Using ISE to assign ACL's for VPN users

[Jason Regan]

Hi,

I've just implemented ISE into our environment using various documents and videos found online but have not been able to find anything about using ISE to Authenticate remote users via VPN and assigning them the ACL's created for thewir level of network access.

Does anyone know of a good document or training video knocking about that I can use?

Thanks

Jason

[Tarik Admani]

Jason,

If the ACL is present on the ASA you can use the "filter-id" radius attribute to reference the acl to the user's session. You can make this work by configuring an authorization profile and tying this in with your authorization policy for vpn users.

If you want to push an acl then my recommendation is to use the cisco-av-pairs to push the acls since the username is associated with the acl that is applied to the username of the vpn session.

http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/ref_extserver.html#wp1763743

Thanks,

Tarik Admani
*Please rate helpful posts*