ASA DAP functionality in ISE

[gjw_csco]

Do we have a way to support a customer that is currently using DAP on ASA with ISE?

The customer is using DAP to assign "Basic VPN Connectivity" ACL based on LDAP group, then provide additional access with a network ACL above and beyond if they are part of a different LDAP group. They would like to centralize everything with ISE.

[Timothy Abbott]

Hi Gregory,

Have you seen the response to a similar question?  This might be what the customer is looking for:

https://supportforums.cisco.com/t5/vpn/asa-5525x-anyconnect-configuration-with-ise-2-1/td-p/2997585

Regards,

-Tim

[Craig Hyps]

Yes, ISE can return an attribute like Class 25 which contains the Group Policy name.  There is a section in DAP that allows mapping of RADIUS attributes to DAP policy.