Anyconnect User and machine certificate sending to ASA and then to ISE

[Cisco_user3]

Hello,

I'm looking to use both certificate authentication at asa level and authorization on ISE.

Anyconnect is able to send both certificate to ASA.

but i'm not able to Send both certificate from asa to ISE, is that possible?

Someone already try this ? it is possible to implement it ?

Thanks for your help

@Philip D'Ath 

@Mohammed al Baqari 

@Marvin Rhoads 

@Rahul Govindan 

[Rob Ingram]

Hi,
VPN authentication using only certificates is between the client and ASA only. You can still do authorization for the user against ISE (configure authorization only mode under AAA Server Group). This relies on the CN value in the certificate matching a username in AD.

If you want to also authenticate against ISE, configure the tunnel-group for AAA and certificate. This will prompt for username and password to authenticate against ISE (internal user or AD) and a certificate (authenticated against the ASA).

HTH

[Cisco_user3]

Thank you RJI.

To goal is to maintain authentication on ASA  but autorization on ISE.

We are looking for autorization of both user and machine, but asa just sent one certificate not both.

The question is to know if it is possible to send both certificate (user + mùachine)

[sdfgdfgfddfdfgdf]

Hi,

This looks similar to what I also want to achieve.

We could then authenticate both computer and user with less interaction by the user.

Two features which seem almost ideal, and nearly match the MS equivalent Always On seem to be:

• Management VPN Tunnel
  • Connects before the user, and uses the Computer certificate for limited access.
• Always-On VPN
  • Can be set to connect at login, and can use the User certificate for full access.

Unfortunately, these both use Trusted Network Detection, which conflicts.

Management VPN Tunnel connects fine, but then Always-On VPN doesn't because it is then on the (limited) network.

I wonder if anyone else has tried this and found any workarounds?

Or if there is anything in the pipeline form Cisco to get this working which will greatly improve user experience?