Connection profile detection in ISE

[martinlarsen]

I would like to set up an alternate connection profile in the ASA for testing posture assessment when authenticating via ISE.  It is well known that AV pair 25 can be used to assign the group policy.  Is there a way for ISE to determine the connection profile?  This way test testers can get in with or without going through posture assessment during the test period.

[abhishek.marat1 · Accepted solution]

Please try using:

Cisco-VPN3000:CVPN3000/ASA/PIX7x-SVC-Profiles contains "Connection profile name".

Attaching a screenshot.

P.S: Please marked my comment as accepted solution if it works, thank you!

[martinlarsen]

I jumped the gun clicking on the "Solved" button.  I see in the following message in the authentication steps in ISE, but there is no answer.

15048

Queried PIP - Cisco-VPN3000.CVPN3000/ASA/PIX7x-SVC-Profiles

I do see an entry for CVPN3000/ASA/PIX7x-Tunnel-Group-Name in "Other Attributes".  This entry is just plain wrong.  It lists the name of a different connection profile in the ASA; not the one connected to in this session.

[Rob Ingram]

"CVPN3000/ASA/PIX7x-Tunnel-Group-Name" EQUALS Profile-Name < this works for me. I can create multiple AuthZ rules in ISE and match on each rule depending on which Tunnel Group the user connects to (via drop down box in AC).

What is the output of "Tunnel-Group:" when you run "show vpn-sessiondb detail anyconnect"? That should match the Tunnel-Group in the ISE Live logs.

[martinlarsen]

[Rob Ingram]

Do you have a certificate map overriding the tunnel-group?

[martinlarsen · Accepted solution]

It is working now.  CVPN3000/ASA/PIX7x-Tunnel-Group-Name is the proper attribute to check.

In the earlier screen shot, the results shown were cached from previous authentications.  Disabling "Suppress repeated successful authentications" corrected how it showed up in the logging.