Hi all,
I'm trying to configure an AnyConnect VPN profile on ASA to allow access only to corporate-owned devices. The condition is that the device must be joined to the domain — otherwise, it should be denied VPN access.
I created a Dynamic Access Policy (DAP) with a HostScan check for domain membership. However, I'm unsure how to bind this DAP to a specific tunnel group (for example, VPN-CORP-SECURE). I don’t want to affect other existing profiles or tunnel groups.
Could someone please guide me on:
How to properly associate the DAP with the desired tunnel group?
Whether this is done via general-attributes or webvpn-attributes?
Any recommended best practices to avoid impacting other users or profiles?
Thanks in advance!
