ISE: 2.3 Using CVPN3000/ASA/PIX7x-Tunnel-Group-Name Atrribute Not Working for ISE Posture Condition

[misinsuan2229]

We are configuring ISE posture to be implemented to Anyconnect VPN. Decided to use tunnel-group-name condition to have separate posture policy between tunnel groups, but the issue is the attribute looks to be not working. 

I already checked in Live Logs and we are using the correct attributes CVPN3000/ASA/PIX7x-Tunnel-Group-Name then tried (Equals,Matches,Starts,Contains) to our vpn-group name but is failing to work. Checked that vpn-group name sent from ASA to ISE live logs is correct.

[Mike.Cifelli]

You need to define that in the Client Provisioning Policy. It would look something like this:

If {identity group:any} and Windows ALL and {CVPN3000/ASA/PIX7x-Tunnel-Group-Name EQUALS YOUR GROUP} then AnyConnect Configuration

Under your policy element (results) configure the AnyConnect Configuration for the VPN module and the proper profile selection for ISE Posturing.

I use this type of setup for all VPN users and differentiate based on the tunnel group name.

Good luck & HTH!