Running AnyConnect on ASA 5525. This is a DR/Test firewall with a maximum of 5-Users on it at any one time. Testing a profile using ISE for authorization. If I connect using AnyConnect without a DACL in ISE, the connection authenticates fine.
When I apply a DACL to the policy in ISE, the connection fails. ISE Radius logs show the authentication passes and the DACL is sent to the ASA successfully. The firewall logs show an error when the DACL is passed to it from ISE and does not allow the session.
%ASA-6-716051: Group group-name User user-name IP IP_address Error
adding dynamic ACL for user.
There is not enough memory to perform the action.
Memory appears to be fine on the firewall, despite the error.
TEST-VPN# show memory
Free memory: 3291834675 bytes (75%)
Used memory: 1116307600 bytes (25%)
------------- ------------------
Total memory: 4408142275 bytes (100%)
This is the only DACL being used. It consists of 3-lines. It appears a 5525 not under load should be able to handle this without issue. The ASA OS has been upgraded and the same error appears. Any suggestions???
