2

Is it possible to configure a Group Policy to be used based on the source IP of the AnyConnect user?

I want users connecting from a specific location (IP address) to get a specific Group policy. When those same users travel to another network, they would get a different Group Policy.

  • ASA is 9.12
  • AnyConnect is 4.8
Improve this question
7
  • Can't check right now but wouldn't this be possible with a DAP policy?
    – hertitu
    Nov 2, 2019 at 23:29
  • @hertitu I don't see that as a criteria to filter against in DAP (unless I just missed it).
    – Jesse P.
    Nov 3, 2019 at 0:50
  • @JesseP. It's been a (very) long time since I worked with DAP but IIRC ip address is one of the attributes provided by HostScan (VPN Posture).
    – hertitu
    Nov 3, 2019 at 13:48
  • @hertitu HostScan is also a paid feature of AnyConnect that requires additional licensing and such.
    – Jesse P.
    Nov 3, 2019 at 13:49
  • @8None1 If I've answered your question to your satisfaction, please mark my answer as the accepted solution.
    – Jesse P.
    Nov 5, 2019 at 2:14

1 Answer 1

Reset to default
3

I've never seen a way to do that natively (in the ASAs themselves) but, if your AnyConnect setup uses RADIUS for authenticating users, you could assign group policies based on a condition statement that looks for CallingStationID (the IP address they're coming from) and matches the users that way.

Improve this answer
5
  • Yeah, I couldn't remember a way to do it without an AAA back end either (all my deployments for years have used AAA), which is why I didn't throw in an answer. Can do this and a whole lot more with an AAA back end.
    – YLearn
    Nov 2, 2019 at 4:26
  • @YLearn Yeah. Same. I only use local auth when I'm first building things out.
    – Jesse P.
    Nov 2, 2019 at 11:02
  • @JesseP. We don't use RADIUS, but it's an interesting reason to possibly try it. Would the CallingStationID be the public source or would it be what the calling host thinks it's IP is (meaning internal LAN it's on)?
    – 8None1
    Nov 6, 2019 at 4:12
  • @8None1 What do you use for user authentication? It would be whatever the IP address is that the request to connect comes from. If the user is connecting from the public Internet, it would be their public IP address.
    – Jesse P.
    Nov 6, 2019 at 4:19
  • @8None1 Are you still in need of help with this, or are you giving the RADIUS option a shot?
    – Jesse P.
    Nov 8, 2019 at 16:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.