AnyConnect DHCP Pool - Based on A/D Group

[wmoody329]

Is it possible for the DHCP Pool assigned to the user to be based on their Active Directory Group?  Like to maybe have a default Pool, but for users in a specific Active Directory Group to get assigned an IP from a different local DHCP Pool?

[Rob Ingram]

@wmoody329 if you use RADIUS for authentication/authorisation you can authorise the user based on their AD group membership and return a DHCP scope. You'd just create multiple rules based on the number of different AD groups, and return a different DHCP scope as required.

The RADIUS attribute to send to the user is "CVPN3000/ASA/PIX7x-DHCP-Network-Scope", example using ISE:-

[wmoody329]

Rob we are actually using MFA with Azure. I'm not sure if that simplifies the issue or not. 

[Rob Ingram]

@wmoody329 in this scenario before, I have used MFA for authentication and authorisation via RADIUS (ISE), which performs the lookup of the AD group membership and assigns the DHCP scope (as per above).

[MHM Cisco World]

FTD AnyConnect Certificate Map – integrating IT (wordpress.com)

check this link 

MHM