topic Re: ISE as Two Factor Authentication Tool? in Network Access Control

ISE as Two Factor Authentication Tool?

mweintraub — Mon, 12 Mar 2018 18:38:14 GMT

Can ISE be configured to create a two-factor authentication protocol without the use of an external identity source like an RSA token? Or at least can it be configured to work with other Cisco products in a way that acts as two-factor authentication like in conjunction with Anyconnect?

Re: ISE as Two Factor Authentication Tool?

Craig Hyps — Mon, 12 Mar 2018 20:57:49 GMT

Suggest review this session from Cisco Live 2017: On-Demand Library - Cisco Live Global Events (see Reference presentation).

Specific OTP, that is something requires integration with external RSA/RADIUS-based token server, as ISE is not a OTP server. Some examples that may address the customer goal (and not all technically qualify as pure MFA) include EAP Chaining, CWA Chaining, EZC Chaining, Machine Access Restrictions (MAR). Some methods are NAD based (for example, ASA can perform double auth), or are client based (for example, biometric reader or PIN to unluck credentials/certificate). The session I cite above also gets into the options to handle the device + user auth, which is not MFA, but multiple identity auth.

Craig

Re: ISE as Two Factor Authentication Tool?

peter.matuska1 — Tue, 13 Mar 2018 12:27:42 GMT

so it is not a problem to implement MFA (lets say DUO) with dot1x for user auth? do I need to use some xy chaining? thank you

Re: ISE as Two Factor Authentication Tool?

Craig Hyps — Tue, 13 Mar 2018 14:20:03 GMT

The chaining options are not true MFA. MFA typically refers to multiple factors (such as something you have, something you know, something you are) being used for a specific identity. The chaining options are separate, discreet auth events, but combined together to provide a single access policy decision. This is similar to the ASA double authentication feature. It is not MFA in pure sense. That said, you need to decide what is the outcome you are trying to achieve.

We do not have any special integration with DUO, although I have received reports of successful integration with ISE. DUO is more of a true MFA type function which can work outside ISE, but may have the needed hooks via RADIUS, LDAP, or other integration into web auth flow.