I need help in knowing If through "CISCO ANY CONNECT" client MAC address information would be send in syslog payload. We are building a security monitoring use-case with a client, where we plan to whitelist MAC's and detect unauthorized access from Machines using MAC address from CISCO VPN logs generated by use of CISCO ANY connect. Could this be done?
Also, I have seen using cisco 5500 configured with DAP access protection can be enforced based upon device posture generation which is based upon MAC address given in link
http://www.cisco.com/c/en/us/td/docs/security/vpn_client/anyconnect/anyconnect30/administration/guide/anyconnectadmin30/acmobiledevices.html
I'm hoping this MAC address information would be present in the payload as well.
