2

Is it possible to configure a Group Policy to be used based on the source IP of the AnyConnect user?

I want users connecting from a specific location (IP address) to get a specific Group policy. When those same users travel to another network, they would get a different Group Policy.

  • ASA is 9.12
  • AnyConnect is 4.8
  • Can't check right now but wouldn't this be possible with a DAP policy? – hertitu Nov 2 '19 at 23:29
  • @hertitu I don't see that as a criteria to filter against in DAP (unless I just missed it). – Jesse P. Nov 3 '19 at 0:50
  • @JesseP. It's been a (very) long time since I worked with DAP but IIRC ip address is one of the attributes provided by HostScan (VPN Posture). – hertitu Nov 3 '19 at 13:48
  • @hertitu HostScan is also a paid feature of AnyConnect that requires additional licensing and such. – Jesse P. Nov 3 '19 at 13:49
  • @8None1 If I've answered your question to your satisfaction, please mark my answer as the accepted solution. – Jesse P. Nov 5 '19 at 2:14
3

I've never seen a way to do that natively (in the ASAs themselves) but, if your AnyConnect setup uses RADIUS for authenticating users, you could assign group policies based on a condition statement that looks for CallingStationID (the IP address they're coming from) and matches the users that way.

| improve this answer | |
  • Yeah, I couldn't remember a way to do it without an AAA back end either (all my deployments for years have used AAA), which is why I didn't throw in an answer. Can do this and a whole lot more with an AAA back end. – YLearn Nov 2 '19 at 4:26
  • @YLearn Yeah. Same. I only use local auth when I'm first building things out. – Jesse P. Nov 2 '19 at 11:02
  • @JesseP. We don't use RADIUS, but it's an interesting reason to possibly try it. Would the CallingStationID be the public source or would it be what the calling host thinks it's IP is (meaning internal LAN it's on)? – 8None1 Nov 6 '19 at 4:12
  • @8None1 What do you use for user authentication? It would be whatever the IP address is that the request to connect comes from. If the user is connecting from the public Internet, it would be their public IP address. – Jesse P. Nov 6 '19 at 4:19
  • @8None1 Are you still in need of help with this, or are you giving the RADIUS option a shot? – Jesse P. Nov 8 '19 at 16:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.