ISE + ASA VPN Portal anyconnect Login Error

[thomas poeckl]

Hello;

We have a ASA 5515 as VPN Portal, and a ISE 2.7 for allowing the Domain Users to connect with Posturing to our Network.

So far so good, everything works fine.

Now i want to upgrade the annyconnect Client and get this Error when i try to login to our VPN Portal:

5400 Authentication failed

15039 Rejected per authorization profile

Authorization Profile with ACCESS_REJECT attribute was selected as a result of the matching authorization rule. Check the appropriate Authorization policy rule-results.

How can i allow our Users to Login to the Portal for the Webdeploy Clint Upgrade?

Many Thanks, Thomas

[ashok_boin]

Hi Thomas,

Can you please follow this article for both Anyconnec clients (before and after upgrade) so that it's easy to rule out the issue? 

https://community.cisco.com/t5/security-documents/how-to-troubleshoot-ise-failed-authentications-amp/ta-p/3630960#toc-hId--236862679

Or, it may be hitting this bug as well?

https://quickview.cloudapps.cisco.com/quickview/bug/CSCuy05270

[Mike.Cifelli]

Are you unable to rely on the ASA to upgrade connecting clients via webdeploy? IMO that would be the easiest/quickest solution mainly because ISE webdeploy via CPP is a bit more complex.  Lastly, I think it is unclear (not enough info) to fully understand what you are wishing to accomplish in terms of AC upgrades.  

15039 Rejected per authorization profile

-This means clients are not matching your respective authz policy.  Verify your radius authz conditions as it seems they are hitting the default deny policy.

[thomas poeckl]

Thanks for the Reply, i have the Problem that users who try to connect with the ISE Posturing Policyare not allowed to download the  upgraded anyconnect webdeploy client provided by the ASA VPN Portal. With the old anyconnect local User on the ASA webdeploy is working fine.

Thanks an Greetings, Thomas.