topic Re: ISE using Azure MFA and AD in Network Access Control

ISE using Azure MFA and AD

imsheikh — Wed, 01 Feb 2017 19:34:32 GMT

Are there any white papers on configuration VPN Authorization in ISE using Azure MFA and AD?

Re: ISE using Azure MFA and AD

imsheikh — Wed, 01 Feb 2017 20:14:48 GMT

if nothing for MFA how about whitepaper about using ISE for Anyconnect VPN authentication without MFA?

Re: ISE using Azure MFA and AD

kthiruve — Thu, 02 Feb 2017 19:30:58 GMT

Hi,

You can find information on ISE and Anyconnect design guides.

ISE Design & Integration Guides

With related to MFA, ISE support RSA secure ID, Radius token. You can also use an external server such as Symatec VIP with guest portal. You can look at the integration with Symantec for that from the design guide above.

ISE is supporting Azure AD with MFA for SAML 2.0 SSO at ISE end-user-facing webauth portals if the primary auth is form-auth authentication.

Now, ASA supports MFA with two different identity sources for authentication, you can use ISE as authorization only in such cases.

Thanks

Krishnan

Re: ISE using Azure MFA and AD

Richard Lucht — Fri, 12 Jan 2018 14:37:09 GMT

Hi imsheikh,

I was working on the same thing it looks like you are trying to do. We just set up an Azure MFA server to set up multi-factor for VPN and I also found that it works quite nice with accessing network devices. Since the MFA server is on-prem and uses our AD I used the Azure server as an external radius token server in ISE. The Azure server is now the Identity store I use in the Authentication Policy then, of course, AD groups for the Authorization policies. I found the results to work just as we needed. I did not have to set up the second authentication on the ASA. Using the MFA as the Authentication Policy identity store now when we log into Cisco gear or the VPN we can use either a token or a push notification. It is a little overkill for access to network gear but being a government organization we had a requirement for that. it works much like the DUO Auth Proxy.

Re: ISE using Azure MFA and AD

MARK BAKER — Wed, 11 Sep 2019 20:19:40 GMT

Hi Richard,

Do you have the NPS w/ extension config that worked with ISE integration? I am attempting to setup ISE to NPS Azure MFA for device access like you have done by using RADIUS token server on ISE. I appreciate any assistance you can provide.

Re: ISE using Azure MFA and AD

paul — Wed, 11 Sep 2019 20:41:02 GMT

If you have your NPS server correctly working with Azure MFA, i.e. you can point VPN auth directly at NPS server and perform Azure MFA then you should be able to define the NPS server as an external RADIUS token server in ISE, ensure the ISE IPs are defined as RADIUS client on the NPS server and point VPN authentication to ISE.

Have you tried this and it isn't working?

Re: ISE using Azure MFA and AD

MARK BAKER — Wed, 11 Sep 2019 20:46:24 GMT

Paul,

Doing device CLI login -> ISE -> NPS/AzureMFA as a first deployment. Would the NPS setup be the exact same as when used with ASA/VPN through NPS/MFA? If they are the same and can use the same policy, It may be a little easier to find documentation on the VPN setup.

Thank you,

Mark

Re: ISE using Azure MFA and AD

paul — Wed, 11 Sep 2019 20:55:59 GMT

It should be the same. At the end of the day it is just RADIUS calls into NPS. You can match on different RADIUS attributes in NPS if you want to build different policies. If you are ultimately going to go against ISE I would recommend keeping your NPS policy as generic as possible. Basically just have it run the MFA process. All the AD group checking stuff can occur in ISE.

Re: ISE using Azure MFA and AD

MARK BAKER — Wed, 26 Feb 2020 21:21:34 GMT

Wanted to follow-up that I did get this working and wanted to add something that I was unable to find online. The examples I found online for device CLI MFA showed RADIUS configured on the device to ISE and then NPS /extension as RADIUS token server on ISE. You can use TACACS from device to ISE and RADIUS from ISE to NPS server. This is how I did it for device CLI MFA. It saved a lot of config changes on the Cisco devices.

Re: ISE using Azure MFA and AD

vsurresh — Tue, 21 Apr 2020 16:01:55 GMT

https://packetswitch.co.uk/cisco-anyconnect-with-azure-ad/

Re: ISE using Azure MFA and AD

chacy2000 — Fri, 12 Jun 2020 14:11:19 GMT

ISE

@paul wrote:
It should be the same. At the end of the day it is just RADIUS calls into NPS. You can match on different RADIUS attributes in NPS if you want to build different policies. If you are ultimately going to go against ISE I would recommend keeping your NPS policy as generic as possible. Basically just have it run the MFA process. All the AD group checking stuff can occur in ISE.

RADIUS Token Server Supported Authentication Protocols

ISE Radius token with NPS solution only supported PAP protocol (ISE 2.4). Do you know if MSCHAPv2 protocol is now supported by ISE?

https://www.cisco.com/c/en/us/td/docs/security/ise/2-2/admin_guide/b_ise_admin_guide_22/b_ise_admin_guide_22_chapter_01101.html

Re: ISE using Azure MFA and AD

cfitzgerald — Mon, 06 Jul 2020 21:22:34 GMT

Hello @MARK BAKER

Do have a good guide you followed to setup ISE > NPS/AzureMFA? (aka Token Server)

I need to integrate AzureMFA with AnyConnect VPN but using a FirePower devices, not an ASA, so direct AuthZ to AzureMFA is not possible.

Re: ISE using Azure MFA and AD

chacy2000 — Tue, 07 Jul 2020 22:11:41 GMT

New ZixCorp secure email message from Beacon Health Options

To view the secure message, click on the link below or copy and paste the link into your Internet browser address bar.

https://securemail-valueoptions.com/s/e?m=ABAaA5qVYKNGKd0VJGIvh5jp&c=ABCuAEoOylrg13RyZzJuX4Xf&em=ciscosupport%2eprod%7c914b1085%7cd159a44c%2dbfe0%2d4c39%2db348%2d3283c55c7cc2%40reply01%2elithium%2ecom

You are reading the plaintext version of this message. For a better user experience, change your email settings to enable the viewing of HTML.

Do not reply to this notification message; this message was auto-generated by the sender's security system. To reply to the sender, click on the link above.

The secure message expires on Jul 07, 2021 @ 10:11 PM (GMT).

Want to send and receive secure email messages transparently? http://www.zixcorp.com/info/zixmail_ZMC

Re: ISE using Azure MFA and AD

chacy2000 — Tue, 07 Jul 2020 22:22:00 GMT

The gateway type used shouldn’t matter-in my case ASA -only communicates (radius) with ISE . Below is my design diagram. Use NPS (ISE token server) for your Identity source (typically this is AD) for authentication policy. I used a similar setup guide as the attached. https://community.cisco.com/kxiwq67737/attachments/kxiwq67737/4561-docs-security/5748/1/Multi-Factor%20Authentication%20with%20ISE.pdf My design diagram image.png

Re: ISE using Azure MFA and AD

Arjun Bhamra — Mon, 09 Nov 2020 14:36:46 GMT

Is there any document that integrates Azure MFA on cloud 2020, with any-connect and all authorization from ISE, but Without ON PREM azure server . Microsoft no longer allows ON prep Azure MFA server. Has to be without DUO.

Re: ISE using Azure MFA and AD

vsurresh — Mon, 09 Nov 2020 14:44:21 GMT

https://www.google.com/amp/s/packetswitch.co.uk/cisco-anyconnect-with-azure-ad/amp/

Here you go. I have the similar set up.

Authentication on Azure AD
Authorization on ISE.

Re: ISE using Azure MFA and AD

vsurresh — Mon, 09 Nov 2020 14:46:17 GMT

Here you go

https://www.google.com/amp/s/packetswitch.co.uk/cisco-anyconnect-with-azure-ad/amp/

Re: ISE using Azure MFA and AD

bhatel — Tue, 26 Oct 2021 14:46:33 GMT

@Baker

Hey, do you have any documentation for how you implemented TACACS between network device and ISE & RADIUS between ISE and AZ MFA. Any help would be appreciated.

Thanks

Re: ISE using Azure MFA and AD

MARK BAKER — Tue, 26 Oct 2021 20:20:51 GMT

@bhatel

See if this helps. I don't recall where I got this online, but it was provided by Richard Lucht. You might be able to find the file location and possibly more info by searching "Azure MFA Richard Lucht". I just used TACACS instead of RADIUS between the router/firewall and ISE. I may have used this in combination with other online info.