09-30-2019 09:37 AM
Hi All,
Need to set up an anyconnect client Vpn where my users get authorize via using 2FA i.e 1st will be AD then party Innefu token. After these successful check, my machine will be checked for Registry key using ASA Host-scan features and then user will be allowed to connect to Anyconnect client Vpn and access to corporate network.
Is this possible to check Registry key using ASA host scan?
I know it would be achieved using ISE posture but I don't have ISE in my infrastructure.
Any help.
Regards,
VISHAL
09-30-2019 09:53 AM
A. Yes. AnyConnect 4.x still supports Hostscan functionality for VPN only posture with the Cisco ASA. AnyConect 4.x also has a unified posture agent that works across wired, wireless and VPN but this requires ISE 1.3 or greater. An AnyConnect Apex license is required for both options.
09-30-2019 09:58 AM
Dear Balaji,
Thanks for your reply.
Is it any document related to my scenerio where I can use host scan feature of ASA for registry checking and then authorize user to enter my network.
Note: I don't want to use ISE for this condition
09-30-2019 10:49 AM
What registry value do you want to check?
If you want to check to confirm whether the computer is joined to the domain, locate the domain name in the registry of the computer. E.g:-
Then create a basic hostscan for that registry value. E.g:-
Create a new DAP, define tunnel-group user is connecting from and check endpoint attributes to determine whether the registry value is correct (in this example lab.local is the local domain). Action is continue if matched. E.g:-
HTH
10-01-2019 06:30 AM
10-01-2019 08:37 AM
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide