Any option to block specific anyconnect vpn user from cisco asa

[Richard.cheng]

Hi,

I would like to block some specific  AD service account coming for anyconnect vpn .
please help/assist is there any option to do this in ASA side , not by blocking with ip , by blocking with user.

[MHM Cisco World]

add 0 access group-policy and then use group-lock

https://www.cisco.com/c/en/us/support/docs/security/ios-easy-vpn/117634-configure-asa-00.html

MHM

[ccieexpert]

there are many ways to accopmlish this.. one easy way is to use DAP

ciscoasa# conf t
ciscoasa(config)# dynamic-access-policy-record BLOCK_USER
ciscoasa(config-dynamic-access-policy-record)# description "Block specific VPN user"
ciscoasa(config-dynamic-access-policy-record)# aaa-attribute username eq USERNAME_TO_BLOCK
ciscoasa(config-dynamic-access-policy-record)# action terminate
ciscoasa(config-dynamic-access-policy-record)# exit