Filter
Top Products
CHAPTER
36-1
Cisco ASDM User Guide
OL-16647-01
36
Configuring Dynamic Access Policies
This chapater describes how to configure dynamic access policies. It includes the following sections.
• Understanding VPN Access Policies
• Add/Edit Dynamic Access Policies
• Add/Edit AAA Attributes
• Retrieve AD Groups from selected AD Server Group
• Add/Edit Endpoint Attributes
• Operator for Endpoint Category
• DAP Examples
Understanding VPN Access Policies
VPN gateways operate in dynamic environments. Multiple variables can affect each VPN connection,
for example, intranet configurations that frequently change, the various roles each user may inhabit
within an organization, and logins from remote access sites with different configurations and levels of
security. The task of authorizing users is much more complicated in a VPN environment than it is in a
network with a static configuration.
Dynamic access policies (DAP) on the security appliance let you configure authorization that addresses
these many variables. You create a dynamic access policy by setting a collection of access control
attributes that you associate with a specific user tunnel or session. These attributes address issues of
multiple group membership and endpoint security. That is, the security appliance grants access to a
particular user for a particular session based on the policies you define. It generates a DAP at the time
the user connects by selecting and/or aggregating attributes from one or more DAP records. It selects
these DAP records based on the endpoint security information of the remote device and the AAA
authorization information for the authenticated user. It then applies the DAP record to the user tunnel or
session.
The DAP system includes the following components that require your attention:
• DAP Selection Configuration File—A text file containing criteria that the security appliance uses
for selecting and applying DAP records during session establishment. Stored on the security
appliance. You can use ASDM to modify it and upload it to the security appliance in XML data
format. DAP selection configuration files include all of the attributes that you configure. These can
include AAA attributes, endpoint attributes, and access policies as configured in network and
web-type ACL filter, port forwarding and URL lists,