Alternative to DAP in FTD

[nibor64]

Hi

I'm currently migrating a customer from ASA to a FP2110 using Firepower Threat Defence. As we're probably all aware DAP (Dynamic Access Policies) are not yet supported on FTD, but i was wondering if anyone else has any idea or workaround to implement the same functionality.

The customer uses DAP on the Anyconnect setup and if the Anyconnect Client belongs to specific AD Groups he grants them special permissions to the network based on Access Lists.

The way i see it we could just implement Access Rules in the Access Control Policy to grant specific permissions based on the AD Group but this does not work from a VPN Point of view. Even when you log on to Anyconnect using your AD Credentials, FTD does not map your username to your IP-Address so we can not perform this kind of enforcement unless the client is connecting from a domain laptop.

Has anyone stumpled upon this and figured out other ways to implement it?

[nibor64]

So far what i have done is to implement multiple tunnel-groups using different IP Pools and made access rules in the Access Control Policy based on the IP Pool. This works, IF the user actually uses the URL we have created and given them, we cannot prevent them from just logging in to the customer.com tunnel-group and receive full access to the network.

[nupur jain]

Hey nibor64,

Can you throw some light on what are customer URL and default tunnels groups! 

How does that change anything for us?

---

@nibor64 wrote:

So far what i have done is to implement multiple tunnel-groups using different IP Pools and made access rules in the Access Control Policy based on the IP Pool. This works, IF the user actually uses the URL we have created and given them, we cannot prevent them from just logging in to the customer.com tunnel-group and receive full access to the network.

---

[k.nandakumar]

You can achieve this by integrating ISE with FMC and, configure DAP on ISE, based on user/group ISE will assign group-policy.