Flows between an ASA and an ISE with dACL

[Jeremy Dubrulle]

Hello,

We are using ASA with Anyconnect VPN clients. The ASA asks the ISE to auth the user and the ISE checks the user with the Domain Controller. Once authentified, the ISE pushes downloadable ACL depending on the user. These ACL are then used by the ASA to restrict the rights of the user.

I'm not sure of how it works, I mean the exchange since the beginning until the ACL on the ASA, I don't know this thing. But I have to tell if we can replace the ASA by Fortigate and Forticlients. So I'm trying to understand how it works so that I can tell if the ISE can still pushes its ACL if it's a Fortigate instead of an ASA. Is it a thing we can only do if we have ASA with the ISE ?

Can you help me, provide me documentation ?

Thanks,

[hslai]

Please take a look at these:

ASA Version 9.2.1 VPN Posture with ISE Configuration Example - Cisco

ASA 8.3 and Later: Radius Authorization (ACS 5.x) for VPN Access Using Downloadable ACL with CLI and ASDM Configuration Example - Cisco

AnyConnect Group Authentication With Cisco ISE and Downloadable ACLs (Part 1)

AnyConnect Group Authentication With Cisco ISE and Downloadable ACLs (Part 2)

[paul · Accepted solution]

I doubt the Fortigate will support dACLs.  If you look at the details of the RADIUS live log record for your VPN traffic you can see the RADIUS Attribute/Value (AV) pairs passed between ISE and the ASA.  The dACL is passed as AV pairs and needs to be supported by the network device.  Only Cisco devices (and not all Cisco devices) support dACLs that I know of.

I am guessing you can build ACLs on the Fortigate and assigning the user to a group on the Fortigate that limits their access, but I am not at Fortigate expert.

This may help:

https://kb.fortinet.com/kb/viewContent.do?externalId=FD36919&sliceId=1

[Jeremy Dubrulle]

Thanks both of you, seems we can't indeed.