Cisco ASA 5500X with anyConnect v4.4 integration to Cisco ISE v2.1 using machine certs

khalid_mahmood — Mon, 15 May 2017 15:25:10 GMT

Hi we are trying to integrate Cisco ASA AnyConnect v4.4 to Cisco ISE v2.1 with machine Cert authentication (EAP-TLS) and posture. We have configured the ASA Connection profile to do the Certificate authentication under Basic on the ASA and under advanced Authorisation & Accounting is set to ISE (RADIUS) server.

Connection profile:

Basic Authentication method = Certificate
Advanced Authentication = None
Advanced Secondary Authentication = None
Advanced Authorisation = ISE (Server group)
Advanced Accounting = ISE (Server group)

on Cisco ISE we have a Authentication policy to authenticate against the Active directory. This works and the machine certification happens on the ASA and the user authentication & authorisation on the ISE.

AD User Logon if DEVICE Type=Device Types#VPN allow protocols MSCHAP and
- default use ActiveDirectory

My question, is this the right way or should we be pointing everything to ISE, so Certificate authentication, authorisation, accounting on connection profile set to RADIUS (ISE) server. I cannot see any ASA to ISE integration guides is anyone could help clarify and provide any links to suitable documentation.

Thanks Khalid

Re: Cisco ASA 5500X with anyConnect v4.4 integration to Cisco ISE v2.1 using machine certs

hslai — Fri, 19 May 2017 07:46:38 GMT

See a recent discussion -VPN certificate auth using ISE?

topic Cisco ASA 5500X with anyConnect v4.4 integration to Cisco ISE v2.1 using machine certs in Network Access Control

Cisco ASA 5500X with anyConnect v4.4 integration to Cisco ISE v2.1 using machine certs

Re: Cisco ASA 5500X with anyConnect v4.4 integration to Cisco ISE v2.1 using machine certs