This document describes the Cisco AnyConnect Identity Extensions (ACIDex) feature and its introduction for non-mobile platforms.
There are no specific requirements for this document.
The information in this document is based on these software and hardware versions:
Cisco Adaptive Security Appliance (ASA) 5500-X Series Next Generation Firewall Version 9.2(1)
Cisco Adaptive Security Device Manager (ASDM) Version 7.3(1)
Cisco AnyConnect Secure Mobility Client Version 3.1.05152
The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, make sure that you understand the potential impact of any command.
The ACIDex, also known as the AnyConnect Endpoint Attributes or Mobile Posture, is the method that is used by the Cisco AnyConnect VPN client in order to communicate posture information to the ASA. The Dynamic Access Polices use these endpoint attributes in order to authorize users.
This table describes the ACIDex attributes, where Cisco AnyConnect is the attribute type (does not require Cisco Secure Desktop or Host Scan) and the endpoint is the attribute source:
Maximum String Length
AnyConnect client version
Operating System (OS) on which AnyConnect client is installed
Version of OS on which AnyConnect client is installed
Mobile device type on which AnyConnect client is installed
Unique ID of mobile device on which AnyConnect client is installed
Must be in the format xx-xx-xx-xx-xx -xx, where x is a valid hexadecimal character
Media Access Control (MAC) address of device on which AnyConnect client is installed
ACIDex Feature for Non-Mobile Platforms
The Cisco AnyConnect VPN client now provides platform identification for the desktop OSs (such as Microsoft Windows, Macintosh OS X, and Linux) and a pool of MAC addresses that can be used by the Dynamic Access Policies (DAPs):
Note: The ASA must run Version 9.0 or later in order for this feature to work correctly, and the 3.x pkg or later must be loaded on the ASA for the non-mobile platform clients that run Version 3.1.05152 or later in order to report the ACIDex attributes.
The MAC address list is included with this feature, as well as the <device-id> element, which uses these three attributes:
Note: Aggregate Authentication Version 2 now supports the new elements for the <device-is> tag.