Anyconnect NON-complaint Machine with ISE 2.0

[khaled alodat]

HI,

is there a way to force non complaint Anyconnect users to be redirected to WebVPN.

I have configured a posture to check domain machine based on an entry on RegEdit . if the machine is domain machine an authorization profile is assigned with full access. what i need is : if the machine is not domain machine (non-compliant) I need the user to use only webvpn (clientless).

technically i need the authorization profile to deny the connection (which is easy) but i need the user to be notified that he can only use the web version.

Thanks in advance .

Khaled 

[Rahul Govindan]

Might not be exactly what you want, but you can try setting the default group policy for the tunnel group to have only the "clientless" vpn-tunnel-protocol. Users who match your posture condition and have authz policy can be assigned a different group-policy from ISE that has both "anyconnect" and "clientless" as vpn-tunnel-protocol. This won't redirect them to webvpn directly but wont allow them connection via anyconnect unless they have the right posture.

[khaled alodat]

I thought about this solution but there is one problem with it. the COA does not allow you to resend a new authorization profile with different result. can i push a msg for users as part of the authorization profile? ex: non complaint devices --> deny access + MSG 

[Rahul Govindan]

I believe during "Posture Unknown" state, you hit one authz policy and when you change to Compliant or Non-compliant, you get other attributes pushed out to you. The flow is defined here:

http://www.cisco.com/c/en/us/support/docs/security/adaptive-security-appliance-asa-software/117693-configure-ASA-00.html

You can use the remediation action to show a message when a posture condition fails, but the problem is that you are still in posture unknown state during that remediation state - which means you are not denied connection, but anything you send on the browser is redirected to the Client Provisioning page.

An easy way to do this is with DAP and hostscan on the ASA, where you can send a message and even allow "Access-Method" to be only Clienteles when a DAP policy (checking for posture) is not hit.