4

We want to be able to disable a computer in Active Directory and prevent that computer from accessing our VPN.

I have an ASA VPN setup, with Cisco Security Desktop, and a Dynamic Access Policy to check the host. The AAA uses LDAP to talk to active directory. The primary authentication is for the user, with a secondary authentication setup for the computer with DAP.

My first guess is that I may have to switch to RADIUS? If we had an Enterprise Certificate Authority setup for the Domain with auto-enrollment, we could check the computer certificates, but we do not, nor can we.

Or is there a way to have the ASA 'proxy' do something similar to the Kerberos authentication that the computer would do with AD in order to validate access?

In other words, is there a Computer equivalent to the User AAA:

aaa-server AD-LDAP protocol ldap
aaa-server AD-LDAP (INSIDE) host AD-SERVER
ldap-base-dn OU=Users,OU=Dept,DC=company,DC=org
ldap-scope subtree
ldap-naming-attribute userPrincipalName
ldap-login-password *****
ldap-login-dn CN=vpn.service.account,OU=ServiceAccounts,OU=Users,OU=Dept,DC=company,DC=org

where you could change userPrincipalName to maybe the computer CN and base-dn to the Computers container?

Improve this question
4
  • You may want to ask this on ServerFault
    – Ron Trunk
    Oct 22, 2014 at 1:40
  • I figured it was most appropriate on NE, because, although it does tie into AD, all the configuration options are on the ASA. For instance, Cisco Secure Desktop and HostScan run on the client, but they are bin files that have to be loaded and configured on the ADA, and are pushed to the client over the VPN through AnyConnect, so this is still very much a Cisco networking specific issue.
    – glallen
    Oct 22, 2014 at 2:20
  • For curiosity's sake, why worry about the computer? If you are utilizing CSD and you are requiring a valid user to log into the VPN, what problem are you specifically solving for by disallowing the device itself in AD? I may have a way utilizing some of the attributes that you can set in CSD, however I'll need to lab it up for testing tonight.
    – Brett Lykins
    Oct 22, 2014 at 21:04
  • The user authenticates with a smartcard which maps to an AD account. BUT, potentially a user could use their card on any computer with AnyConnect installed. We want to prevent this, and only allow OUR computers access. Also, if a user's computer is subject to certain vulnerabilities, or has not been scanned in a certain ammount of time, we want to quarantine the box on our network, and block it from VPN access. It's looking like querying the AD computer account directly from the ASA via AnyConnect may not be feasible... And I'll have to do something like 802.1x and RADIUS. Basically, if the bo
    – glallen
    Oct 22, 2014 at 21:13

1 Answer 1

Reset to default
4

In general, if you are utilizing Cisco Secure Desktop, this opens up a whole world of options to give you restrictions based on the device.

Just as an example off of the top of my head, you could do the following. I haven't had the opportunity to test this configuration, however I have seen similar configurations in the field.

  1. Create a Group Policy in AD that creates a specific registry entry called VPN-ACCESS (for example) on every desktop that will be accessing the VPN.
  2. Create a security group and disable inheritance of the first Group Policy. In it's place, configure a Group Policy that deletes the VPN-ACCESS registry entry if it exists.
  3. Place all PCs are not allowed to have VPN access into this security group. This step would require some scripting elbow grease to ensure that your "blocked" PC's got put into the security group based on whatever criteria you chose.
  4. In Cisco Secure Desktop, have it evaluate if that registry entry exists, if it doesn't exist then block access.

This would take care of only allowing "known" PCs into the VPN, as well as allowing you to explicitly blacklist PCs.

I'm sure there are other ways to do this as well, and this may not even be the best way by far.

The main thrust is, once you've paid for the Anyconnect Premium licenses and have deployed Cisco Secure Desktop, you're only restrained by your ingenuity with regards to what kind of "better mouse trap" you build.

See the CSD Admin Guide for more information on all of it's bells and whistles.

Improve this answer
1
  • Was hoping for something that didn't require touching the client and only queried AD, but this will work. Thanks.
    – glallen
    Nov 2, 2014 at 1:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.