Anyconnect user static IP

[charleseapen]

Guys, looking for DC-DR static IP solution for Anyconnect VPN clients.

Current architecture is 

Anyconnect <> DC ASA <> DC ISE <> Corp AD

Anyconnect user gets a static IP. IP is binded to static IP properties of AD user in Dial-in Tab.

DC ISE fetches this IP (192.168.31.x range) and passes on to the user. Till now it's working perfectly.

Now, we are setting up another ASA in DR, now the architecture becomes;

Anyconnect <> DR ASA <> DR ISE <> Corp AD

this time the anyconnect user should get IP in the range 172.16.x.x range.

Anyone any idea how this can be worked out. AD user properties lets store only one IP address.

[Mohammed al Baqari]

Hi,

This is not possible using AD Dial-In option. You need to assign the static
IPs using ISE (Frame-IP) on a per user basis or use an external DHCP for
your IP Pool and bind using MAC addresses. But from AD, you can't have more
than one static IP.

One solution you can try is to have two OUs in AD with duplicate users but
having different static IPs. Then your ISE nodes in Active/DR should point
to their respective OUs. This makes active ISE validate with Active OU and
get Active static IPs and DR ISE validate DR OU and get DR static IPs.

I will go for ISE option of allocating IPs as this is the best option but
its your call.

***** please remember to rate useful posts

[charleseapen]

Thank you @Mohammed al Baqari 

I think the feasible option is " assign the static IPs using ISE (Frame-IP) on a per user basis". Question is how do we assign static IP in ISE for an AD user.

[Mohammed al Baqari]

Hi,

You match the username in the authorization policy and in the authorization
profile assign framed-ip attribute.

**** please remember to rate useful posts

[Rob Ingram]

@charleseapen 

Perhaps you could use dynamic variable substitution, example here. Add the IP address to an unused AD attribute, such as "pager" for each user. Create a new AuthZ profile, referencing the attribute. Use this AuthZ profile for sessions from the DR ASA.

[charleseapen]

Thank you @Rob Ingram let me test this.

[Rob Ingram · Accepted solution]

@charleseapen Out of curiousity and to confirm my thoughts, I've tested it and it works as expected.

msRADIUSFramedIPAddress just relates to the attribute under the Dial-in tab in AD, it seems you can use any attribute under the users account in AD, as long as you import them into ISE. I imagine you could use custom schema attributes also.

HTH

[charles07]

Thank you @Rob Ingram It worked like a charm.