Cisco ASA DAP Username attribut CLI

mklofac — Fri, 21 Feb 2020 16:24:06 GMT

Hey guys,

I have just started writing scripts in expect language on my ASA. I am able to create new local users (AAA) and I can remove them, but where I am struggling is creating Dynamic Access Policy and adding a username attribute to it. Here is a part of my script:

send "conf t\n"
expect "(config)#"
send "access-list [string toupper $username] extended permit ip any host $ip\n"
expect "(config)#"
send "dynamic-access-policy-record $username\n"
expect "(config-dynamic-access-policy-record)#"
send "network-acl [string toupper $username]\n"
expect "(config-dynamic-access-policy-record)#"

Basically what this does that it first creates an access list rule with desired IP address, then creates DAP record and assigns the previously created acl rule to it. Where I am struggling is how to add the aaa.cisco.username of my user, so that it will use this DAP.

I wasn't able to find any CLI command for it, but I can manually click it in GUI (ASDM). Is there some kind of command, that lets me add a username to DAP record? Thank you in advance 🙂

topic Cisco ASA DAP Username attribut CLI in Network Security

Cisco ASA DAP Username attribut CLI