Filter
Top Products
36-7
Cisco ASDM User Guide
OL-16647-01
Chapter 36 Configuring Dynamic Access Policies
Understanding VPN Access Policies
Fields
• Selection Criteria—Determine the AAA and endpoint attributes to test for dynamic access policy
retrieval.
• AAA Attributes
–
AAA Attribute—Identifies the AAA attribute.
–
Operation Value—Identifies the attribute as =/!= to the given value.
–
Add/Edit—Click to add or edit a AAA attribute.
• Endpoint Attributes—Identifies the endpoint attribute.
–
Endpoint ID—Provides the endpoint attribute ID.
–
Name/Operation/Value—
–
Add/Edit/Delete—Click to add, edit or delete and endpoint attribute.
• Test Result—Displays the result of the test.
• Test—Click to test the retrieval of the policies you have set.
• Close—Click to close the pane.
Modes
The following table shows the modes in which this feature is available:
Add/Edit Dynamic Access Policies
To add or edit a dynamic access policy, perform the following steps:
Step 1 At the top of the Add/Edit Dynamic Access Policy pane, provide a name (required) and a description
(optional) of this dynamic access policy.
Step 2 In the Priority field, set a priority for the dynamic access policy. The security appliance applies access
policies in the order you set here, highest number having the highest priority. In the case of DAP records
with the same priority setting and conflicting ACL rules, the most restrictive rule applies.
Step 3 In the Add/Edit AAA Attributes field, use the ANY/ALL/NONE drop-down box (unlabeled) to choose
whether a user must have any, all, or none of the AAA attribute values you configure to use this dynamic
access policy.
Step 4 To Set AAA attributes, click Add/Edit in the AAA Attributes field.
Step 5 Before you set endpoint attributes, configure CSD Host Scan.
Step 6 To set endpoint security attributes, click Add/Edit in the Endpoint ID field.
Step 7 You can create multiple instances of each type of endpoint attribute. For each of these types, you need
to decide whether the DAP policy should require that the user have all instances of a type (Match all =
AND) or only one of them (Match Any = OR). To set this value for each of the end point attributes, click
the Logical Op. button.
Firewall Mode Security Context
Routed Transparent Single
Multiple
Context System
• • •——