You are here
SEC0128 - SSL VPN AnyConnect Hostscan and Endpoint Assessment (Part 2)
Difficulty Level:
Lab Document:
<Please login to see the content>
Category:
Security
The video takes you through the Cisco ASA AnyConnect VPN abilities to gather VPN client information using Hostscan and basic Endpoint Assessment features. We will be deploying a Hostscan agent as part of an AnyConnect Posture module, and creating a pre-login policy from device registry and OS checks to categorize the endpoint and allow or deny VPN access accordingly. The video finishes with enabling Host Scan extension as a preparation to the next lab video.
Part 2 of this video goes over pre-login policy testing and enabling host scan extension
Topic:
- Host Scan and AnyConnect Posture Module
-
VPN Pre-Login Policy
- Certificate Check
- Registry Check
- OS Check
- Host Scan Extension
About Author
Metha Chiewanichakorn, CCIE#23585 (Ent. Infra, Sec, SP), is a Cisco networking enthusiast with years of experience in the industry. He is currently working as a consulting engineer for a Cisco partner. As a founder of and an instructor at labminutes.com, Metha enjoys learning and challenges himself with new technologies.
2 comments
AnyConnect endpoint detection
Hello,
Thank you for the videos, they are very helpful. I am trying to find a way to detect/gather information about end users computers' name, public IP, SSL VPN duration. Basically pretty much everything in sh vpn-sessiondb details anyconnect , plus computer name, whether a domain or personal computer (without restrict anything at the beginning) So I can start to build new access-list and policies.
We currently use ASA5540 with failover mode. We authenticate our end users with SecureAuth certificate. The main goal is to restrict non-domain computers but we want to identify them first. We have a Syslog server, I am trying to pull this information to the Solarwinds Orion server via SNMP traps.
Do you know if there is a way to do that?
Thank you
Regards
-Erdo
AnyConnect endpoint detection
DAP should give you a lot of information. For the domain computer check, we don't believe there is a wuick way to do that but to do some kind of certificate or registry value check.