topic At this point all of the end in Network Security

ASA 9.0 support for CoA

jrobey284 — Tue, 12 Mar 2019 01:51:24 GMT

Does anyone know if ASA 9.x code supports Change of Authorization (CoA). I have looked through the release notes and can't find anything.

Re: ASA 9.0 support for CoA

Marvin Rhoads — Thu, 30 May 2013 20:34:08 GMT

It does not yet support it. Last I heard it would be later this year - possibly in 9.2.

For now you need to put an ISE IPEP inline to get CoA for VPN users using an ASA headend.

Re: ASA 9.0 support for CoA

Akhtar Samo — Mon, 25 Nov 2013 07:16:19 GMT

Is there any update on CoA support on ASA ?

Any plans to make CoA feature as open standard ? so that customers having non-Cisco products can benefit from advanced ISE features such as Posture assessment.

Regards,

Akhtar

Re: ASA 9.0 support for CoA

Marvin Rhoads — Mon, 25 Nov 2013 14:06:27 GMT

Last I heard, it's still projected for 9.2. Haven't heard the exact date yet.

I doubt it would be made an open standard as it is a competitive differentiator.

Re: ASA 9.0 support for CoA

Akhtar Samo — Wed, 27 Nov 2013 10:31:56 GMT

Thanks.

The problem in implementing CoA and MAB is when it comes to customers buying ISE and having a multivendor environment (Juniper/Nortel switches) are left with only ISE's authentication functionality on end points. I know they have an option for IPEP but that doesn't make sense for a client having high number of non-cisco switches connected to end points.

Regards,

Akhtar

ASA 9.0 support for CoA

dirkmelvin — Sun, 26 Jan 2014 16:29:06 GMT

Ok, so as of 2 days ago, the latest I have heard about the ASA update is 1st Quarter of this year. Now, I will of course take this with a grain of salt, as we have been told this CoA update would be coming for 2 years. Last I had heard before this was by the end of this year.

Either way, I just read there is a vulnerability in RADIUS CoA on the ASA? How can there be a vulnerability in something that isn't supported?

http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0655

Maybe I am not thinking of the same thing?

But whatever it is, I am still very anxious to get this update working, because having to have the IPN between the ASA traffic and the network has caused a few kinks in my moving our ASA into a firewall role on top of the current VPN role.

Thanks,

Dirk

ASA 9.0 support for CoA

Jacob Gibb — Tue, 18 Feb 2014 21:53:11 GMT

I found the same vulnerability when searching for CoA support. Not sure what to make of that. Hoping we get CoA support soon. Is there any reference as to how to this interoperates with ISE and AuthZ rules etc..? What is the use case scenario?

Of course it has now been

dirkmelvin — Wed, 12 Mar 2014 14:42:30 GMT

Of course it has now been revised to 1st half of this year, sure to slip again to 2nd half.

Use scenario is, as we are using it today, we have to have a physical ISE (IPN) Inline Posture Node to handle the CoA because that function is not native in the ASA.

So a user connects with Anyconnect, (and they have Cisco NAC installed), the NAC agent then contacts the ISE policy server to see what rules it needs to check and comply with, then ISE policy server says if you meet these rules then we check what 'group' you belong to, in order to determine what ACL is assigned.

The planned change will eliminate the need for the IPN and ISE server to be separate devices. Right now the IPN HAS to be physical, and our ISE Policy server is a VM. So when all this is updated we can remove the VM and only have the physical device, but it no longer has to be INLINE for the ASA VPN Posture functions.

Also, was told that ISE v1.3 will be required in addition to the ASA update.

So for this to work BOTH need to be released.

It appears that the CoA is in

MARK BAKER — Mon, 14 Jul 2014 22:33:34 GMT

It appears that the CoA is in version 9.2.1. As far as I can tell, the 5500 non-x models stop at 9.1. Is there not going to be a maintenance 9.1 release to include CoA for non-x ASAs?

At this point all of the end

Marvin Rhoads — Mon, 14 Jul 2014 22:48:04 GMT

At this point all of the end-of sales models will not be getting any significant functionality upgrade. That would include the RADIUS CoA that works with ISE.

Once a product goes end of sales (as they did back last September), generally any new software releases that come out are for bug fixes.