Cisco Duo LDAPS migration to SAML with DAPS

[LindseyJGreen]

We currently use Cisco Duo with LDAPS for our SSL VPN Clients. On the firewall (ASA5508) we have Dynamic Access Policies in place, allowing certain Active Directory groups access to certain subnets.

When testing moving to SAML (Hybrid AzureAD with on prem domain controllers) for MFA, this no longer uses DAP.

How can we secure our different networks on a per user basis instead?

Thanks

[Salman Mahajan]

Hi @LindseyJGreen If my understanding is correct , what you are saying here is when deploying SAML as an authentication for SSL VPN it does not use DAP ( Dynamic Access Policy ) . It is not true as DAP applies to all remote access and clientless sessions and cannot be disabled – it is always running from the moment the ASA is powered on .