topic Re: ISE + OKTA for 2FA/OTP in Network Access Control

ISE + OKTA for 2FA/OTP

nspasov — Fri, 12 Jan 2018 02:50:59 GMT

Hello-

I have a customer that is interested in ISE that is currently using OKTA for their 2FA/OTP. They want to know if ISE and OKTA can integrate together to provide:

2FA/OTP for RA-VPN users utilizing ASAs and AnyConnect
2FA/OTP for RADIUS/TACACS+ based device administration

From what I was able to find on OKTA's support pages and documentation this should not be an issue. It appears that OKTA will just be referenced as an external RADIUS server in ISE (Similarly to other OTP providers such as DUO, RSA, etc). However, I wanted to see if anyone can confirm this.

Thanks!

Neno

Re: ISE + OKTA for 2FA/OTP

hslai — Fri, 12 Jan 2018 15:37:32 GMT

ISE can integrate with any RADIUS token server compliant with RFC 2865. Our teams are not testing OKTA as an OTP so we do not have info which OKTA product(s) work.

Re: ISE + OKTA for 2FA/OTP

paul — Fri, 12 Jan 2018 21:01:52 GMT

I have used OKTA on several installs without an issue mostly for VPN authentication. As you said OKTA is just an external RADIUS server to ISE and it runs the whole authentication. You probably want to crank up your RADIUS timeouts to something like 2-3 minutes because depending on the verification OKTA is doing (OKTA App, App Push, SMS Text, call) it can take a while for the person to type in their password.

Re: ISE + OKTA for 2FA/OTP

nspasov — Tue, 16 Jan 2018 05:55:53 GMT

Hey Paul, nice to "hear" from you! Thank you for the reply/confirmation Paul!

Best regards,

Neno

Re: ISE + OKTA for 2FA/OTP

hugh.kelley — Thu, 19 Apr 2018 18:22:49 GMT

To be clear, in that scenario, is the ASA the original RADIUS client and ISE just proxies the RADIUS message back and forth between the Okta agent and ASA?

Re: ISE + OKTA for 2FA/OTP

Nathaniel Bell — Thu, 14 Feb 2019 22:25:05 GMT

Sorry to barge in to this thread, but it fits right in with the topic at hand...is it possible to use ISE for the Primary authc and authz, and add an OKTA RADIUS agent as a secondary RADIUS server just for the 2nd factor? (I.E. Okta Push)

Re: ISE + OKTA for 2FA/OTP

Mustafa9046 — Fri, 05 Nov 2021 20:11:26 GMT

Hi Team,

I have Cisco ISE 3.0 trying to integrate OKTA for 2FA/OTP for RADIUS/TACACS+ based device administration

Authentication via OKTA Push + AD

Authorization Via AD

Can you please help me with any reference configuration ??

Re: ISE + OKTA for 2FA/OTP

Mustafa9046 — Fri, 05 Nov 2021 20:12:01 GMT

Hi Team,

I have Cisco ISE 3.0 trying to integrate OKTA for 2FA/OTP for RADIUS/TACACS+ based device administration

Authentication via OKTA Push + AD

Authorization Via AD

Can you please help me with any reference configuration ??

Re: ISE + OKTA for 2FA/OTP

kdurai12 — Wed, 27 Apr 2022 12:58:18 GMT

Thank you so much, is it work well for Cisco CLI MFA authentications? like App Push / approve.? Thank you. !