Hi Paul,
By default, the ASA does not map the certificate Common Name (CN) or Subject Alternative Name (SAN) from the client certificate directly to the username field in ASDM monitoring. However, you can configure the ASA to use the certificate’s CN or SAN as the username for identification. Here's how you can achieve this:
Steps to Configure Username Mapping from Certificate:
1- Enable Certificate to Username Mapping:
You can map the certificate field (like CN or SAN) to the username using the crypto ca trustpoint and username-from-certificate commands.
crypto ca trustpoint MyTrustpoint
enrollment terminal
subject-name CN=<Common Name>,OU=<Organizational Unit>
...
tunnel-group AnyConnect-Tunnel webvpn-attributes
authentication certificate
username-from-certificate CN
This example uses the CN from the certificate as the username. If the certificate uses SAN, you can adjust accordingly, for example:
username-from-certificate SAN-DNS
2- Verify the Certificate Mapping:
After configuring the ASA, verify the certificate-to-username mapping. To ensure it's working, you can either reconnect the client or issue the following command on the ASA to view the connection details:
show vpn-sessiondb detail anyconnect
This command will display detailed session information, including the username derived from the certificate.
3- Configure ASDM Monitoring Settings:
Once the username is derived from the certificate, ASDM should display the proper username under the monitoring section. You may need to refresh the session view or wait for the next session update to see the change reflected.
By configuring this certificate-to-username mapping, ASDM will now display the certificate’s CN or SAN in place of the "unknown" username.
