Cisco ISE authentication for Cisco Anyconnect Clients

[kartik.shah1]

Hi,

We are planning to conduct demonstration of Cisco ISE. Following is our scenario;

Scenario:

Cisco ISEv as Primary node is configured for DC.

Users are locally created in database. Bangalore RAVPN (AnyConnect) user will get authenticate on DC ISEv to access resources in DC & DR.

Cisco ISEv as Secondary node is configured for DR.

Users are synchronized between DC – DR.

Alike DC, AnyConnect users will get authenticate to local ISEv (DR) to access DC-DR resources.

If for any reasons, primary ISE appliance fails, all the users - the one which are getting authenticated to DC appliance, will redirect their request to DR ISE & will authenticate from DR ISE & will access DC & DR resources.

Customer is using Cisco firepower in HA mode.

Can any one help how will be my configuration.

I have to create users locally in ISE database.

I have attached architecture diagram for same.

Thanks.

[Damien Miller]

I think your ask is more of a Firepower configuration question than an ISE question. The requirement you identified of having one primary radius server, and a secondary radius server, is a very common config on any network device. You will define/configure both servers in a radius server group, then the Firepower device will handle the active/dead authentication piece.

Here is a guide that covers an AC remote access sample set up and also radius server group configuration. Search for "Click Add for the Authentication Server and choose RADIUS Server Group - this will be your Cisco Identity Services Engine PSN (Policy Services Node)" about a quarter of the way down the guide.
https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/213905-configure-anyconnect-vpn-on-ftd-using-ci.html

When complete, you should have two ISE nodes defined in this section.

[kartik.shah1]

Thanks a ton! Damien Miller,

Any thing other i need to configure in Cisco ISE for authentication policy? 

Further, can i configure ISE as CA instead of Windows server? if yes, can you share the steps please?

[hslai]

ISE is validated with ASA only for SCEP -- ISE CA Issues Certificates to ASA VPN Users

Configure AnyConnect VPN on FTD using Cisco ISE as a RADIUS Server with Windows Server 2012 Root CA - Cisco should help you with ISE configurations needed to auth a remote access VPN client from FTD.