Cisco ASA 5505 Configuration Manual page 1434

Understanding VPN Access Policies
Add/Edit Dynamic Access Policies
Figure 65-3 Add/Edit Dynamic Access Policies Pane
To add or edit a dynamic access policy, perform the following steps:
At the top of the Add/Edit Dynamic Access Policy pane, provide a name (required) and a description
Step 1
(optional) of this dynamic access policy.
In the Priority field, set a priority for the dynamic access policy. The adaptive security appliance applies
Step 2
access policies in the order you set here, highest number having the highest priority. In the case of DAP
records with the same priority setting and conflicting ACL rules, the most restrictive rule applies.
Step 3 In the Add/Edit AAA Attributes field, use the ANY/ALL/NONE drop-down list (unlabeled) to choose
whether a user must have any, all, or none of the AAA attribute values you configure to use this dynamic
access policy.
To Set AAA attributes, click Add/Edit in the AAA Attributes field.
Step 4
Step 5 Before you set endpoint attributes, configure CSD Host Scan.
Step 6 To set endpoint security attributes, click Add/Edit in the Endpoint ID field.
Step 7 You can create multiple instances of each type of endpoint attribute. For each of these types, you need
to decide whether the DAP policy should require that the user have all instances of a type (Match all =
AND) or only one of them (Match Any = OR). To set this value for each of the end point attributes, click
the Logical Op. button.
Cisco ASA 5500 Series Configuration Guide using ASDM
65-10
Chapter 65 Configuring Dynamic Access Policies
OL-20339-01