topic Cisco ISE and RSA ID packet flow in Network Access Control

Cisco ISE and RSA ID packet flow

AIN UL BADAR — Tue, 07 Dec 2021 17:29:07 GMT

Hello

I'm in the process of integrating Cisco ISE and RSA Token Server. I'll need to allow Firewall ports in this ISE Distributed Deployment. The question is, does authentications for RSA Tokens come from a PSN or from a PAN towards the RSA Server?

Thank you

Re: Cisco ISE and RSA ID packet flow

balaji.bandi — Tue, 07 Dec 2021 21:59:57 GMT

check below flows : (Hope this helps you understand)

https://www.grandmetric.com/2017/03/31/vpn-remote-access-with-multi-factor-authentication-experience-case-study/

Re: Cisco ISE and RSA ID packet flow

Greg Gibbs — Tue, 07 Dec 2021 22:11:54 GMT

This depends on what MFA use case(s) you are implementing. If you are only using MFA for user flows like Portals, these are handled by the PSNs. If you are using MFA for login to the Admin GUI (from any of the nodes), then all nodes would need connectivity.

Re: Cisco ISE and RSA ID packet flow

AIN UL BADAR — Wed, 08 Dec 2021 14:17:29 GMT

Thank you Greg. It makes sense. My clients are authenticating with regular 802.1x, so it means PSNs initiate/relay the authentication requests back to RSA server.