topic RADIUS authentication to strip '@domainname.com' from user principal name in Network Access Control

RADIUS authentication to strip '@domainname.com' from user principal name

waqas gondal — Wed, 14 Nov 2018 19:06:39 GMT

Hello,

I have ISE VM 2.0.0.306 which is using RADIUS authentication just for AAA.

I am having a certificate issue with our Palo Alto remote access VPN. When the client connects their VPN the firewall looks at the User Principal Name which is "username@domainname.com" in some cases it might be "username@other.domainname.com"

The problem is the authentication doesn't work because the firewall is supposed to only send the username of the UPN when authenticating to LDAP. It should not be sending anything after the '@' symbol.

If I send the VPN authentication request to ISE would it be possible for ISE to strip everything after the @ symbol and then authenticate against AD?

Re: RADIUS authentication to strip '@domainname.com' from user principal name

Nadav — Wed, 14 Nov 2018 19:35:10 GMT

Definitely. Check out:

https://www.cisco.com/c/en/us/td/docs/security/ise/2-0/admin_guide/b_ise_admin_guide_20.pdf

Specifically "Identity Rewrite". You can put square brackets around any part of the identity you wish and then tokenize as you see fit. After ISE performs the changes you wish, it will then authenticate with that identity.

Re: RADIUS authentication to strip '@domainname.com' from user principal name

waqas gondal — Wed, 14 Nov 2018 22:39:27 GMT

Thanks!

It addresses my issue but now I have a certificate problem. I pointed the firewall to ISE for Radius authentication of VPN users.

ISE has a certificate form the issuing CA and so do the clients but the Firewall is saying there is a self signed cert in the chain when VPN users enter their credentials.

Re: RADIUS authentication to strip '@domainname.com' from user principal name

Jason Kunst — Wed, 14 Nov 2018 22:44:04 GMT

Suggest you open a separate thread and provide screenshot of your trusted certificates.

Make sure client presented to endpoints is from a well know root. If you don’t have this and using your own PKI then the complete chain needs to be trusted on the clients.