topic Re: 2 Factor Authentication for Administration on ASA in Network Access Control

2 Factor Authentication for Administration on ASA

Jonathan Van Vuren — Fri, 08 Jul 2016 16:30:34 GMT

A customer has multiple ASAs set up mulit context. They would like to use 2 Factor authentication for admin access control, and have tried unsuccesfully with ACS.

Would this be possible using ISE with the Device Administration License?

From the customer for more color:

We’ve tried it with ACS, and it’s not supported that way either. I think the challenge from what I see in the logs is that there is a reauthentication that occurs every time you switch contexts. That wouldn’t work with SecurID which acts as an OTP.

Re: 2 Factor Authentication for Administration on ASA

thomas — Fri, 08 Jul 2016 22:26:38 GMT

In the User Guide for Cisco Secure Access Control System 5.8 is a section Authenticating Administrators against RSA SecurID Server which should explain how to do with with an OTP/token server such as an RSA server. See the Supported and Interoperable Devices and Software for Cisco Secure Access Control System 5.8 for Supported External Identity Stores.

ISE has the same capability. Please read the Cisco Identity Services Engine Administrator Guide, Release 2.1 section for Administrative Access to Cisco ISE and specifically Administrative Access to Cisco ISE Using an External Identity Store.

Re: 2 Factor Authentication for Administration on ASA

vibobrov — Sat, 09 Jul 2016 00:22:57 GMT

Starting with version 5.5, ACS has the ability to cache the passcode for up to 5 minutes without going back to the RSA server. It will introduce a security hole, but will give you the ability to switch contexts without re-prompts, at least for 5 minutes.

ISE does not have this feature yet.