topic Re: Can ISE using Azure MFA with Internal User on ISE for authorize on in Network Access Control

Can ISE using Azure MFA with Internal User on ISE for authorize only

jewfcb001 — Thu, 05 Jan 2023 06:49:18 GMT

Hi All ,

I try to find the solution of Anyconnect integrate with Azure AD and ISE do authorize only . This is solution working fine but ISE integrate with on-premise AD for do condition authorization and If I need use group internal user for do authorization . Can I do that ?

Reference : https://www.packetswitch.co.uk/cisco-anyconnect-with-azure-ad/

https://community.cisco.com/t5/network-access-control/ise-using-azure-mfa-and-ad/td-p/3592900

Re: Can ISE using Azure MFA with Internal User on ISE for authorize on

balaji.bandi — Thu, 05 Jan 2023 10:37:23 GMT

trying to understand your scenario, you looking authentication with Local ISE and Authorisation send to Azure AD ?

please clarify ?

Re: Can ISE using Azure MFA with Internal User on ISE for authorize on

jewfcb001 — Thu, 05 Jan 2023 10:43:21 GMT

@balaji.bandi

I looking for authentication with Azure AD and authorization check from group of internal user for do authorization policy . I'm not sure I explain clear or not?

Re: Can ISE using Azure MFA with Internal User on ISE for authorize on

balaji.bandi — Thu, 05 Jan 2023 11:02:15 GMT

ok how is your Azure and on Prem AD synched you have any agent ?

is the users are different on prem and azure cloud ?

if you have synched user and groups to Azure AD - then ISE can use that AD group for authentication and Authorisation, what is the challange you see here ?

Re: Can ISE using Azure MFA with Internal User on ISE for authorize on

jewfcb001 — Thu, 05 Jan 2023 11:17:43 GMT

@balaji.bandi

I understand If I sync ISE with on prem AD and AD replicate with Azure AD can do that .

My scenario If I will not sync user from AD group. Can I manual create same user with AD in local user in ISE . Can i do that ?

Re: Can ISE using Azure MFA with Internal User on ISE for authorize on

balaji.bandi — Thu, 05 Jan 2023 13:51:54 GMT

If the users and groups are not synched ? how do you validate the user belong to group which is not there ?

Can I manual create same user with AD in local user in ISE . Can i do that ? - If you create local user in ISE, the users will be Local users - they are not AD users right. - if you looking to authenticate and authz with that database sure you can do so.

personally your use case not valid. AD user should be located in AD, and belong to Group that is exist to the condition matches here.

Re: Can ISE using Azure MFA with Internal User on ISE for authorize on

Marius Gunnerud — Thu, 05 Jan 2023 14:00:37 GMT

You can create a local user in ISE and have the user use that for authentication, but this user will not be associated in any way with Active Directory.

Re: Can ISE using Azure MFA with Internal User on ISE for authorize on

jewfcb001 — Thu, 05 Jan 2023 14:09:01 GMT

@balaji.bandi

Thank you for answer. I see in your answer but the customer have some restriction.

I looking authentication with Azure AD and condition of authorization I will using the group local user and user in ISE.

Re: Can ISE using Azure MFA with Internal User on ISE for authorize on

jewfcb001 — Thu, 05 Jan 2023 14:12:58 GMT

@Marius Gunnerud

can create a local user in ISE . you mean authentication i can go Azure AD first and authorization i can go to ISE and check group and user on ISE . My understand correct? If correct , It's my objective.

Re: Can ISE using Azure MFA with Internal User on ISE for authorize on

balaji.bandi — Thu, 05 Jan 2023 15:42:32 GMT

I do see any option you looking 2 different system - as per i know Either you can use local or Azure AD for Authentication and Authorization

Re: Can ISE using Azure MFA with Internal User on ISE for authorize on

jewfcb001 — Thu, 05 Jan 2023 15:50:10 GMT

@balaji.bandi

I will try to Azure AD for anyconnect authentication first and ISE do authorize with internal local user.

I think , I will test first .

Re: Can ISE using Azure MFA with Internal User on ISE for authorize on

balaji.bandi — Thu, 05 Jan 2023 16:45:45 GMT

If you also looking 2facto authentication - Like to take advantage of SAML MS authenticator with Azure AD.

Re: Can ISE using Azure MFA with Internal User on ISE for authorize on

jewfcb001 — Thu, 05 Jan 2023 16:50:29 GMT

@balaji.bandi

Yes I looking for 2FA . Now I integrate SAML with Azure AD And after authentication I need ISE do authorize but in condition on ISE I need the local user group in ISE for do that . that's all my requirement.

I'm not sure Are you got my point ?

Re: Can ISE using Azure MFA with Internal User on ISE for authorize on

Marius Gunnerud — Thu, 05 Jan 2023 21:33:48 GMT

No, that is not what I meant. you need to either use an external user or an internal user. If you are using an external user but want to match on something other than an Active Directory group or similar, you would need to install a posture agent on the client machine and then match on something local on the machine that the agent can identify.

Matching on a user group local to the ISE is not possible as far as I know. There is no way to associate an external user with a local group that I can see.

Re: Can ISE using Azure MFA with Internal User on ISE for authorize on

balaji.bandi — Thu, 05 Jan 2023 21:37:22 GMT

In your own terms what you mean by Authorization -"authorization i can go to ISE"

as we repeatedly mentioned that is not possible,

Based on the condition matched - ISE will have policies - on what to access and what to not access.

Re: Can ISE using Azure MFA with Internal User on ISE for authorize on

jewfcb001 — Fri, 06 Jan 2023 01:56:00 GMT

@balaji.bandi

I mean If authentication via 2FA Azure AD and FW will do authorize to ISE and ISE do authorize , condition in authorize I using internal user internal. The user, I will create it same in AD instead sync user from AD (Restrictions from the customer). Are you clear in my explain?

Please see the detail below again.

Re: Can ISE using Azure MFA with Internal User on ISE for authorize on

jewfcb001 — Fri, 06 Jan 2023 01:55:22 GMT

As Picture below It's my objective. I understand It's my sense but restrictions from the customer.

Re: Can ISE using Azure MFA with Internal User on ISE for authorize on

balaji.bandi — Fri, 06 Jan 2023 10:10:39 GMT

If the user already verified and he is in AD, what is the point of redoing same verification ?

Looks like we are going circle here - spending enough time discussing the same situation again and again.

Personally the solution not work - the use case not intedent to design like that.

@Marius Gunnerud suggested you can look posture module to validate after 2Facto done.

I would suggest to contact Local Cisco partner and Contact TAC - validate the information provided here.

Re: Can ISE using Azure MFA with Internal User on ISE for authorize on

jewfcb001 — Fri, 06 Jan 2023 10:14:50 GMT

@balaji.bandi

Thank you so much for your help.

Re: Can ISE using Azure MFA with Internal User on ISE for authorize on

Marius Gunnerud — Fri, 06 Jan 2023 10:23:02 GMT

Even if you configure the same user name and groups on the ISE it will still be different from the user you are authenticating with so there is nothing associating the user you are authenticating with to the objects you create in ISE. So, you have a couple options here.

1. install a posture agent on the end client PC and authorize the user based on some value configured in the PC

2. use certificate authentication with MFA. This way you can authorize the user based on values within the certificate.