RA VPN Profiles and Policies Flow (Pre and Post Login)

1.DAP rules (Dynamic Access Policy)(NAC)(e.g. if firewall present on client machine etc.)
2.User Profile rules (User Account)(e.g. Two simultanous logins)
3.User Profile Group rules (Group Policy attached to the User profile)(e.g. WebTypeACL)
4.Connection Profile Group rules (selected at pre-login based on URL, Alias or Cert)(e.g. no http from portal)
Custom connection profile
5.DfltGrpPolicy Group rules (e.g. connection time 33 mins)

Connection Profile (aka Tunnel Group) controls the “Pre-logoin Policy”

After login, ASA knows who the user is and post-login policies(permissions,authorizations,restrictions,etc) come. Top always win if there is conflict.

Example flow.


Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: