I am looking to eliminate the need for the drop down list, and just assign a users policy based on their GPO in AD through ISE. Was looking at this doc, http://www.petenetlive.com/KB/Article/0001155 , but it retains the group drop down. I don't want to over complex it either(I don't want to own it IYKWIM), so should be fairly easy to manage.
I would also like to incorporate Two Factor using Certs, and not the breath mints(can you still get those?). I have two options for Certs, push then out via the ASA, which means a separate item to admin, or through AD, either through ISE or a windows Cert server. We do have APEX licenses, ISE and X model ASA, so have pretty much the latest and greatest.
Which method would work best in this situation then, using ISE, or using LDAP as per this, http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/98634-asa-ldap-group-pol.html ?
End goal, needs to be dumbed down the the Executive level. Client clicks, auths and that is all. One step better would be click clicks and thats all, but now were into SSO and LBSO.
