topic Re: Two factor authentication on LAN in Network Access Control

Two factor authentication on LAN

vgoda — Wed, 10 Jan 2018 10:20:55 GMT

Hello Team,

I had a query on two factor authentication on LAN, can this be achievable on LAN. The requirement is to have the following-

- When the user connects his laptop on LAN, he should authenticate using his domain login and he should be prompted for a second factor before he is allowed access to the LAN.

- What is the licensing requirement to achieve this?

- Is there a limitation on the switch capability for this? Any particular variant only that supports this?

Regards,

Vikram

Re: Two factor authentication on LAN

ognyan.totev — Wed, 10 Jan 2018 10:42:33 GMT

Hello,

1st Domain machine + certificate on machine

2nd Domain user + certificate on user(or username or password)

This will be simple dot1x authentication.\

You can check this Two Factor Authentication on ISE – 2FA on ISE

Re: Two factor authentication on LAN

hslai — Thu, 11 Jan 2018 00:26:57 GMT

ISE does single authentications, other than EAP Chaining and CWA Chaining. However, a single authentication can be done with a multi-factor software/device. If not done already, I would suggest you to read:

Why Multi-Factor and Two-Factor Authentication May Not Be the Same
SP 800-63B (esp. 4. Authenticator Assurance Levels😞
- Multi-Factor OTP by itself can achieve AAL2.

Re: Two factor authentication on LAN

Craig Hyps — Thu, 11 Jan 2018 07:10:42 GMT

Vikram,

As already discussed on your internal post...

Yes, this is achievable in many different ways. Here a pointer to a particular session (BRKSEC-3697 from Melbourne 2017) which touches on various methods to achieve multiple identity auth. Also, OTP is supported for 802.1X and WebAuth to allow Token servers like RSA to be used as the ID store.

Craig