We are in the process of testing Cisco AnyConnect authentication using AD user certificates (haven't got machine certificate working just yet). Our goal with using certificates is to use the Always-On feature and therefor not having to have a user entering username/password. Our production AnyConnect VPN (username & password) process is setup using a Windows Network Policy Server (NPS) as our RADIUS for authentication. Within the NPS, we have policies setup to detect what AD group a user is assigned to and base on that will get an IP address from one of the different IP pools configured on the ASA.
Now with using Certificate authentication only, that apparently stops the process of checking the NPS to see what group a user is a member of in order to get assigned to the correct IP pool. Is there a way to accomplish still without having to create separate custom URL links for the different groups of users? Any examples will be greatly appreciated.
Goal - Use AD user certificate to authenticate to VPN and assign the user to the correct IP Pool based on AD group membership.
Thx in advance for any help given.
