ASA vs ISE

Similar Questions

• VPN to ASA with ISE and Posture

  Hello

  I'll put up a new facility of ISE. I want to install AnyConnect 4.1 and use ISE for authentication & posture validation. I'm ok with the side of the authentication of things.

  http://www.Cisco.com/c/en/us/support/docs/security/Adaptive-Security-app...

  This configuration applies to time AnyConnect 3.1 & 4.x?

  Any help would be appreciated.

  Thank you

  Hi Stuart,

  Yes - this configuration applies as well to the AC3 and AC4.

  The new feature of AC4 is available directly from ISE ability:

  http://www.Cisco.com/c/en/us/support/docs/security/AnyConnect-secure-mob...

  But the posture itself works in a similar way.

  Thank you

  Michal

• ASA college level of RADIUS (Cisco ISE)

  Dear,

  I have treid to authenticate access management ASA of ISE and it works fine, when I tried to push private level 15 to him even in private 1.

  I am using my version, Cisco-AV-pair attribute ASA 9.0

  Thank you

  Even if you press on cisco-av-pair attribute as shell: priv-lvl = 15 ASA, it won't allow you to land directly on the privileged exec mode. You supply enable password until you get # mode.

  https://supportforums.Cisco.com/thread/2201512

  Let me know if you have any other requirement.

  ~ BR
  Jatin kone

  * Does the rate of useful messages *.

• ASA VPN with ISE and different backends WBS for authentication

  Hello

  I have an AAA-problem I hope to have a few problems help.

  The problem ultimately is: how the ASA via ISE send Radius Access requests to different given OTP backends provided a connection to a certain group of Tunnel.

  BACKGROUND:

  I'll try to give you a brief picture of the scenario, this is what I currently have.

  A VPN system (ASA 8.4 (4)) where I let my users to choose among 3 different methods of authentication being

  (1) certificate (on chip card)

  (2) token - token of the OTP (One Time Password provided via the smartphone application: using pledge of Nordic OTP-Edge transport server)

  (3) SMS - OTP token (Nordic OTP - Edge transport server SMS OTP)

  The choice corresponds to different groups of profiles/Tunnel connection.

  Today, all authentication requests go directly to the OTP server and authorization goes directly to the AD via LDAP.

  THE PROBLEM:

  The problem occurs when I try to put in the ISE in the mixture.

  What I obviously (?) would like to do is have all the network authentication/authorization to go through my ISE platform to take advantage of a centralized administration, monitoring etc.

  Again I would need to use data bases different backend such as AD and Nordic OTP - Edge server, but then mandated by ISE.

  For me to be able to know what back-end AAA to the proxy system, to somehow be able to distinguish the incoming Radius Access-requests.

  WHAT WE CALL:

  At the time of the ASA 8.4.3 Radius access request contains 2 new attributes, the name of Group of Tunnel and the Type of customer, when a VPN user connects.

  http://www.Cisco.com/en/us/docs/security/ASA/asa84/configuration/guide/ref_extserver.html#wp1802187

  QUESTION:

  The seams, that I can achieve what I want by looking at the access request attribute Radius "Tunnel Group Name" and forward my request to different backends OTP for the authentication part therefore in theory. But, how do I actually go ahead and set that up in ISE?

  I don't see this attribute when I look at the details of Radius Authentication for an authentication AAA of the ASA at the ISE.

  Best regards

  / Mattias

  I think you can hit the following problem:

  CSCtz49846: ISE does not match the condition with VPN 146 Tunnel-Group-Name attribute

  This issue is not specific to this attribute, as shown in the solution shown in the accompanying note

  Workaround

  Ensure that the attribute name does not include a '.' character. This also applies to some of the existing attributes in the dictionary of Cisco-VPN300. Attribute names should be changed so that they do not include a "." character.

• Cisco ISE posture assessment and client provisioning

  Hello

  I have the Cisco ISE and Cisco IOS device. I configured the RADIUS between these devices.

  Also, I configured RADIUSbetween ISE of Cisco and Cisco ASA. Now I want to know that how to posture assessment for these devices (ISE of Cisco and Cisco ASA or ISE Cisco Cisco IOS). Please give me the steps together for assesment for cisco ios device posture in Cisco ise.

  In addition, please give me related to posture assessment and the provisioning client logs.

  Thanks in advance.

  You can go through the list link below to download a PDF link

  Assessment of the posture with ISE.

  http://www.Cisco.com/Web/CZ/expo2012/PDF/T_SECA4_ISE_Posture_Gorgy_Acs.PDF

  ~ BR
  Jatin kone

  * Does the rate of useful messages *.

• ASA 5525 X Anyconnect configuration with ISE 2.1

  I have a new deployment of ISE 2.1 which is used only for the management of the devices at the moment.  The intention is that it will serve as radius for authentication of our VPN server.

  5525 x is a brand new ASA runs the 9.4 code.  I want to configure VPN on the SAA strategy so that each user is assigned a DAP based on their Department.

  I already have the designation of the Department for user accounts assigned in AD through a group membership.  I don't know how to get ISE to belonging to a group at the ASA so that she can associate the user based on this correct in RAP group membership.

  I succumbed to determine how this is supposed to work.  Thanks for any help.

  @Jonathan Harrison ,

  Normally we authenticate and authorize users and then push DACL or allow connection from ISE etc. of such conditions profiles that check results Posture or parts constituting the identity of the user (such as AD or another external identity store belonging to a group).

  There are a couple of good guides to do so, including detailed examples:

  https://communities.Cisco.com/docs/doc-68158

  http://www.Cisco.com/c/en/us/support/docs/security/Adaptive-Security-app...

  http://www.Cisco.com/c/en/us/support/docs/security/AnyConnect-secure-mob...

  While they focus on the case of use of Posture, they can be adapted to add other uses. For example, ISE registration condition may be the result of not only a Posture check also membership in a given group or another if you make it a State.

  I do not think we can specify to the ASA to call a given font of DAP like Hostscan module cannot be used at the same time that the module ISE Posture. However, you should be able to accomplish just about everything you used to depend on the DAP with ISE Posture Module AnyConnect (assuming you have AnyConnect 4.x Apex licenses).

  If you want to stick with the ASA DAP model, you can forgo using policies and module ISE Posture and instead create an authorization profile (result) to send the ASA, a pair of RAY - V based on a correspondence (in the authorization of the ISE policy) with the ad group. He is a "Cisco-VPN-3000" A - V called "PIX7x-members-from' that can be used in ASA dynamic access policies. You can see (and all other pairs A - v supported buy ISE) here:

  https://communities.Cisco.com/docs/doc-67894

• ASA 5525 X AAA connect on EXEC by ISE mode

  I use ISE 2.0 and have created a policy to connect to our ASA 5525 X worm 9.5.2 running using SSH.

  I can log in the SAA to user exec mode, use activate and type in my password to access the exec priv mode.

  I want to type a user name and password to access the exec priv mode directly.

  That's what I have on our ASA

  RADIUS protocol AAA-server vpnISE
  allow only
  Dynamics-authorization
  vpnISE AAA-server (inside) host IP ADDRESS
  key *.

  RADIUS protocol AAA-server vpnISE
  vpnISE AAA-server (inside) host IP ADDRESS
  LOCAL AAA authentication serial console
  ssh vpnISE LOCAL console AAA authentication
  AAA authentication http LOCAL console
  AAA authentication enable console LOCAL vpnISE

  AAA authorization exec auto activate authentication server

  I have an authorization profile

  ASA_Access

  Access type = ACCESS_ACCEPT
  Cisco-av-pair = shell: priv-lvl = 15

  The authentication policy is PAP_ASCII for AD and local

  The authorization policy:

  NAS-port-type: virtual

  Network Access Protocol: RADIUS

  When I try to log in with this configuration it is said that password authentication failed.  When I check the Logs I see that I have my authentication succeeded.

  Am I need to change my attributes to something else to make it work.

  Two questions:

  1. confirmed that the appropriate rule is now struck in ISE

  2. are - that return you the correct RADIUS attribute? For ASAs, you must go back:

  Radius:Service-Type = Administrative

  Thank you for evaluating useful messages!

• Access VPN ASA and cisco ISE Admin

  Hello

  Currently I'm deployment anyconnect VPN Solution for my client on ASA 9.2 (3). We use the ISE 1.3 to authenticate remote users.

  In the policy stipulates the conditions, I put the condition as below.

  Policy name: Anyconnect

  Condition: DEVICE: Device Type Device Type #All Device Types #Dial - in access EQUALS AND
  RADIUS: NAS-Port-Type is equal to virtual

  I'm authenticating users against the AD.

  I am also restrict users based on group membership in authorization policies by using the OU attributes.

  This works as expected for remote users.

  We also use the ISE to authenticate administrators to connect to the firewall. Now what happens is, Cisco ASA valid also against policy, administrators and their default name Anyconnect.

  Now the question is, how to set up different political requirement for access network admin and users the same Firewall VPN.

  Any suggestions on this would be a great help.

  See you soon,.

  Sri

  You can get some ideas from this article of mine:

  http://ltlnetworker.WordPress.com/2014/08/31/using-Cisco-ISE-as-a-generic-RADIUS-server/

• Assign the static IP address by ISE, ASA VPN clients

  We will integrate the remote access ASA VPN service with a new 1.2 ISE.

  Authentication is performed in Active directory. After authentication, can address assigned to a specific user of VPN by ISE IP?

  This means that the same VPN user will always get the same IP address. Thank you.

  Daniel,

  You can override the IETF-RADIUS-Framed-IP-Address in the authorization policy.

  However if I may make a suggestion:

  Unless you have only a handful of users to do so, it may be appropriate to assign the address of ISE pool or perform the mapping of LDAP attributes on ASA itself.

  In the latter case, the IP addresses are kept on the server as LDAP attributes and ASA will map the IP address. You don't want to keep address IP DB in several places.

  M.

• ISE 1.3-> ASA ssh and attribute anyconnect

  Hello

  I created a condition made up to match the anyconnect client and allow, if necessary, but the problem is that if the user does not match the anyconnect group and match the ssh group (user group only to ssh the ASA) he get authenticated to anyconnect and go to the default group of tunnel.

  AnyConnect condition: type of device, NAS-PORT-Type = virtual and Cisco - VPN3000:CVPN3000/ASA/PIX7x - Client - Type = client Anyconnect

  SSH status: device type, NAS-PORT-Type = virtual

  Basically, if the user does not match the anyconnect condition it can still vpn through SSH condition.

  Thank you

  Khaled

  There are several ways you can do. Probably the cleanest is to use different strategy games. One for VPN access and one for the administration of the unit.

  But to keep things simple, you can use the same attribute 'Cisco VPN3000'... "in your SSH condition, but instead of '=' you can use 'Different' in this way if the SSH session sees the AnyConnect client, then the condition will not be matched.

  Thank you for evaluating useful messages!

• AnyConnect FireSight through ISE user

  Hello!

  We installed the ISE 2.1 for AAA process for users VPN to ASA5545x. AnyConnect users authenticate successfully and you can see the username within newspaper at ISE. Also we have modules of firepower in the ASA and the virtual appliance FireSight 6.1. How we can use ISE as a source of identity for FireSight?

  Inspect traffic to the power of fire based on groups of users, or a user.

  Thanks for the help.

  Hello Serge, you can certainly do that by integrating both via PxGrid.

  Thank you for evaluating useful messages!

• Check the ISE for the VPN Cisco posture

  Hello community,

  first of all thank you for taking the time to read my post. I have a deployment in which requires the characteristic posture of controls for machines of VPN Cisco ISE. I know that logically once a machine on the LAN, Cisco ISE can detect and apply controls posture on clients with the Anyconnect agent but what about VPN machines? The VPN will end via a VPN concentrator, which then connects to an ASA5555X that is deployed as an IPS only. Are there clues to this?

  Thank you!

  The Cisco ASA Version 9.2.1 supports the change in RADIUS authorization (CoA) (RFC 5176). This allows for the gesticulations of users against the ISE Cisco VPN without the need of an IPN. Once a VPN user connects, the ASA redirects web traffic to the LSE, where the user is configured with a Network Admission Control (NAC) or Web Agent. The agent performs specific controls on the user's computer to determine its conformity against one together configured posture rules, such as the rules of operating system (OS) patches, AntiVirus, registry, Application, or Service.

  The posture validation results are then sent to the ISE. If the machine is considered the complaint, then the ISE can send a RADIUS CoA to the ASA with the new set of authorization policies. After validation of the successful posture and CoA, the user is allowed to access internal resources.

  http://www.Cisco.com/c/en/us/support/docs/security/Adaptive-Security-Appliance-ASA-software/117693-configure-ASA-00.html

• Question ISE Cisco router certificate

  Hello

  I'm looking to get to the how to guides or examples of configuration on how ISE NHPS can be used as an intermediate CA (certification authority root in Enterprise Microsoft CA). Routers / Firewalls ASA automated certificate request to LSE which can issue the certificate as intermediate CA, purpose of these certificates to routers / firewall can use for configuration of the IPSec VPN.

  Thank you very much

  Rakesh

  Hello

  Here's the Cisco documentation:

  http://www.Cisco.com/c/en/us/TD/docs/security/ISE/2-0/admin_guide/b_ise _...

  It's very simple to set as an intermediary ca ise. ISE will use CEP Protocol to distribute certificates. Wait paragraph ISE CA issues certificates user VPN ASA.

  In a few words, after importing CA root and when you enable ise as a ca server, you will generate a csr from ISE. generate Windows intermediate certificate for ISE from this REA. That generated while bound this certificate to CSR in ISE.

  That's all.

  Don't worry, the steps are described very well in the ISE.

  There is a great video, I always recommend to newbies, labminutes; who do an outstanding job: http://www.labminutes.com/sec0187_ise_13_internal_certificate_authority _...

  What you need to know, is that you will not be able to create specific model to the LSE, as you did on Windows.

  PS: If this solves your problem do not forget to note and correct mark them as answer

  Thank you

• Department of foreign for GANYMEDE + via ISE - is RSA Secure ID the only option?

  I'm running Cisco Secure ACS to GANYMEDE and other things.  I have to move to another platform due to the requirements of PCI DSS 3.2.

  ISE is the head to replace ACS but I also have a requirement to implement a multifactor authentication (MFA) everywhere.

  2.1 ISE implementation guide says that RSA Secure ID is supported for the Ministry of Foreign Affairs with the GANYMEDE connections.  I did not have RSA Secure ID and probably never have it.

  The implementation guide and my provider Cisco also make the State more general that ISE will work with any solution of Ministry of Foreign Affairs which has a front end compliant RADIUS.  Well, it's because I already have one of these (SafeNet/SafeWord).  What they are not, is if it will work specifically to authenticate the RADIUS authentications.  The only docs I can find on this subject are all/only on ISE do this for the RADIUS clients such as ASA Cisco Anyconnect VPN client handling.

  Someone at - he obtained ISE GANYMEDE to work with the Ministry of Foreign Affairs with anything other than Secure ID? You have any links?

  Click on your name in the upper right to see your profile. Then choose the 'Message' tab and click 'New Message'.

• Configuration guide benefits of Cisco context directory Agent (CDA) and AAA (on ASA)

  Hello

  I would like to set up and test AAA on a Cisco ASA (5505 or 5510).
  1 are there any other tools or server required to use this feature? And you have good configuration guides?

  I already tested a CDA of Cisco. He was able to show users active directory and their IP equivalent.
  2. do you have a brief explanation what kind of opportunities I have with this server/tool? It is perhaps usable for the AAA mentioned on the SAA?

  Thanks in advance

  Best regards

  1. Yes, you need a Radius like Windows Server NPS or RADIUS server such as Cisco ACS/ISE server.

  2. He's just a man in the middle of the ADC, you will always need an AAA server: radius or Ganymede (see # 1).