From all that I have learned so far, the only way the ASA can talk to the ISE IPN is via RADIUS.and that takes a lot of options out of play for VPN users/machine authentications.
Ideally we would like to verify that both the user and the machine are members of the domain before we allow full access to our network. Better still would be certificate verification for any machines that are members of our domain.
At this time we have settled for a simple NAC agent read of a specific registry key that says the machine is a member of our domain. Primitive, yes, but does what we need for now.
Now my challenge is contractor systems...we have about 30 of them....and I am afraid that to read a registry key for the exact machine name they give us upon signing our access agreement means that I have to create 30 different policies to make it read the registry key over and over as it goes through each policy.
Is there some way to make a list in a policy, so that instead of 30 different policies, I have one policy that reads through a list of possible texts that would be acceptable?
Dirk
