ASA - AnyConnect - Want to terminate user based on certicate

[kennethhandberg]

Hello,

We are using AnyConnect AlwaysOn with certicate auth.
When PCs are stolen (it happens) - I would like to terminate the specific PC based on certicate name or PC name.

In the log, it looks like the PC-name comes in as Username

"Group <RemoteAccess-Cert-GrpPolicy> User <VK32851.domain.name>"

Can I just create a DAP where I terminate on Username?

[Rob Ingram · Accepted solution]

@kennethhandberg 

Ideally you'd revoke the certificate and get the ASA to check the CRL, which would then deny the connection.

Yes, DAP seems like a good alternative, match the username and terminate the connection.

[kennethhandberg]

Hello Rob,

Thanks for answering.
I'm gonna use OCSP for validation instead of CRL