topic ISE Device Admin with 2FA in Network Access Control

ISE Device Admin with 2FA

fatalXerror — Thu, 06 Aug 2020 10:27:08 GMT

Hi Guys, I want my ISE Device Admin to be in 2FA (AD username + passcode). I know that ISE can only authenticate to one external ID store at a time so what I am going to do is to integrate my 2FA server (since my 2FA is integrated already to AD). My question now is, which of these options should I use?

1. External RADIUS Server (under the Network Resources category)

2. RADIUS Token (under the External ID Sources) - this is the existing setup but I noticed I need to configure a username stored locally in ISE DB in which I don't want. I want to leverage the integration of my 2FA and AD.

3. RSA SecurID (under the External ID Sources)

Thanks

Re: ISE Device Admin with 2FA

Francesco Molino — Thu, 06 Aug 2020 17:42:16 GMT

I personally don't know the rsa solution. When using Duo, I use Radius token and replied to a previous post with same requirements (https://community.cisco.com/t5/network-access-control/tacacs-authentication-with-a-proxy-radius-and-local/td-p/4088804)

Doing a quick search on this forum, you can use Radius Token and external 2FA for RSA. See the following links (2nd link include an official guide from RSA):

https://community.cisco.com/t5/network-access-control/cisco-ise-tacacs-with-rsa-securid-and-ad-integration/td-p/3441295

https://community.cisco.com/t5/security-documents/two-factor-authentication-on-ise-2fa-on-ise/ta-p/3636120

Re: ISE Device Admin with 2FA

fatalXerror — Thu, 06 Aug 2020 17:53:13 GMT

Hi @Francesco Molino,

Thanks for your feedback, I'll check it out.

But I am just wondering what are the difference between those different ways to integrate RADIUS server?

Thaks

Re: ISE Device Admin with 2FA

Francesco Molino — Thu, 06 Aug 2020 18:38:03 GMT

The external identity source called RSA SecurID is a specific integration between ISE and RSA. Radius Token is an external server communicating through radius protocol. In this last case, ISE act as a proxy Radius and gets infos regarding authentication from another radius for example.

Re: ISE Device Admin with 2FA

thomas — Tue, 11 Aug 2020 21:45:24 GMT

Did you look at the Cisco ISE - RSA SecurID Access Implementation Guide ?