ISE Lab: ASA AnyConnect 1 – VPN, RADIUS and Policy Sets

This lab is demonstrating the use of Cisco AnyConnect and ISE. AnyConnect can be used in conjunction with ISE in a similar way it can on a wired LAN.
Based off a username, ISE can determine which group-policy to apply to an AnyConnect user, and apply a downloadable ACL (dACL) to that user. In addition to this, ISE can also run a posture scan on the user’s machine to determine if it is running correct software or is actually a corporate machine or not.

The lab will have three types of users; standard corporate user, Admin corporate user and a third party user. Each user will receive their own VPN IP pool and ACL.

• ASA RADIUS Config
• Add ASA to ISE
• ASA VPN Config
• ISE Policy Sets
• Testing

ASA RADIUS Config

Add ASA to ISE

The ASA is configured to send RADIUS to ISE, however, ISE needs to be aware that it will receive RADIUS messages from the ASA. Each device must be configured in ISE with the same RADIUS key as input to the device config.

Once the ASA has been added, a test may be performed from the ASA to confirm. The test can also be seen in the ISE RADIUS live logs.

ASA VPN Config

There are three user types, each with their own VPN config. Only the default tunnel-group is shared. If the user does not match on any of the user types (standard corp user, admin corp user or third party user) then they will be given a no access group-policy. This will disconnect them from the VPN as no user sessions are permitted.

ISE Policy Sets

To create an ISE policy set for the VPN users, the first step is to create the authorisation policy for each VPN user type.

Inside each of the authorisation profiles, the group-policy is referenced. In the ASA there are three group policies, the names in ISE must match in order for the user to be given the correct group policy.

Now the individual authentication profiles have been created, the overall policy set can be created. The policy set is going to tie together the authorisation profiles and the authenticating device (ASA).

Testing

Employee1 – Standard Corp User

The employee1 user will be given the VPN_USER_GRP

Employee2.admin – Admin Corp User

The employee2.admin user will be given NETWORK_ADMIN

Vendor1 – 3rd Party User

The vendor1 user will be given VPN_3rd_PARTY_GRP