topic Re: ASA user filtering with external service in Network Security

ASA user filtering with external service

Julie_grst — Tue, 03 Nov 2020 22:08:09 GMT

Hello,

A client of mine is asking me a tricky question. On ASA, is it possible to do some flow filtering based on user groups, with user information located in a Microsoft Graph? In other word, can ASA trigger an API call to an external service to do some user filtering in flow policy?

Thank you advance for your help!

Re: ASA user filtering with external service

balaji.bandi — Tue, 03 Nov 2020 22:28:08 GMT

Not sure if the below URL help, we need more example what exactly you looking to filter based domain or content?

what ASA version?

https://www.cisco.com/c/en/us/td/docs/security/asa/asa72/configuration/guide/conf_gd/filter.html

Re: ASA user filtering with external service

Mohammed al Baqari — Wed, 04 Nov 2020 06:57:13 GMT

Hi,

Not out of the box to make ASA do this. However, you can write your own
script and make it running on a separate server (or maybe guestshell if you
have IOS-XE). This script can read data from MS Graph and parse it. Then
same data can connect to ASA API to allow rules or create objects, etc.

***** please remember to rate useful posts

Re: ASA user filtering with external service

Julie_grst — Wed, 04 Nov 2020 23:51:30 GMT

Hello,

I checked the URL you sent, but I didn't find anything related to my issue. Actually we want to filter traffic based on users and groups, with user information located in a Microsoft Graph.

I don't know their ASA version, for now it's only a theoretical question 🙂

Thank you for your answer!

Re: ASA user filtering with external service

Julie_grst — Wed, 04 Nov 2020 23:53:30 GMT

Hello Mohammed,

Thank you very much for your answer, that's exactly the kind of thing we were looking for 🙂