topic Hi Alisson , I think you can in Network Security

Cisco AnyConnect: Check Computer Certificate Domain Membership

Alisson C — Tue, 12 Mar 2019 06:39:52 GMT

Hello everyone,

I have an ASA5550, on which I have successfuly configured Anyconnect (Client version 3.1.10010) to authenticate with both Username/Password and User certificate issued by my internal CA.

What I'm actually trying to achieve is to allow only computer domain members to login to this VPN access. So users cannot connect to the VPN when they are in their non-corporate devices.

I know every domain member computer have a certificate issued by my internal CA. Is it possible to use this certificate to authenticate the VPN instead of the User Cert?

I only have cisco Anyconnect Essentials license.

Version 9.1(6)4

Licensed features for this platform:
Maximum Physical Interfaces : Unlimited perpetual
Maximum VLANs : 400 perpetual
Inside Hosts : Unlimited perpetual
Failover : Active/Active perpetual
Encryption-DES : Enabled perpetual
Encryption-3DES-AES : Enabled perpetual
Security Contexts : 2 perpetual
GTP/GPRS : Disabled perpetual
AnyConnect Premium Peers : 2 perpetual
AnyConnect Essentials : 5000 perpetual
Other VPN Peers : 5000 perpetual
Total VPN Peers : 5000 perpetual
Shared License : Disabled perpetual
AnyConnect for Mobile : Disabled perpetual
AnyConnect for Cisco VPN Phone : Disabled perpetual
Advanced Endpoint Assessment : Disabled perpetual
UC Phone Proxy Sessions : 2 perpetual
Total UC Proxy Sessions : 2 perpetual
Botnet Traffic Filter : Disabled perpetual
Intercompany Media Engine : Disabled perpetual
Cluster : Disabled perpetual

Hi Alisson , I think you can

rvarelac — Wed, 30 Sep 2015 04:31:59 GMT

Hi Alisson ,

I think you can use the certificate matching feature under the XML profile of Anyconnect , make sure the certificate store field is selected as "all" . Also you can limit the devices that can connect to the VPN with DAP.

See more information below.

XML features

https://supportforums.cisco.com/document/12549161/anyconnect-xml-preferences

https://supportforums.cisco.com/document/12550601/anyconnect-xml-settings

DAP files

http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/115947-dap-adv-functions-00.html

http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/108000-dap-deploy-guide.html

Hope it helps.

-Randy-

Hello Randy,Thank you for

Alisson C — Thu, 01 Oct 2015 13:45:36 GMT

Hello Randy,

Thank you for your answer.

That is exactly what I was looking for.

Best regards.

Its been a long time, but I

Alisson C — Fri, 28 Oct 2016 18:55:00 GMT

Its been a long time, but I would like to update this to say that new windows (7 and 10) when using UAC in high levels still are unable to read the machine certificates, even if the option "Certificate store override" enabled in the Cisco AnyConnect client profile.

After struggling with it for weeks, i found out that the issue is related to the users with no admin privileges not being able to read the private key on the computer identity certificate.

If you add the permission, it will work.
Since I have to do this on about 2.5k computers, I had to use a powershell script + GPO on windows that sets the permission.

After that, VPN has been working just fine.

Re: Its been a long time, but I

Alex Pfeil — Fri, 05 Oct 2018 01:32:19 GMT

We will check this out. We are having a similar issue. Thanks!