Anyconnect 4.0 and Authenticating only Corporate Controlled Clients

[shawnalloyd]

Today we have an environment that allows about 30,000 devices to connect over VPN using Anyconnect 3.x. Some of these devices are corporate owned, others are employee personal pc's and tablets, that they use with Anyconnect 3.x to access the corporate network over VPN. What we are after is a solution with Anyconnect 4.x that would allow only connections from Corporate devices, or tablets/phones that we control. Is there any option available to use with Anyconnect 4.x that would allow only connections from our known devices. We would like to authenticate similar to how we use .1x in the internal corporate network to discriminate between personal and corporate pcs. 

thanks

Shawn

[Marvin Rhoads]

You could use ISE as your authentication server. It can check on device attributes such as domain membership, presence of a certificate etc. You need to have ASA 9.2 or later for ISE to do this (it works via RADIUS Change of Authorization)

With ISE Apex (formerly know as Advanced) licenses you can drill down into more details to assess the posture, check for registry keys, consult your Mobile Device Management (MDM) software for device status, etc.

[shawnalloyd]

We do this today with ASA and ISE. Do you have any specific information regarding AnyConnect 4 that would be more generic across all platforms, i.e phones and tablets. Also, any good links regarding AnyConnect 4 would be great.

[Marvin Rhoads]

When you deal with phones and tablets, you aren't getting AnyConnect 4 but rather the native AnyConnect client version for those platforms (iOS or Android).

In that case, your functionality would be primarily via what you can do with ISE 1.3. The ISE 1.3 documentation is pretty thorough in that regard and ISE Apex is required thus a Cisco Authorized Technology Partner (ATP) should be involved and they have access to even more partner level documentation on setting up the various features.