Limiting the VPN Connection

[deepuvarghese1]

Is there any feature in Cisco Anyconnect or other software to allow Domain users to connect only to their

corporate VPN. We don't want domain users to connect any other VPN rather than corporate VPN.

VPN users are authenticating with ISE. Is there any workaround for this.

[rvarelac]

Hi deepuvarghese1

I think you can use the Always-ON and Auto connect on start feature of the XML profile to accomplish this. 

 Make sure to uncheck the "user controllable"  and "allow vpn disconnect" to avoid the end user to start another VPN session. 

See more information about those features:

https://supportforums.cisco.com/document/12549161/anyconnect-xml-preferences

Hope it helps

- Randy -

[Fabian Ortega]

Hello,

I would suggest using a DAP policy and check for a certificate or a register key on corporate machines. This action requires host-scan. You can learn more about DAP policies following this link:

http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/108000-dap-deploy-guide.html

Also an LDAP mapping would be a good option to prevent users to connect to a tunnel-group they are not supposed to connect on.

http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/98625-asa-ldap-authentication.html

Please check those links out and if you have any questions please let me know.

Regards,