Anyconnect connection profile

[rajmohan30]

Hi Team,

I have couple of questions and challenging to find the answers. Would you pls clarify me on the below items ?

1) Under the tunnel-group config, we have the group-url along with group-alias is configured. Which means when the user connects to the vpn with that URL, the connection profile automatically assigned to that users as far as i understood.

I also see certificate mapping to connection profile is configured for the same. I don't know which one takes precedence here between group-url vs certificate map and not sure how to check if the certificate mapping is used (any show command to check) or simply sitting idle in the config.

2) We are using Cert only auth method using digital cert and the username is extracted from the cert and checked against LDAP server for authorization.. Can you please explain me the purpose of authz here ? Is it an additional security check and it does make any impacts to the connection in case of authz fails ?

[Rob Ingram]

Hi @rajmohan30 

When the users firsts attempts to connect to the ASA, they will connect to the tunnel-group/connection profile as specified in the anyconnect profile or manually entered. When the ASA processes the connection, if a certificate map exists and is matched then this would take precedence.

Authorization can be used to push down additional attributes to the connected user, e.g. ACL, DHCP pool per AD group etc. If you fail AuthZ then you don't get connected.

HTH

[rajmohan30]

Hi,

Thanks for the response. Is there any show command to check if the certificate map to connection profile had any hits ?

[MHM Cisco World]

webvpn 
cert.group "depend on issuer" webvpn
tunnel-group webvpn
group-alias

As I understand the cert. determine the tunnel-group,
i.e. it happened before the alias.
https://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/116111-11611-config-double-authen-00.html#anc16

[rajmohan30 · Accepted solution]

Hi,

Thanks for the confirmation.. Seems by default, the connection profile to cert map takes the precedence but there is an option to make group-url to take the precedence (the checkbox is disabled by default). Thanks all for your feedback/comments.