FMC FTD RA VPN Session Info

[JGB_GtmK_CJoN]

Greetings,

Using the FMC or CLI, how can I find the computer name of the device that an end-user is connecting from when they use Anyconnect client for RA VPN?

FMC & FTD 4112's = 7.2.5

Secure Client w/Anyconnect = 5.0.0540

Thanks!

[Rob Ingram]

@JGB_GtmK_CJoN if you just want to determine whether the authenticated user is connecting from a trusted/managed device the standard way of doing this is either using a machine certificate (which can only be issued via your internal CA) or using a DAP policy to confirm the device is joined to the domain. If either fail the connection request fails.

[JGB_GtmK_CJoN]

@Rob Ingram yes, very much agree. That is being discussed and prepared but is not available for all devices.  There is a mixed pool of W10, W11, MAC OS, Linux, Android & iOS.. so the domain join is something that needs to be worked through for some of these client machines.  It should be straightforward for W10, W11 but there are a few hurdles with the rest.

Having an identifier that gets parsed via SYSLOG would allow some form of identification vs. null.  This would be an interim until certs are worked out.  If there is any other suggestions, please let me know. 

[Marvin Rhoads]

This might be available using ACIDEX natively via the Dynamic Access Policy (DAP) feature if we gather endpoint host name as one of the matching criteria.

I know that when we use ISE we get all of the ACIDEX information automatically. See attached for the details I get when connecting to my lab VPN and authentication to AD via ISE.

[Marius Gunnerud]

If you want to collect the hostname of the machines connecting to VPN you will either have to use certificate authentication and use the machine name in the CN field or install a host scan agent on the end device that collects data about the system and sends to, for example, an ISE appliance.