topic Re: RA VPN (Any connect) password change using ISE and Active Directory in Network Access Control

RA VPN (Any connect) password change using ISE and Active Directory

Philip Badhams — Mon, 08 Mar 2021 12:19:16 GMT

Hi All

I am trying to understand if it is possible to send password expiry notifications / reset password for RA VPN Users.

The current setup uses 2FA as follows:

1) User connects to FTD Outside Interface

2) The FTD passes the request via RADIUS to ISE

3) ISE, (which is integrated into Active Directry) queries the account via LDAP

4) ISE returns the result to the FTD

5) The FTD connects to the 2FA server and prompt the user for a token code.

6) The user is granted access.

My thinking is is not currently possible in the above setup as the FTD / FMC, does not talk directly to AD, instead it communicates via ISE.

I have been trying to follow the below configuration to test the theory

https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/213905-configure-anyconnect-vpn-on-ftd-using-ci.html

What I cannot tell from the above guide is wether or not the ISE is required to integrate with Active Directory (as an external identity source) for it to work? The guide only shows setting up the realm in the FMC.

Any clarification would be appreciated.

Thanks

Re: RA VPN (Any connect) password change using ISE and Active Directory

Marcelo Morais — Mon, 08 Mar 2021 15:16:46 GMT

Hi @Philip Badhams

yes, ISE is required to integrated with AD in External Identity Sources > Active Directory... on the link that you provided search for Cisco ISE, take a look at the screenshot related to RADIUS > Live Logs, look at the Steps, 24402 User Authentication against Active Directory succeeded.

Hope this helps !!!

Re: RA VPN (Any connect) password change using ISE and Active Directory

Philip Badhams — Mon, 15 Mar 2021 11:54:27 GMT

Is there a reason why both FMC and ISE need to be connected to AD in the scenario? I cannot see where the FMC talks directly to AD. All the authentication requests appear to go from the FMC to ISE and then to AD.

Re: RA VPN (Any connect) password change using ISE and Active Directory

hslai — Wed, 17 Mar 2021 03:11:46 GMT

Philip Badhams, I've not used FMC/FTD for RA-VPN yet but I believe it not required to integrate with AD if you are not using any objects from AD in the policies in FMC.

If you want to support password changes for AD users, then the VPN head-end needs using MSCHAPv2 to connect to ISE.