Configuring DAP
When a user tries to establish a connection, DAP can analyze the posture assessment result of a remote host and apply access policies that are dynamically generated. DAP can use the AAA attributes, such as RADIUS, LDAP, and Cisco-specific, and endpoint attributes, such as host scans and prelogin locations, before an action or a series of actions can be applied to a user session. It is designed to complement the authentication, authorization, and accounting (AAA) services by aggregating the locally defined attributes with the received attributes from the AAA server. In the case of an authorization attribute conflict, the locally defined attribute is selected. Therefore, it is possible to generate DAP authorization attributes by aggregating multiple DAP records from the AAA server and the posture assessment information for a user session. This way, the security appliance can use the prelogin sequence, the user login credentials, and the computer scan results before a DAP can be applied to a session.
A user connection might match multiple DAP records. For example, you can have a DAP record that only scans the remote workstations for a registry key. You can have another DAP record that checks the remote computer for an active process. If a remote workstation has the registry key and the process is active as well, that workstation will match against both DAP records. In this case, the security appliance combines both records dynamically and applies an aggregated access policy to a user connection.
The security appliance has a default DAP record called DfltAccessPolicy. This DAP record cannot be deleted and can contain only access policy attributes. It does not allow you to define any AAA or endpoint selection attributes. It is applied to all sessions that do not match any configured DAP records. By default, the DfltAccessPolicy does not restrict a session and allows traffic to pass through without imposing any access policies.
NOTE The default behavior of DfltAccessPolicy is identical to the pre-DAP-supported security appliance versions, where no policy enforcement existed on user sessions.
You can configure DAP by choosing either of the following commands:
• Configuration > Remote Access VPN > Network (Client) Access > Dynamic Access Policies
• Configuration > Remote Access VPN > Clientless SSL VPN Access > Dynamic Access Policies
Create a new DAP record by clicking Add. ASDM opens a new window, where you can specify a name for this policy. The security appliance also allows you to specify a priority for this record. The priority is used to logically order the DAP records in case a user session matches multiple DAP records. The higher the number of a DAP record, the higher the priority.
For each DAP record, you specify selection criteria and configure appropriate action. For ease of understanding, DAP configuration is divided into the following three subconfiguration sections:
• Selecting a AAA attribute
• Selecting endpoint attributes
• Defining access policies
Continue reading here: Step 1 Set Up CSD
Was this article helpful?