Users cannot choose a profile when connecting to a VPN (AnyConnect)

[andrycorry]

Hello!

I can't find a solution to my problem.

I have a cisco asa configured, it has several profiles with SSO authorization and everything works fine.

The problem is that users are not able to change the profiles because after clicking "Connect" they are immediately authorized through the MS account, which does not allow them to change the profile. The problem exists in both Windows and MacOS.

Could you please tell me how to configure ASA so that users can select a profile before automatic authorization?

If you need more information, I will share it

[andrycorry]

n

[Aref Alsouqi]

If I understood correctly, you want the users to be able to select the tunnel group they want to connect to? if so, you need to enable group alias list under webvpn global config, and then you would need to create your aliases under each tunnel group similar to this:

webvpn
   tunnel-group-list enable

tunnel-group Group1 webvpn-attri
   group-alias Group1 enable
tunnel-group Group2 webvpn-attri
   group-alias Group2 enable
tunnel-group Group3 webvpn-attri
   group-alias Group3 enable

[andrycorry]

Thank you for your reply!

You may have misunderstood me, so I'll try to describe the configuration and the problem in more detail.

Cisco ASA is installed on local servers and I use Cisco ASDM to configure it.

I use the "Remote access VPN", on which I have several connection profiles configured with different group policies and addressing. SSO authorization via Microsoft Azure is configured on each profile.

When connecting to the VPN, a window appears with a microsoft login "2" and a window with a choice of a profile for connection "1", but due to the fact that authorization in Microsoft is automatic, I have no way to select a group in the window "1". Is it possible to configure so that users first select a group and then the Microsoft login window opens?

[Aref Alsouqi]

Could you please share your ASA VPN sanitized configs for review?

[andrycorry · Accepted solution]

Solved my problem in the way described in this documentation:
https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/98580-enable-group-dropdown.html

[Aref Alsouqi]

That was exactly what I referred to as the group alias enablement in my first post :-D. Glad to know the issue is fixed now.

[andrycorry]

Sorry, I don't have enough experience to understand everything so easily :-D.

Thank you for your support