Anyconnect profile as Radius atribiute

[zahir_zahir]

Hi.

Is it possible to send profile name as an Radius atribute during client authentication? I would like to match users depends on profile name to sperate Identity Stores in my ACS.

ASA 5540 8.4, anyconnect 3.1.01065, ACS 5.1

thanks.

[Javier Portuguez]

Hi Ad,

I have verified the Radius IETF and Radius Cisco, but could not find any attribute for this purpose.

You may want to open this same post on the AAA community.

HTH.

Portu.

Please rate any helpful posts

[zahir_zahir]

Dont know how i couldnt find that earlier:

https://supportforums.cisco.com/thread/2102448

[Javier Portuguez · Accepted solution]

Hi Ad,

Thanks for refreshing my mind with this enhancement request, yesterday I could not find it.

Please check this out:

Radius upstream VSAs (Tunnel Group,Client type) for VPN policy decisions

Symptom:Enhacement request: Implement ASA facility to send Radius VSAs (vendor Specific attributes) such as Tunnel Group and Client Type upstream to a Radius Server for VPN Remote Access policy decisions Conditions: Workaround:This AAA feature was implemented in ASA version 8.4.3 Key vendor-specific attributes (VSAs) sent in RADIUS access request and accounting request packets from the ASA Four New VSAs—Tunnel Group Name (146) and Client Type (150) are sent in RADIUS access request packets from the ASA. Session Type (151) and Session Subtype (152) are sent in RADIUS accounting request packets from the ASA. All four attributes are sent for all accounting request packet types: Start, Interim-Update, and Stop. The RADIUS server (for example, ACS and ISE) can then enforce authorization and policy attributes or use them for accounting and billing purposes.

Fixed-In

8.4(3)

8.6(1.3)

9.0(1)

http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCsw31922

So you may want to give it a try in this versions.

HTH.

If you do not have any further questions please mark this post as answered.

Thanks