ASA SSL VPN Group policy mapping via Active directory

[meidanmeshulam]

Hi everyone,

I got a VPN question, I'm looking at the next configuration:
group-policy "nomfa-Support, ou=VPNUsers" internal
group-policy "nomfa-Support, ou=VPNUsers" attributes
banner aaaabbbbccccddddeeeeffff
dns-server value 10.132.4.186 10.134.27.11
vpn-filter value RA_SCB_SUPPORT
vpn-tunnel-protocol ssl-client

Is this something that supposed to work without the tunnel mapping ?
there is no tunnel configuration that will use the group policy, at least not in the "sh run" and as far as I know, there should be. For example if we look at this group policy:
group-policy "HCL, ou=VPNUsers" internal
group-policy "HCL, ou=VPNUsers" attributes
vpn-filter value RA_VEN_HCL
vpn-tunnel-protocol ssl-client
webvpn
anyconnect profiles value HCLProfile type user

 
we can also find a tunnel that uses this policy:
tunnel-group HCLGroup type remote-access
tunnel-group HCLGroup general-attributes
authentication-server-group RADIUS_GROUP
accounting-server-group RADIUS_GROUP
default-group-policy "HCL, ou=VPNUsers"
tunnel-group HCLGroup webvpn-attributes
proxy-auth sdi

Thanks a lot !

[Rob Ingram]

@meidanmeshulam 

If the group-policy is not explictly called by a tunnel-group, it could be applied dynamically via the RADIUS server.

You'd use "Class = ou=<GROUP-POLICY-NAME>"

[meidanmeshulam]

Thank you for your answer, Is there a way to see that dynamic mapping on
the asa itself ?

[Rob Ingram · Accepted solution]

@meidanmeshulam 

Only by checking the users sessions using "show vpn-sessiondb detail anyconnect" which will show group-policy applied to the active users session. There is no other way of confirming the group-policy is in use on the ASA, that I know of.

You should check the configuration of the RADIUS server to confirm.