Hi everyone
Just saw a very strange issue with Anyconnect on 9.0.3 with radius authentication with Class 25 Attribute. I have webvpn|Anyconnect configured on 5510 running 9.0.3, the authentication is done using a FreeRadius server with class 25 attributes being passed on for group assignment.
The user is able to authenticate & group-policy is being assigned as per the Class attribute but for some reason only members of one Group have access to the resources ones connected using anyconnect rest of the users are authenticated, group-policy assigned but have no access at all and whats strange is that all users have access according to group-policy for webvpn.
I have not cleared the tunnel-group or rebooted the device since it's been moved to Freeradius with Class Attributes from the static group assignment. Here's the configuration :
webvpn
enable outside
enable backup
enable inside
anyconnect image disk0:/anyconnect-win-3.1.05170-k9.pkg 1
anyconnect image disk0:/anyconnect-macosx-i386-3.1.05170-k9.pkg 2
anyconnect image disk0:/anyconnect-linux-64-3.1.05170-k9.pkg 3
anyconnect enable
tunnel-group-list enable
!
group-policy SSL_1 internal
group-policy SSL_1 attributes
dns-server value 10.100.100.100
vpn-filter value SSL_1-FILTER
vpn-tunnel-protocol ssl-client ssl-clientless
split-tunnel-policy tunnelall
address-pools value SSL_1
webvpn
anyconnect keep-installer installed
group-policy SSL_2 internal
group-policy SSL_2 attributes
dns-server value 10.100.100.100
vpn-filter value SSL_2-FILTER
vpn-tunnel-protocol ssl-client ssl-clientless
split-tunnel-policy tunnelall
address-pools value SSL_2
webvpn
anyconnect keep-installer installed
!
tunnel-group VPN-SSL type remote-access
tunnel-group VPN-SSL general-attributes
authentication-server-group 2FA_GRP_LDAP LOCAL
authorization-server-group 2FA_GRP_LDAP
default-group-policy SSL_2
tunnel-group VPN-SSL webvpn-attributes
radius-reject-message
group-alias VPN-SSL enable
Please let me know if you have seen this before.
Thanks
Manish
