ok that makes things clearer.

Define 2 authorisation rules in ISE, use the NAS IP address of FW A on one rule and the IP address of FW B on the other rule, to distinguish between the connections depending on which firewall the users connects to

For the FW A authorisation rule, set the "Radius > Framed-IP-Address--[8]" to equal a custom attribute in AD such as msRADIUSFramedIPAddress or create a custom attribute - which has the static IP address for FW A.

For the FW B authorisation rule, set the "Radius > Framed-IP-Address--[8]" to equal a custom attribute a different AD attribute, such as Pager, telephone or create a custom attribute - which has the static IP address for FW B.

Use the same logic as per the guide provided above - https://integratingit.wordpress.com/2018/12/01/ise-dynamic-variables-from-ad/

Therefore the user will receive a different static IP address depending on which FW they connect to.

Re: Can you more attribute for assign Frame IP to Cisco ISE and ASA

jewfcb001 — Wed, 28 Dec 2022 14:00:34 GMT

@MHM Cisco World

multi user for get 2 ip address for 2 site firewall

Re: Can you more attribute for assign Frame IP to Cisco ISE and ASA

jewfcb001 — Thu, 29 Dec 2022 03:23:25 GMT

@Rob Ingram

Thank you for answer .

You mean other attribute besides msRADIUSFramedIPAddress such as pager . telephone . that parameter Can I use for IP address instead msRADIUSFramedIPAddress from AD?

Re: Can you more attribute for assign Frame IP to Cisco ISE and ASA

jewfcb001 — Fri, 30 Dec 2022 03:33:52 GMT

@Rob Ingram

I tried to find the information and found the link answer by you . It's same requirement .

Thank you so much

https://community.cisco.com/t5/network-access-control/anyconnect-user-static-ip/td-p/4270585