Cisco ISE and RSA ID packet flow

[AIN UL BADAR]

Hello

I'm in the process of integrating Cisco ISE and RSA Token Server. I'll need to allow Firewall ports in this ISE Distributed Deployment. The question is, does authentications for RSA Tokens come from a PSN or from a PAN towards the RSA Server?

Thank you

[balaji.bandi]

check below flows : (Hope this helps you understand)

https://www.grandmetric.com/2017/03/31/vpn-remote-access-with-multi-factor-authentication-experience-case-study/

[Greg Gibbs · Accepted solution]

This depends on what MFA use case(s) you are implementing. If you are only using MFA for user flows like Portals, these are handled by the PSNs. If you are using MFA for login to the Admin GUI (from any of the nodes), then all nodes would need connectivity.

[AIN UL BADAR]

Thank you Greg. It makes sense. My clients are authenticating with regular 802.1x, so it means PSNs initiate/relay the authentication requests back to RSA server.