This document describes the Cisco AnyConnect Identity Extensions (ACIDex) feature and its introduction for non-mobile platforms.
There are no specific requirements for this document.
The information in this document is based on these software and hardware versions:
- Cisco Adaptive Security Appliance (ASA) 5500-X Series Next Generation Firewall Version 9.2(1)
- Cisco Adaptive Security Device Manager (ASDM) Version 7.3(1)
- Cisco AnyConnect Secure Mobility Client Version 3.1.05152
The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, make sure that you understand the potential impact of any command.
The ACIDex, also known as the AnyConnect Endpoint Attributes or Mobile Posture, is the method that is used by the Cisco AnyConnect VPN client in order to communicate posture information to the ASA. The Dynamic Access Polices use these endpoint attributes in order to authorize users.
This table describes the ACIDex attributes, where AnyConnect is the attribute type (does not require Cisco Secure Desktop or Host Scan) and the endpoint is the attribute source:
|Attribute Name||Value||Maximum String Length||Description|
|endpoint.anyconnect.clientversion||version||–||AnyConnect client version|
|endpoint.anyconnect.platform||string||–||Operating System (OS) on which AnyConnect client is installed|
|endpoint.anyconnect.platformversion||version||64||Version of OS on which AnyConnect client is installed|
|endpoint.anyconnect.devicetype||string||64||Mobile device type on which AnyConnect client is installed|
|endpoint.anyconnect.deviceuniqueid|| ||64||Unique ID of mobile device on which AnyConnect client is installed|
|endpoint.anyconnect.macaddress||string||Must be in the format xx-xx-xx-xx-xx -xx, where x is a valid hexadecimal character||Media Access Control (MAC) address of device on which AnyConnect client is installed|
ACIDex Feature for Non-Mobile Platforms
The Cisco AnyConnect VPN client now provides platform identification for the desktop OSs (such as Microsoft Windows, Macintosh OS X, and Linux) and a pool of MAC addresses that can be used by the Dynamic Access Policies (DAPs):
The MAC address list is included with this feature, as well as the <device-id> element, which uses these three attributes: