domain computer check for anyconnect connection

[xili5]

Hi expert,

ISE is used for radius server for anyconnect connection. Is it possible to check whether anyconnect PC is a domain computer?

I use AD domain user for authentication, create authorization condition to check domain computer and define different rights accordingly. But it doesn't work. I use a domain computer to connect anyconnect vpn successfully, but from radius log, session does not match the condition of checking domain computer.

br,

Martin

[paul · Accepted solution]

I don't think you will have much luck getting the VPN client to pass in domain computer credentials.  You have two ways to handle this typically:

1. Configure the ASA to check the attaching device for a computer cert issued from the customer's CA.  This assumes the customer has an internal CA and is issuing computer certs to their domain joined devices.
2. Use posturing to check the registry for domain joined computer status.

#1 is the method I always use to ensure my Employee VPN is only allowed on corporate owned devices.  When you do computer cert authentication on the ASA you have to roll out the XML profile ahead of time with the machine store cert check setting enabled.  Otherwise the AnyConnect client can't check the machine cert store. 

You would be doing machine cert check on the ASA + AD credential check in ISE. 

[shehreyar]

Hi,

I have similar requirements, can you please share the steps for method#1 .?

[Greg Gibbs]

See these examples for the both the ASA configuration and the ISE policy configuration elements.

SSL VPN with AnyConnect using Certificate-Based Authentication 

ISE Configuration for Anyconnect VPN