topic Re: Cisco ISE Two Factor Authentication / Authorisation with different User Identity Store in Network Access Control

Cisco ISE Two Factor Authentication / Authorisation with different User Identity Store

data-dynamic — Wed, 30 Aug 2017 08:27:13 GMT

Hello everybody ,

My customer would like the following scenario for Device Administration (TACAS):

Authentication is to take place via the RSA SecureID server (user name and RSA passcode).

The authorization is to be carried out via the ISE User Identity Store.

(User name and password or only the password)

At the moment you can register with user name and RSA passcode

And for an ENABLE on the network component will be renewed

the RSA passcode.

Here, however, the password from the ISE User Identity Store is to be queried.

Is there a suitable authorization policy to implement this scenario?

Geetings Mario

hslai — Wed, 30 Aug 2017 15:56:12 GMT

I think you are asking about this feature -- Login Authentication and Enable Authorization Differentiation.

Given the usernames are the same in RSA and Internal Users, we may have the following:

Authentication Policy

Enable Password : If TACACS:Service EQUALS Enable Allow Protocols : Default Device Admin and

Default use: Internal Users

Default Rule (if no match) : Allow Protocols : Default Device Admin and use: RSA

kthiruve — Wed, 30 Aug 2017 23:56:24 GMT

Mario,

Authorization policy is meant to send suitable privileges for network admins that includes TACACS+ profile and command sets.

In authorization policy you can also verify it the users are part of a certain group as in the case of AD.

Authentication policy is what you need to verify credentials.

If you need to authenticate different TACACS+ service(login vs enable), you can do it as Hsing pointed out above.

Hope it clarifies.

Thanks

Krishnan

data-dynamic — Thu, 31 Aug 2017 08:41:03 GMT

Hello hslai,

Thanks for the answer.

I will test it and report back with the results.

Greeting Mario

data-dynamic — Thu, 31 Aug 2017 08:41:18 GMT

Hello Krishnan ,

Thanks for the answer.

Greeting Mario