Location based authorization

[wileong]

Hi there, 

A customer with requirement to return different AUTHZ policy in ISE based on location from ASA remote VPN.

What is the best way to achieve this?

Thanks

Wing Churn

[hslai · Accepted solution]

In case the location is that of an ASA headend, then we may set the NAD to a specific location in ISE configuration and use that info for authorization.

In case the location is the geo-location of a remote access VPN session, we may use the calling-station-ID RADIUS attribute as conditions. ISE is not currently supporting to perform a lookup for geo-location info of a remote access client so the conditions would likely need set explicitly.

Additionally...

Marvin Rhoads mentioned a solution using IPS -- The new model ASA (5500-X - Cisco Community

Karsten Iwen suggested using DAP -- Re: Can CISCO ASA locate anyconnect geo... - Cisco Community

[wileong]

Hi Hsing,

Thanks for the tip, follow up question on the suggestion. Is calling-station-ID appear as private IP of the AnyConnect real client IP in ISE or the egress IP of the client?

Thanks

Wing Churn

[Surendra]

It should be client's physical NIC ip (or mac address?) since the VPN connection is not complete and the tunnel IP would not have been assigned.

[hslai]

It's the external gateway IP address, usually the one from the ISP, that used to contact the RA-VPN head-end.

For example, in [ client -- home router -- Internet -- RA-VPN ], the internet facing IP address of the home router.