Anyconnect

[Raimund Schimanovits]

Hi

How can i assign a policy group to a user in a router?  

So i will assign a policy to a group of members and an other group to other members. There are differesnt acl for different services.

br

webvpn context SSL_Context
gateway SSLVPN_GATEWAY
!
ssl authenticate verify all
inservice
!
policy group SSL_Policy
functions svc-enabled
timeout idle 300
svc address-pool "SDM_POOL_1" netmask 255.255.255.0
svc split include acl 1
default-group-policy SSL_Policy

[Rob Ingram]

@Raimund Schimanovits what authentication method are you using? The best way to achieve this is using RADIUS where you can send the specific settings (ACL, address pool) based on the user's group membership.

[Raimund Schimanovits]

i have only 3 members so i use local authentication. 

br

[MHM Cisco World]

Check group-lock option 

We use it for asa ssl ra vpn and I think it also available in router IOS.

MHM

[MHM Cisco World · Accepted solution]

https://www.cisco.com/c/en/us/support/docs/security/ios-easy-vpn/117634-configure-asa-00.html

MHM

[tvotna · Accepted solution]

Should be

aaa authorization network WebVPN local

aaa attribute list AssignPolicy1
 attribute type user-vpn-group "SSL_Policy1"

aaa attribute list AssignPolicy2
 attribute type user-vpn-group "SSL_Policy2"

username user1 password 0 cisco
username user1 aaa attribute list AssignPolicy1

username user2 password 0 cisco
username user2 aaa attribute list AssignPolicy2

webvpn context SSL_Context
 aaa authorization list WebVPN
 ...
 policy group SSL_Policy1
  ...
 policy group SSL_Policy2
  ...