Firepower FMC Remote Access VPN & Cisco ISE override group policy

[star btsistem]

Hi,

We have Firepower FMC 6.4 as RA VPN device and Cisco ISE 2.3 as radius server. We have one connection profile and different group policies on Firepower. We want to use different group policies for different AD groups. on ISE we have configured ASA VPN attribute as the name of the group policy created on Firepower. ISE is working correctly and it says on logs it applies the correct ASA VPN attribute but on firepower it could not override group policy. Every user hits the group policy defined on connection profile.

If we create different connection profile with different aliases it works but we do not work on this way because we do not want clients to see and choose alias.

Thanks,

[Rob Ingram]

Hi,

Did you modify the configuration to permit group policies to be assigned to VPN users from RADIUS? See example below

Which RADIUS values did you configure in the Authorisation Profiles?

HTH

[star btsistem]

Hi, 

Yes i have already modified, you can see the screenshot below. I am using "ASA VPN" attribute on ISE.

Firepower config :

ISE auth policy config :

---

@Rob Ingram wrote:

Hi,

Did you modify the configuration to permit group policies to be assigned to VPN users from RADIUS? See example below

Which RADIUS values did you configure in the Authorisation Profiles?

HTH

---

[Rob Ingram · Accepted solution]

Are you performing posture? If so are you applying the group policy once posture status changes from unknown to compliant? If so, that doesn't appear to work, it only works when first establishing the VPN. So when performing posture, create multiple AuthZ rules (using AD groups to differentiate the users) for the posture unknown state, apply the GP on this first authorisation.

HTH

[star btsistem]

---

@Rob Ingram wrote:

Are you performing posture? If so are you applying the group policy once posture status changes from unknown to compliant? If so, that doesn't appear to work, it only works when first establishing the VPN. So when performing posture, create multiple AuthZ rules (using AD groups to differentiate the users) for the posture unknown state, apply the GP on this first authorisation.

HTH

---

Yes we are performing posture and yes applying the group policy once posture status changes from unknown to compliant. Ok i will try it now, but i have a question for this; on unknown policy we are redirecting the users to CPP, will i use ASA VPN attribute on the same policy ?

Thanks,

[Rob Ingram]

You can either combine all the settings into 1 AuthZ Profile or create 2 AuthZ Profiles and reference them both in the same AuthZ rule.

[star btsistem]

Very very thanks :) it works by that way :)