cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
428
Views
0
Helpful
3
Replies

Can ISE and FirePower work as an intelligent cut-through proxy

Hi

We need to grant internet access to our jump stations, but only to limited sites.

The ideal way would be if the user could open a browser session, get redirected to ISE, enters the URL, ISE added this URL or IP address to FirePower or the ASA, and then the site can be accessed?

 

Today we are using the cut-through proxy on the ASA, users access a site, gets prompted for username and password, and then has access to everything. We would like to have the user add ACE's, to the "Jumpstation_internet_access" ACL. Then with a fixed frequency, our security team could audit the ACL.

 

If someone has a different solution, I'll be glad to hear it. Perhaps there are a more suitable way to deliver a reasonable experience for the users, without compromising security.

1 Accepted Solution

Accepted Solutions

howon
Cisco Employee
Cisco Employee

It sounds like you want workflow to add URL/IP to ACE. I can't say for Firepower, but certainly not native function of ISE. Have you looked at WSA? ISE could move users to VLAN where users are forced to go through WSA, and WSA can lookup users that ISE can share. But, since WSA deals with URLs they may have feature for such workflow.

View solution in original post

3 Replies 3

Timothy Abbott
Cisco Employee
Cisco Employee
The only way I could see this working is by using active or passive authentication and then sharing the identity over pxGrid to FMC. If you don't have ISE deployed to perform active authentication (RADIUS) to learn the user identity then you might consider using Passive ID especially if you are using a Windows based jump box. ISE can learn the user ID and IP address passively from the AD logon and then share that information over pxGrid to FMC where policy can be applied.

Regards,
-Tim

howon
Cisco Employee
Cisco Employee

It sounds like you want workflow to add URL/IP to ACE. I can't say for Firepower, but certainly not native function of ISE. Have you looked at WSA? ISE could move users to VLAN where users are forced to go through WSA, and WSA can lookup users that ISE can share. But, since WSA deals with URLs they may have feature for such workflow.

It might be that I'm shooting over the edge with a ISE/FP solution, trying to solve a relatively easy problem with alot of moving parts. I'll try with the ASA cut-through proxy again, and see if I'm able to optimize it somehow.

Thanks for your suggestions!

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: