Mobile AV support for ASA Dynamic Access Policies

[tpattgeek]

We just upgraded to ASA 8.4.4.1 and the latest CSD image, 3.6.6203.  We currently have a DAP set up to scan one group policy for a secific AV but wanted to start implementing this for all group policies and including several different flavors of AV (so anyone could connect from anywhere as long as a pre-approved AV is installed).  We are going to allow about 20 different versions of different AV's and I've tested a couple already and they're successful.

My issue right now is trying to allow (or deny) AV that is installed on an Android tablet (and potentially Apple devices).  The tablet has avast Mobile Security installed, and even if I select Vendor: Alwil as a whole, it still does not recognize it and denies the user.  I have tested on a PC and it works fine.  Is there something that I am missing or are mobile AV programs not included in the DAP policies?  Is this going to be considered for future versions of CSD or ASA or are we going to continue to consider Android and Apple devices "secure" and not in need of an AV?  Thanks.

[Javier Portuguez · Accepted solution]

Hi,

At this point CSD is not supported on Android / iOS devices.

CSD + HostScan can be used to allow administrators to identify Apple iOS devices but is limited to the reporting of the operating system.

You may submit a enhacement request to your Account team.

Portu.

Please rate any post you find helpful.

[tpattgeek]

It does recognize the Android AnyConnect software being installed and allows or denies based on policy.  Isn't that part of CSD?  Or is that part of hostscan and CSD only comes into affect for AV?

EDIT: Sorry, I just saw the part about hostscan identifying the OS.  Thanks for the help!

[Javier Portuguez]

You are very welcome