Applying ISE Dacl to Anyconnect client

[tahscolony]

I have this mostly configured and working as far as getting the user authenticated, and authorized, with ISE sending the DACL to the ASA. I then get an error on the client.

Login Denied , unauthorized connection mechanism , contact your administrator

Tells me it is a configuration issue, so I either have the Dacl misconfigured, or the ASA.

What I want is the end user to have a single IP on the VPN for TCP port 3389.

The Dacl has

permit tcp any host 172.16.0.120 eq 3389

Something is telling me this is hte issue, but unsure as to how the Dacl is applied to the end user.

[Karsten Iwen]

The DACL should be fine and should work, at least this line. The error-message soundl as if there is an error in the group-policy (applied locally or through ISE) with a missing vpn-protocol.

[Nayan.Patel85]

Tahscolony,

Have you tried to run the debug while Client is attempting to connect.

I had similar problem in the past,

ISE will say DACL syntax is valid, but ASA was not able to parse the DACL and denying the connection.

[tahscolony]

This is an old one. I got it working using ACS instead with Anyconnect. I will revisit ISE at a later time when we transition TACACS+ to it, and did figure out the sequences in ISE, just have to clarify the syntax of the DACL as it is slightly different in ISE compared to ACS, and the ASA expects it a certain way.