ASA configuration via ASDM Internal Group Policy Banner inheritance

[Philippe4]

Hi all,

I am currently preparing the CCNA Security 210-260 [not a piece of cake :(  ]

I don't find any clear information regarding the inheritance source.

ie : From a created Group Policy,  the Banner option can be written (if Inherit is unticked), but if ticked, from where it could be inherited?

I didn't find anything from the Users configuration, neither from Connection Profiles.

Does the DftGrpPolicy override this, if its Banner field is filled?

And does it work in this manner, in general for all fields?

Values in DftGrpPolicy feed the created Group Policies when the Inherit option is ticked?

Many thanks to you for your help

[Francesco Molino · Accepted solution]

Hi

not sure I understand correctly your question.
When it comes to VPN connection profiles, you have 2 choices:
- create their own Group Policy and you can decide to get all configuration inherited from the DftGrpPolicy or/and override some configs specifically for this connection profile attached to this group policy
- use the DftGrpPolicy for all your connection profiles.

Then if I understand correctly your question, if you keep the inherit option ticked, it will take configs from the DftGrpPolicy.
Let's take an example for split tunnel:
- you configure your split tunnel on your DftGrpPolicy
- you create a new connection profile and keep inherit option ticked then the split tunnel is coming from the value of DftGrpPolicy
- if you untick this option then you create you can override this value for this specific connection profile

Hope this is clear.

[Philippe4 · Accepted solution]

Hello Francesco,

Thank you for your reply.

Yes, I think it's clear now.

We can say that all parameters of created Group Policy with Inherit option are feed by the default group policy (DflGrpPolicy)

It's the reason why default group policy (and default connections profiles) can be modified but not deleted?

They are used in addition of created Group Policies and Connection Profiles?

Many Thanks

Philippe

[Marvin Rhoads · Accepted solution]

---

@Philippe4 wrote:

<snip>

Does the DftGrpPolicy override this, if its Banner field is filled?

And does it work in this manner, in general for all fields?

Values in DftGrpPolicy feed the created Group Policies when the Inherit option is ticked?

<snip>

---

That's correct.

[Philippe4]

Hello Marvin,

Thank's lot for your answer.

It's nice from you