EAPTunnel is not available in Policy Set / Matching PEAP

[kylerossd]

Hello,

EAPTunnel is not an option under the policy set Network Access conditions.  It is however an option inside the policy set for Authorization, which does not help me.  I need to differentiate between PEAP and TLS so that one flow hits an external RADIUS server sequence.  How would one go about matching PEAP with RADIUS or another condition?

[Marcelo Morais]

Hi @kylerossd ,

 if you are able to use the Dictionary Cisco-VPN3000 and the Attribute CVPN3000/ASA/PIX7x-Tunnel-Group-Name on the Conditions of the Policy > Policy Sets, then you will be able to use an specific External Identity Sources or Identity Source Sequences on the Authentication Policy.

Hope this helps !!!

[kylerossd]

Thank you for the reply.  Unfortunately these are all coming off the same switch.  I wish there was a way to classify them before they accessed the policy set or have external RADIUS server and AD join points inside the same policy set.  But, this is not possible.  I am not aware of any RADIUS AV Pair that would match PEAP or TLS.  The only option that I can think of is do a regex looking for the domain(s).  like RADIUS:User-Name MATCHES .*(domainabc.com)$.  I guess this would work but it is .... ugly.

[hslai · Accepted solution]

It's part of the fix for CSCvc98033 to remove such conditions, because such attributes are not yet available for a new endpoint session at the time of selecting a policy set.

As a result, you need to pick something else. Perhaps to use patterns of Radius:User-Name.