06-10-2017 04:27 AM - edited 03-11-2019 12:46 AM
Hi Everyone
ASA = ASA5510
Running = asa917-15-k8.bin
ISE Version = 2.2.0.470
ISSUE = AnyConnect Users can Login to ASA
We have recently implemented Cisco ISE and we are using Microsoft Active Directory to Authenticate AnyConnect Users since all users are in Microsoft DC so I can not use the following command:
username MYUSER attributes
service-type remote-access
I created a TACACS Profile for AnyConnect users in ISE with following Profile Attributes:
priv-lvl=0
max_priv_lvl=0
timeout=1
idletime=1
service-type=remote-access
but service-type=remote-access attributes does not work and AnyConnect Users are still able to login to ASA, although they can not do much on ASA with Privilege Level
Following are my ASA AAA configuration:
aaa-server ISE-GROUP protocol tacacs+
aaa-server ISE-GROUP (INSIDE) host xx.xx.xx.xx
aaa authentication
aaa authentication ssh console ISE-GROUP LOCAL
aaa authentication enable console ISE-GROUP LOCAL
aaa authentication telnet console ISE-GROUP LOCAL
aaa authentication serial console ISE-GROUP LOCAL
aaa authorization command ISE-GROUP
aaa authentication secure-
aaa authorization exec authentication-server auto-enable
Any other technique or solution to block the access will really appreciate.
06-10-2017 11:24 PM
On ISE 2.2 you should be able to use the "DenyAll" shell profile as the default which non-authorized users (i.e. anybody not part of the privileged AD group(s) that allows device access).
See this example:
https://supportforums.cisco.com/discussion/13103531/ise-tacacs-authentication-log-deciding-if-you-should-have-access
06-11-2017 12:08 AM
Hi Marvin
Thank you very much for your response.
If I DENY Shell Profile for AnyConnect AD Group, they are no longer able to Login AnyConnect since AnyConnect requires ASA "exec" access to Login.
Moreover, ASA doesn't have TACACS AutoCmd Attributes so while I put Logout or Exit command, It doesn't work.
There could be a workaround if I allow only ASA exec Access but now sure, how to do it.
06-11-2017 12:09 AM
I should have noted - you use the DENY shell profile only for TACACS+ authorization on your ISE servers.
The tunnel-group(s) for your AnyConnect users also use ISE but as a RADIUS server (e.g. something like "aaa-server ISE-RADIUS protocol radius" etc.). That way ISE can send CoA to the ASA according to the user authorization level for the AnyConnect sessions only.
Here are a couple more examples that you can draw from:
http://www.cisco.com/c/en/us/support/docs/security/adaptive-security-appliance-asa-software/117693-configure-ASA-00.html
https://www.petenetlive.com/KB/Article/0001155
06-11-2017 12:17 AM
Thanks Marvin for the direction,
I shall give a shot and keep it posted.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide