I have a customer who owns ISE admin but not FTD admin so they want to do dACL for RA VPN so they can skip the Access Control Policy on FTD. (So the less they have to ask to the FTD team the better).
They want AD integration for authentication but also need a local database for non-corporate users (external users).
Can they have both AD and local authentication and authorization done through ISE (so FTD would just reference ISE for both)?
I'm thinking FTD authentication should go to ISE and ISE would check with AD, if user is not in AD then check local user base).
(then they will add DUO MFA... but I guess I'll post that with DUO after this is confirmed...)
P.S. Does dACL require posture capable license?
