Hi we are trying to integrate Cisco ASA AnyConnect v4.4 to Cisco ISE v2.1 with machine Cert authentication (EAP-TLS) and posture. We have configured the ASA Connection profile to do the Certificate authentication under Basic on the ASA and under advanced Authorisation & Accounting is set to ISE (RADIUS) server.
Connection profile:
- Basic Authentication method = Certificate
- Advanced Authentication = None
- Advanced Secondary Authentication = None
- Advanced Authorisation = ISE (Server group)
- Advanced Accounting = ISE (Server group)
on Cisco ISE we have a Authentication policy to authenticate against the Active directory. This works and the machine certification happens on the ASA and the user authentication & authorisation on the ISE.
- AD User Logon if DEVICE Type=Device Types#VPN allow protocols MSCHAP and
- default use ActiveDirectory
My question, is this the right way or should we be pointing everything to ISE, so Certificate authentication, authorisation, accounting on connection profile set to RADIUS (ISE) server. I cannot see any ASA to ISE integration guides is anyone could help clarify and provide any links to suitable documentation.
Thanks Khalid
