topic Re: Imprivata as a RADIUS token server in ISE in Network Access Control

Imprivata as a RADIUS token server in ISE

Ciscorocks — Tue, 27 Dec 2022 21:12:30 GMT

Does anyone have documentation or a configuration guide on the integration of ISE and Imprivata for 2FA auth for SSLVPN?

Re: Imprivata as a RADIUS token server in ISE

balaji.bandi — Tue, 27 Dec 2022 21:49:27 GMT

as per I know Imprivata its self an identity used in the medical field.

SSLVPN client connects to the remote access Server using ISE in the normal situation, where is the Imprivata device in the network?

now sure what the requirement is here, can you explain more?

Re: Imprivata as a RADIUS token server in ISE

Ciscorocks — Tue, 27 Dec 2022 22:38:31 GMT

I was wondering if there is a guide for setting up imprivata as a token server and using it as an external identity source in ISE. I found quite a bit of documentation for the set up with DUO but not imprivata. I’m assuming its about the same.

User connects to ssl vpn, FTDs send requests to ISE, ISE queries imprivata, and then Active Directory, push notification is sent to users phone and the user accepts the push and a radius accept is sent to imprivata to ISE to the FTD.

Re: Imprivata as a RADIUS token server in ISE

balaji.bandi — Tue, 27 Dec 2022 22:54:04 GMT

You need to test this, since ISE does everything what you looking to do, so most of them don't have any other identity requirement,

check this ISE can be configured external authentication source :

https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/213239-configure-external-radius-servers-on-ise.html

Re: Imprivata as a RADIUS token server in ISE

Ali Farooqi — Fri, 17 Feb 2023 03:19:49 GMT

Anyone made it work? As far as i know Imprivata can do SAML but cannot be configured as external radius server in ISE.

Re: Imprivata as a RADIUS token server in ISE

Greg Gibbs — Mon, 20 Feb 2023 21:25:16 GMT

I'm not familiar with Imprivata, but if it only supports SAML you will likely need to do the Authentication directly from the VPN headend (ASA, FTD, etc) then use ISE for Authorization only. This is the same flow that is used for SAML using AzureAD + MFA.