topic Re: ACS 5.x with either AD or RSA Authentication depending on us in Network Access Control

ACS 5.x with either AD or RSA Authentication depending on user

timsilverline — Mon, 11 Mar 2019 03:00:34 GMT

I am trying to implement RSA two-factor authentication for our company for access to secure resources.

Our current setup before we had RSA, due to PCI restrictions, was based on AD group membership but was still extremely restrictive on even our admin users to ensure that no secure resources could be accessed without two-factor authentication.

I do not want to have to enable RSA tokens for our entire company - but I would like to be able to allow admins the ability to connect from the outside with two-factor authentication and have access to secure resources in an emergency.

We have less than ten people that require elevated access privileges so my hope is to enable RSA only for those ten users, and leave the rest of the accounts authenticating normally against AD.

I cannot figure out how to configure this. With ACS 4.x such a policy would be simple - just create the user on ACS and point to the Identity Store that I want to authenticate against. Not as easy with 5.x

I tried creating an rules based selection for Identity policy, making RSA the first one, configuring it to drop if no users is found, and configuring the RSA to treat user rejects as user not found. This broke VPN completely.

From what I can tell it seems like ACS really wants me to choose an Identity store based on the NDG - but in this case it will always be our same ASA VPN device.

Anyone know how to accomplish this?

I am running 5.4 with the latest patches.

ACS 5.x with either AD or RSA Authentication depending on user

Tarik Admani — Thu, 24 Jan 2013 06:17:17 GMT

Hi,

I assume you created an identity store sequence and set the RSA at the top of the sequence followed by AD? If so, then setting the process to continue if user not found should have fixed your issue. Please post a screenshot of your settings.

Thanks,

Tarik Admani
*Please rate helpful posts*

ACS 5.x with either AD or RSA Authentication depending on user

timsilverline — Thu, 24 Jan 2013 16:41:07 GMT

I created an Identity store sequence which has RSA at the top of the sequence and then I was just using the Default Rule for AD to match all users that aren't in RSA but I have also tried creating an explicit rule to match All Devices and am having the same result.

I have done some additional analysis on what is happening today.

Here is a log from my session:

11001 Received RADIUS Access-Request

11017 RADIUS created a new session

Evaluating Service Selection Policy

15004 Matched rule

15012 Selected Access Service - Default Network Access

Evaluating Identity Policy

15004 Matched rule

15013 Selected Identity Store -

24500 Authenticating user against the RSA SecurID Server.

24501 A session is established with the RSA SecurID Server.

24552 Reject response from the RSA server is considered as User not found.

24502 The session with RSA SecurID Server is closed

22056 Subject not found in the applicable identity store(s).

22058 The advanced option that is configured for an unknown user is used.

22060 The 'Continue' advanced option is configured in case of a failed authentication request.

Evaluating Group Mapping Policy

Evaluating Exception Authorization Policy

15042 No rule was matched

Evaluating Authorization Policy

15006 Matched Default Rule

15016 Selected Authorization Profile - DenyAccess

15039 Selected Authorization Profile is DenyAccess

11003 Returned RADIUS Access-Reject

From this it seems that my policy is working for RSA and it is continuing to evaluate afterwards, but is no longer using the Authorization Policies that are configured to evaluate the AD user and somehow defaulting to the DenyAll policy. If I switch back to single result for Identity evaluation, everything goes back to working - so I know that the Authorization Profiles are configured correctly if they are properly evaluated. What is the "Exception Authorization Policy"?

Here is what I have configured on the Identity pages:

ACS 5.x with either AD or RSA Authentication depending on user

jrabinow — Thu, 24 Jan 2013 17:22:35 GMT

Each of the results in your identity policy are only selecting a single store; either RSA or AD1

You need to:

1) Create an identity sequence: Users and Identity Stores > Identity Store Sequences

2) select Password based and then add both RSA and AD1 in the selected list in teh order you desire

3) Ocne this is created; select as as the "Identity Source" in the identity policy

ACS 5.x with either AD or RSA Authentication depending on user

timsilverline — Thu, 24 Jan 2013 17:47:19 GMT

Okay this was very helpful and seems to have gotten me past where I was stuck at but something is still not working right....

The ACS Server is evaluating the rules in order, matching the right authorization policy, and sending a success response back, but I am getting a login failed message from AnyConnect.

Need to try doing some active debugs on the firewall while this is happening to see maybe what is going on.

11001 Received RADIUS Access-Request

11017 RADIUS created a new session

Evaluating Service Selection Policy

15004 Matched rule

15012 Selected Access Service - Default Network Access

Evaluating Identity Policy

15006 Matched Default Rule

15013 Selected Identity Store - AD1

24500 Authenticating user against the RSA SecurID Server.

24501 A session is established with the RSA SecurID Server.

24552 Reject response from the RSA server is considered as User not found.

24502 The session with RSA SecurID Server is closed

24430 Authenticating user against Active Director

24416 User's Groups retrieval from Active Directory succeeded

24402 User authentication against Active Directory succeeded

22037 Authentication Passed

Evaluating Group Mapping Policy

Evaluating Exception Authorization Policy

15042 No rule was matched

Evaluating Authorization Policy

15004 Matched rule

15016 Selected Authorization Profile -

22065 Max sessions policy passed

22064 New accounting session created in Session cache

11002 Returned RADIUS Access-Accept

But I am still getting a login failed from the firewall.

Will go get some logs from it to try to see what is happening. Maybe a timeout because it is taking longer or something...

Thanks for your help so far.

ACS 5.x with either AD or RSA Authentication depending on user

Tarik Admani — Fri, 25 Jan 2013 03:29:08 GMT

Hi,

It should be pretty fast when ACS authenticates the session, typically the default timeout on the ASA is 5 if i am not mistaken. You can issue a show run all aaa-server to see what the value is.

Good luck great to know your almost there.

Tarik Admani
*Please rate helpful posts*

ACS 5.x with either AD or RSA Authentication depending on user

timsilverline — Fri, 25 Jan 2013 21:51:46 GMT

Yah something is going on with the firewall and I will probably have to open a TAC case for it..

The ACS log appears to return the Access-Accept, but the firewall just doesn't seem to be listening or something. I even changed the timeout to 60 seconds, and this seems to cause the firewall to keep sending more requests as evidenced by the errors in ACS showing "11013 RADIUS packet already in the process"

I then tried changing on my firewall both the retry intervals to 10 (max). No effect as well.

If anyone has any ideas let me know. Otherwise I will try opening a case with TAC next week to see if they can help.

ACS 5.x with either AD or RSA Authentication depending on user

Tarik Admani — Sat, 26 Jan 2013 06:24:30 GMT

Hi,

Please use the "test aaa authentication...." command while running a capture to the ACS (assuming acs is on the inside).

access-list acs permit ip host any

access-list acs permit ip any host

capture capin match access-list acs interface inside

Tarik Admani
*Please rate helpful posts*

Re: ACS 5.x with either AD or RSA Authentication depending on us

timsilverline — Mon, 28 Jan 2013 22:01:44 GMT

When I do a test aaa authentication from the ASA I receive an Authentication Successful message.

It showed that the timeout for this test is 62 seconds and I think this is where my issue is....

When I timed how long it took for the Authentication Successful message to be returned from the ASA during this test I got more than 25 seconds each time.

When I do it from the AnyConnect client, I think what is happening is that the response is not coming within the retry interval - and then it is asking me for my password again which is restarting the whole process before it can get a response from the device.

Why would it take so long for ACS to process the request this way? I don't see any errors other than the "24552 Reject response from the RSA server is considered as User not found." message. But the process continues on after this as normal until it sends back the RADIUS ACCess-Accept message.

Re: ACS 5.x with either AD or RSA Authentication depending on us

jrabinow — Mon, 28 Jan 2013 23:08:38 GMT

Very interesting

There is a timeout interval on the RSA which by default is set at 30 seconds. Not clear that is coming into play here since does appear that a response has been received from the RSA server but may be worth a try to see if impacts things

If this is a test system (non production / load) I think can open policy diagnostics

System Administration > Configuration > Log Configuration > Logging Categories > Global

select policy diagnostics and set level to DEBUG. Same for

Identity Stores Diagnostics and Authentication Flow Diagnostics

Run test and then see AAA diagnostics

Monitoring & Reports > Reports > Catalog > AAA Protocol

Should see all the steps with the timings to see how long things took

Re: ACS 5.x with either AD or RSA Authentication depending on us

timsilverline — Tue, 29 Jan 2013 18:03:50 GMT

Thank you for the guidance here.

Using these debugs I was able to find the following details in a test authentication in the logs....

Jan 29,13 5:38:12.126 PM A session is established with the RSA SecurID Server.

Jan 29,13 5:38:37.153 PM Reject response from the RSA server is considered as User not found.

So it is definitely the RSA server which is taking about 25 seconds to respond with the rejection message.

When I have the live activity monitor running on RSA it seems to show the message about the user cannot be found within 1 or 2 seconds, so I am not sure why it would take 25 seconds to respond back to ACS.

I will give RSA a call and see what I can find out. If anyone else has any ideas in the mean time let me know.

Thanks for the help so far.

Re: ACS 5.x with either AD or RSA Authentication depending on us

timsilverline — Wed, 30 Jan 2013 05:39:52 GMT

Okay so I was able to get on the phone with RSA support today and made a little progress with the issue before I got dragged into other priorities. It is still not resolved though.

We installed wireshark to do some packet captures on the server and saw that after each packet by Cisco ACS, RSA responds with something. Since it is encrypted we can't see what but there doesnt seem to be much. In the RSA trace it appears to be seeing the user as invalid right away - matching the live monitor - but I don't see anywhere that specifies when it sends the response.

It just seems like there is some back and forth communication for 25 seconds at which point the ACS server recognizes a Reject response and proceeds with authenticating against AD.

Can anyone with a working setup like this do a wireshark capture to see what a regular transaction should look like? Is it just one packet in each direction?

RSA has sent the wireshark capture, the ACS debug, and the RSA trace up to engineering for a closer look and I will see what they come back with.

This sure is frustrating!

Re: ACS 5.x with either AD or RSA Authentication depending on us

Tarik Admani — Wed, 30 Jan 2013 05:51:02 GMT

Please post a screenshot of the settings in your identity store sequence, I am curious to see what your settings are.

Thanks,

Tarik Admani
*Please rate helpful posts*

Re: ACS 5.x with either AD or RSA Authentication depending on us

jrabinow — Wed, 30 Jan 2013 05:53:32 GMT

One other thing that may be useful as an additional data point

If you look at the definition of the RSA object on ACS it has a timeout setting. By default this is 30 seconds.

It may be worth reducing this and see whether it reduces the round trip time for the case of the user not found while still being short enough for users that are found

May not solve anything but can be an additional datapoint to see if the timeout on ACS side is the thing that is terminating the interaction

Re: ACS 5.x with either AD or RSA Authentication depending on us

timsilverline — Wed, 30 Jan 2013 06:02:21 GMT

I just changed the timeout value to 5 seconds and I am able to login to VPN now!

This may have fixed it

I will have to verify now that RSA two-factor is actually working with this timeout...

I don't really understand why I need to specify a timeout but hey if it works...

ACS 5.x with either AD or RSA Authentication depending on user

timsilverline — Wed, 30 Jan 2013 06:50:02 GMT

I was able to get RSA and AD authentication working fine with the timeout set to 5 seconds and all is working now.

I am confused on why thie timesout setting is required though.

Can anyone help to clarify why this is needed? Is it just a bug that I am working around by changing the timeout?

Thanks for your help guys. Much appreciated.

Re: ACS 5.x with either AD or RSA Authentication depending on us

jrabinow — Wed, 30 Jan 2013 06:53:58 GMT

Not suprised

This is still a work around and means system is working in one of two ways

- valid user / password: positive response immediately

- invalid user/password: response from RSA appears to be received but does not seem to get flushed/processed until timeout occurs

In means in case of failures processing is taking longer than it should and not sure of can clearly distnguish all cases including a real timeout from server

Worth still digging some more to undelying causes and also debug from RSA side

Re: ACS 5.x with either AD or RSA Authentication depending on us

timsilverline — Thu, 07 Feb 2013 03:54:36 GMT

When you say Not Surprised is that because this sort of timeout behavior is expected? I have sent logs to RSA and am waiting on their response.

In the meantime, during further testing I found a flaw in my current design....

Succesful Authentication works properly for users as intended.

However, I have found that when using the elevated privilege level account, if I enter the AD password for this account, after RSA authentication fails it still successfully authenticates the end users against AD afterwards and they end up being given the same network access.

The way I have it setup right now is Authorization Profiles are tied to AD group memberships. So even though I have users authenticating against RSA, RSA is still checking against AD for these user accounts, and ACS is still using their group membership from AD to determine which Authorization Profile to provide to the user.

I don't see how else I can set this up to get it working anymore. If I can't base the Authorization Profile on AD group, or NDG device, I can't figure out how to change their authorization profile to know that this user was authenticated against RSA and use the proper profile.

Any idea how I can accomplish this?

ACS 5.x with either AD or RSA Authentication depending on user

jrabinow — Thu, 07 Feb 2013 14:40:27 GMT

I am not sure I haev all the details of the issue but I think there is an additional attribute that defines the name of the external store that was authenticated against. Variable is called "AuthenticationIdentityStore" and is in system dictionary. In fact this is last database that was used to check authentication. In case authentication passed it will in fact be the database against which authentication passed

Therefore, best conditon to use is ("System:AuthenticationIdentityStore" equals "RSA" ) and ("System:AuthenticationStatus" equlas "AuthenticationPassed" )

This will check if authentication was done against RSA

ACS 5.x with either AD or RSA Authentication depending on user

timsilverline — Thu, 07 Feb 2013 15:50:56 GMT

Thanks again jrabinow. That was the exact attribute I had been looking for. It doesn't show up as an option when you just click customize. You have to select Compound Condition when you customize and then select the System variable from that option, and then select its options to see this attribute. It is buried more than the others it seems.

In any event, all authentication is working successfully right now with the timeout set to 5.

Still waiting on feedback from RSA engineering