Cisco AnyConnect + Azure AD Conditional Access Policies

Question

When using Azure AD as the identity provider for Cisco AnyConnect VPN connections, do conditional access policies evaluate the source of the authentication (IP address/geography) as the ASA, or the IP address/geography of the user attempting to authenticate?

For example..
In a scenario where a user's public IP address is 1.1.1.1, and the ASA's public IP address is 2.2.2.2, if a conditional access policy is set to only permit connection attempts from 1.1.1.1, will the user be able to successfully connect, or would the IP address 2.2.2.2 need to be the one which is whitelisted (or both IP addresses)?

Answer 1

Hi @EH • Thank you for reaching out.

When you configure Azure AD as the identity provider for Cisco AnyConnect VPN connections, users who are attempting to connect will get redirected (http 302) to Azure AD Auth endpoint and a connection from user's device is directly established to Azure AD. Which means Azure AD will always receive users' IP address and not the address of Cisco AnyConnect. So, in this case, the conditions in CA policies will be evaluated on the basis of users' public IP addresses.

-----------------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.