topic Re: ASA configuration via ASDM Internal Group Policy Banner inheritance in Network Security

ASA configuration via ASDM Internal Group Policy Banner inheritance

Philippe4 — Tue, 12 Mar 2019 14:14:09 GMT

Hi all,

I am currently preparing the CCNA Security 210-260 [not a piece of cake 😞 ]

I don't find any clear information regarding the inheritance source.

ie : From a created Group Policy, the Banner option can be written (if Inherit is unticked), but if ticked, from where it could be inherited?

I didn't find anything from the Users configuration, neither from Connection Profiles.

Does the DftGrpPolicy override this, if its Banner field is filled?

And does it work in this manner, in general for all fields?

Values in DftGrpPolicy feed the created Group Policies when the Inherit option is ticked?

Many thanks to you for your help

Re: ASA configuration via ASDM Internal Group Policy Banner inheritance

Francesco Molino — Sun, 20 Jan 2019 23:11:52 GMT

Hi

not sure I understand correctly your question.
When it comes to VPN connection profiles, you have 2 choices:
- create their own Group Policy and you can decide to get all configuration inherited from the DftGrpPolicy or/and override some configs specifically for this connection profile attached to this group policy
- use the DftGrpPolicy for all your connection profiles.

Then if I understand correctly your question, if you keep the inherit option ticked, it will take configs from the DftGrpPolicy.
Let's take an example for split tunnel:
- you configure your split tunnel on your DftGrpPolicy
- you create a new connection profile and keep inherit option ticked then the split tunnel is coming from the value of DftGrpPolicy
- if you untick this option then you create you can override this value for this specific connection profile

Hope this is clear.

Re: ASA configuration via ASDM Internal Group Policy Banner inheritance

Philippe4 — Mon, 21 Jan 2019 11:55:17 GMT

Hello Francesco,

Thank you for your reply.

Yes, I think it's clear now.

We can say that all parameters of created Group Policy with Inherit option are feed by the default group policy (DflGrpPolicy)

It's the reason why default group policy (and default connections profiles) can be modified but not deleted?

They are used in addition of created Group Policies and Connection Profiles?

Many Thanks

Philippe

Re: ASA configuration via ASDM Internal Group Policy Banner inheritance

Marvin Rhoads — Mon, 21 Jan 2019 12:46:29 GMT

@Philippe4 wrote:

<snip>

Does the DftGrpPolicy override this, if its Banner field is filled?

And does it work in this manner, in general for all fields?

Values in DftGrpPolicy feed the created Group Policies when the Inherit option is ticked?

<snip>

That's correct.

Re: ASA configuration via ASDM Internal Group Policy Banner inheritance

Philippe4 — Mon, 21 Jan 2019 13:36:31 GMT

Hello Marvin,

Thank's lot for your answer.

It's nice from you