Remote Access SSL VPN with Split tunneling and ISE posture

[imanv]

I have a Cisco ASA configured as a VPN gateway using AnyConnect as the VPN client, and I plan to migrate to FTD soon. My remote access SSL VPN setup includes split tunneling with ISE posture assessment. However, I suspect I’m making a misconfiguration/misunderstanding because I need to create two authorization policies for each remote VPN group. Let me clarify the issue:

Example Scenario:

Users in Active Directory Group 1 must access a specific IP address:

IP 1: x.x.x.x/32

Current Configuration Steps in ASA:

1. I create an object group in ASA and set the required IP(s) in it.

object-group network GROUP1

network-object host x.x.x.x

   2.An access list to call it in DAP :

access-list DAP_ACL_GROUP1 extended permit ip object-group REMOTE_VPN_IPs object-group GROUP1

   3.Creating Split tunnel ACL :

Access-list SPLIT_ACL_GROUP1 extended permit ip object-group GROUP1 any

  4. Creating DAP access policy(DAP ACL):

dynamic-access-policy-record DAP_GROUP1

network-acl DAP_ACL_GROUP1

webvpn

http-proxy enable

Current Configuration Steps in ISE

  1- An authorization policy GROUP1_NON :

     I call the split tunnel (example: SPLIT_ACL_GROUP1 )

     I call the dACL (Pemrit PSNs) and configure the redirect to ISE provisional portal

  2- in authorization policy GROUP1_COM

     I just call the DAP (for example DAP_GROUP1)

 ISE checks the client’s posture (e.g., antivirus, firewall status) and assigns a compliance verdict. If compliant, the user matches the ISE "Posture Compliant" policy and gains access.

If non-compliant, the client have no access to anything.

Problem:

I require a setup where:

• All non-compliant users (regardless of group membership) match a single Non-Compliant policy with the same restricted split tunnel.
• Compliant users match group-specific policies with their specific split tunnel access (e.g., IPs/networks).

Currently, I’m forced to create duplicate policies for each group (one for compliant, one for non-compliant), which seems inefficient.

Current Versions:

ISE : 3.1 Patch 9

ASA : 9.14(4)24

[ahollifield]

Correct, this expected. Unless I'm misunderstanding your question you will always have multiple authz rules for compliant vs non-compliant.

https://community.cisco.com/t5/security-documents/how-to-ask-the-community-for-help/ta-p/3704356

https://www.cisco.com/c/en/us/products/collateral/security/asa-firepower-services/adaptive-security-appliance-eol.html

[Aref Alsouqi]

As @ahollifield mentioned, we always have seperate authorization rules for compliant and non compliant and we also have another one for the unknown clients that their status haven't been decided yet. Each of these authorization rules will have an authorization profile applied. However, you don't have to create redundant rules for each AD group, you can instead add multiple AD groups to the same authorization rule.

[Rob Ingram · Accepted solution]

@imanv I assume you have multiple AuthZ rules because you are sending different radius attributes to the users? In which case you could use ISE dynamic attributes, which uses one rule and performs an external lookup to AD to get the relevant attribute. Here is an example.

Although, it might just be simplier just to have multiple AuthZ rules based....depending on how many you require.

[imanv]

@Aref Alsouqi     @ahollifield       @Rob Ingram 

Many Thanks for your replies. I'm going to test the @Rob Ingram solution. It seems an interesting idea. I also used to apply it to set the special IP address for the users.