topic Hello friends,Please allow me in Network Access Control

ASA TACACS + SDI (RSA) Authentication and Authorisation

jafaruddinlie — Mon, 11 Mar 2019 00:22:28 GMT

Hi guys

Just wondering if this can be done:

We have a RSA server and TACACS server, all working fine.

We would like to put in 2 factor authentication using our RSA token to manage our ASA box.

Now, I have got the 2 factor authentication working (tested it with SSH to ASA box) but it seems like it allows anyone with an account on the RSA server to login to the box. We don't want this, we want to be able to lock it down to only few accounts.

We also have a TACACS server. Logging in to the ASA box using TACACS local accounts work fine

I understand that authorisation doesn't work with RSA, and one of the suggestions that I received was to add the RSA server into TACACS, create the user groups / users we want and use TACACS for both authentication and authorisation. Is that right? Some pointers would be appreciated 😐

Re: ASA TACACS + SDI (RSA) Authentication and Authorisation

martin_knorre — Sat, 04 Sep 2010 09:09:31 GMT

Basically the Tacacs+ is a AA protocol with authentication and authorisation at the same time. I configured the ASA with the ASDM for the Tacacs use. Therefore you should look for the problem with the timeouts, I had troubles that every 30 sec the RSA user ran into a timeout.

I suggest you that you create a group on the ACS for the firewall admins.

cheers Martin

Re: ASA TACACS + SDI (RSA) Authentication and Authorisation

jafaruddinlie — Thu, 16 Sep 2010 09:49:24 GMT

Yep maybe I didn't explain myself very well 🙂 Thank you for your reply, sorry it took this long for me to write back. I'll have a look at the timeout issue, thanks for the heads up. Could be some ports that need to be opened, who knows 🙂

Hello friends,Please allow me

alexdelangel — Mon, 23 Jun 2014 01:38:41 GMT

Hello friends,

Please allow me to resurect this old post!

Did you find your answer? My IT manager is asking me to integrate RSA token with our TACACS. Is it possible to add that second factor of authentication for managing my whole network devices?

Regards!