09-30-2015 02:05 PM
Is there any feature in Cisco Anyconnect or other software to allow Domain users to connect only to their
corporate VPN. We don't want domain users to connect any other VPN rather than corporate VPN.
VPN users are authenticating with ISE. Is there any workaround for this.
09-30-2015 09:41 PM
I think you can use the Always-ON and Auto connect on start feature of the XML profile to accomplish this.
Make sure to uncheck the "user controllable" and "allow vpn disconnect" to avoid the end user to start another VPN session.
See more information about those features:
https://supportforums.cisco.com/document/12549161/anyconnect-xml-preferences
Hope it helps
- Randy -
10-02-2015 03:36 PM
Hello,
I would suggest using a DAP policy and check for a certificate or a register key on corporate machines. This action requires host-scan. You can learn more about DAP policies following this link:
http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/108000-dap-deploy-guide.html
Also an LDAP mapping would be a good option to prevent users to connect to a tunnel-group they are not supposed to connect on.
http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/98625-asa-ldap-authentication.html
Please check those links out and if you have any questions please let me know.
Regards,
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: