topic Setting up 2 factor authentication to a PIX? in Network Access Control

Setting up 2 factor authentication to a PIX?

nathan — Fri, 21 Feb 2020 18:16:01 GMT

Hi guys, is it possible to set up 2 factor authentication using a tacacs+ server in the pix firewall? only want to use a tacacs+ server using aaa on the pix.

Re: Setting up 2 factor authentication to a PIX?

brian.r.johns — Fri, 02 Jun 2006 19:42:08 GMT

It is dependant on your TACACS server having the 2 factor support. The PIX sends athentication request to the aaa server for serial|telnet|ssh|http|enable that I know of. If you are authenticating vpn clients via TACACS I am not sure off the top of my head.

cheers

Re: Setting up 2 factor authentication to a PIX?

vayusa1234 — Fri, 02 Jun 2006 20:06:41 GMT

We are running accross the same thing here, my question is what tacacs+ or tacacs server supports two factor authentication?

Re: Setting up 2 factor authentication to a PIX?

nathan — Fri, 02 Jun 2006 22:30:19 GMT

according to this article: "The Power Behind RSA SecurID® Two-factor User Authentication: RSA ACE/Server"

page 4of11 it seems that tacacs+ supports server sessions.

http://www.opsec.com/solutions/partners/downloads/rsa_securid_whitepaper.pdf

"Most leading remote access server, firewall,

VPN and router products have built-in RSA ACE/Agents for compatibility with RSA SecurID two-factor authentication. In addition, both TACACS+ and RADIUS authentication support RSA ACE/Server sessions."

anyways, in general, what is the best way to set up 2 factor authentication on a pix ?

Re: Setting up 2 factor authentication to a PIX?

Fernando_Meza — Sat, 03 Jun 2006 09:49:24 GMT

Hi .. the best two factor authentication that I have come across is always RSA secureID. Basically you configure the AAA options in your PIX as radius client while the RSA ACE is the radius server.

This is a quick example that I have set up in the past using an ASA.

I hope it helps .. please rate it if it does !!!

aaa-server RADIUS_SERVERS protocol radius

aaa-server RADIUS_SERVERS host RSA_SERVER

timeout 5

key ********

tunnel-group GT_VPN_RSA type ipsec-ra

tunnel-group GT_VPN_RSA general-attributes

address-pool VPN_rsa_pool

authentication-server-group RADIUS_SERVERS

tunnel-group GT_VPN_RSA ipsec-attributes

pre-shared-key *

For configurating on a PIX running 6.XX you can check the command reference under aaa-server and vpngroup commands

http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_command_reference_book09186a008017284e.html

I hope it helps ... please rate it if it does !!!

Re: Setting up 2 factor authentication to a PIX?

nathan — Sat, 03 Jun 2006 15:53:47 GMT

well, I dont want to radius at all if possible.

So if you dont have a radius server, what are my options?