topic Re: Using Radius to assign Anyconnect static IP's in ASA 9.1x in Network Security

Using Radius to assign Anyconnect static IP's in ASA 9.1x

tryingtofixit — Fri, 01 Mar 2024 22:23:28 GMT

Anyone have this working in production?

I have it working in a limited lab. Seems the only statement I needed to do was go from:

no vpn-addr-assign aaa

vpn-addr-assign aaa

My Anyconnect client gets the IP assigned to them in AD. And my other clients continue to pully dhcp from the asa vpn pool. Tested this several times works with no issues.

Is it really this simple?

I don't need to create tunnel-groups, policies, separate anyconnect profiles?

My limited testing shows that vpn-addr-assign aaa isn't overriding dhcp being given out via my vpndhcp pool.

thanks

Re: Using Radius to assign Anyconnect static IP's in ASA 9.1x

Ruben Cocheno — Fri, 01 Mar 2024 22:46:58 GMT

@tryingtofixit

Yes, it is

Re: Using Radius to assign Anyconnect static IP's in ASA 9.1x

balaji.bandi — Fri, 01 Mar 2024 22:50:15 GMT

not sure what radius using you need to configure Framed-IP-Address for that to work.

Re: Using Radius to assign Anyconnect static IP's in ASA 9.1x

tryingtofixit — Fri, 01 Mar 2024 22:52:29 GMT

using Microsoft NPS for radius. did zero config on the NPS.

Re: Using Radius to assign Anyconnect static IP's in ASA 9.1x

balaji.bandi — Sat, 02 Mar 2024 08:27:12 GMT

Just user NPS for 802.1X for my testing not used for VPN authentication.

check below example : (using ISE) - should get an idea on NPS.

https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/220438-configure-a-static-ip-address-on-an-anyc.html