ASA IP reservation based on VPN username

[stephen.collum]

I saw a post about the ASA now being able to perform IP reservations based on MAC addresses but couldn't find anything about doing the same thing based on the username connecting to VPN. Is this possible?

[Rob Ingram]

@stephen.collum you can assign an IP address from RADIUS, example - https://integratingit.wordpress.com/2017/01/01/cisco-asa-anyconnect-vpn-with-static-client-ip-address/ which would assign the same IP address per user

[stephen.collum]

Thank you for sharing that link. We already use ISE for wireless authentication so this may work for us. Just to be thorough, do you know if this can be done without moving the VPN authentication to ISE?

[Rob Ingram · Accepted solution]

@stephen.collum you can use an LDAP attribute map on the ASA to query the attribute in AD for the static IP address, as defined under the user's AD User Properties, Dial-in tab.

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/91831-mappingsvctovpn.html#anc17

[stephen.collum]

Perfect! Thank you Rob.

[MHM Cisco World]

if you use local then command below will help you 

username USER attributes
  vpn-framed-ip-address x.x.x.x y.y.y.y

 ASA/PIX: Static IP Addressing for IPSec VPN Client with CLI and ASDM Configuration Example - Cisco

[stephen.collum]

Thank you for posting those commands. When you say local you mean the user accounts, right?

[MHM Cisco World]

I am talking about authentication user locally in ASA and add this attribute under the User attributes. 
authentication locally meaning using username/password save in ASA.