Hello,
the Password handover to Radius Server is different between Client (AnyConnect) and Clientless (WebVPN) VPN from the same ASA. The ASA sends the Username and Password with Radius to an ISE.
AnyConnect Client Session
AVP Type 1 = User-Name
AVP Type 2 = User-Password
ClientlessVPN Session
AVP Type 1 =User-Name
AVP Type 2 = "Is Missing"
Instead the AVP 26 Vendor-Specific 311 MS-Chap is present
With MS-Chap behind the ISE the General Authentication Platform can't do anything.
Can the ASA perhaps already fill in the password from Radius AVP Type 2 field or perhaps the ISE? The ISE in this case is Radius Proxy. Behind the is the Symantec VIP Gateway for Two Factor Authentication. The ISE is connected by Radius Protocol.
With Client VPN it works fine and don't works for ClientlessVPN (because the Password is missing).
Does someone have an idea how to customize the ASA or ISE accordingly?
ASA Version 9.6
ISE Version 1.3
Thanks
Sven
