How to give different Anyconnect profiles for some users

[Terry Whitford]

Hi,

I'm very new to Anyconnect but have managed to configure our ASA5510 with 2 connection files, one with split tunnelling enabled and one without.  How do I configure the ASA/Anyconnect client so that most of the users only see the connection profile with split tunnelling disable but some other get to see both connection profiles in the client ?  Currently all users get to see both profiles in the client and I'm stuck at the moment trying to work out how I controll what connection profiles they get to see..  The users are authenticated against a Microsoft IAS server if that matters and the ASA is running V8.2(1) and ASDM 6.2(5)53.  Thanks for any help.

Regards,

Terry

[Jennifer Halim · Accepted solution]

Microsoft IAS is a good piece of information. Thanks.

So I assume that you are using Radius for authentication.

You have 2 options:

1) Configure the IAS radius server to map user to a particular group-policy using radius attribute.

Here is a sample configuration using Cisco ACS radius server for your reference:

http://www.cisco.com/en/US/products/sw/secursw/ps2086/products_configuration_example09186a00808cf897.shtml

(sorry, couldn't find a sample configuration using Microsoft IAS server, but the concept is the same)

2) Since you are running microsoft IAS, I assume that you are using Active Directory? Assuming that is true, you can actually authenticate using LDAP and perform LDAP mapping to place user into specific group-policy.

Here is the sample configuration for LDAP authentication:

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00808c3c45.shtml

and here is the sample configuration for LDAP attribute mapping:

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a008089149d.shtml

Hope either option helps.

[Terry Whitford]

Hi Jeniffer,

This information was very helpful.  I followed the instructions in your option (2) and set up LDAP for authentication, created the attribute mapping and now have it working the way I wanted.  Thanks

Regards,

Terry

[Jennifer Halim]

Great to hear it's working now. Please kindly mark the post as answered. Thanks.