Cisco ISE Two Factor Authentication / Authorisation with different User Identity Store

[data-dynamic]

Hello everybody ,

My customer would like the following scenario for Device Administration (TACAS):

Authentication is to take place via the RSA SecureID server (user name and RSA passcode).

The authorization is to be carried out via the ISE User Identity Store.

(User name and password or only the password)

At the moment you can register with user name and RSA passcode

And for an ENABLE on the network component will be renewed

the RSA passcode.

Here, however, the password from the ISE User Identity Store is to be queried.

Is there a suitable authorization policy to implement this scenario?

Geetings Mario

[hslai · Accepted solution]

I think you are asking about this feature -- Login Authentication and Enable Authorization Differentiation.

Given the usernames are the same in RSA and Internal Users, we may have the following:

Authentication Policy
	Enable Password : If TACACS:Service EQUALS Enable Allow Protocols : Default Device Admin   and
		Default use: Internal Users
	Default Rule (if no match) : Allow Protocols : Default Device Admin   and use: RSA

[data-dynamic]

Hello hslai,

Thanks for the answer.

I will test it and report back with the results.

Greeting Mario

[kthiruve]

Mario,

Authorization policy is meant to send suitable privileges for network admins that includes TACACS+ profile and command sets.

In authorization policy you can also verify it the users are part of a certain group as in the case of AD.

Authentication policy is what you need to verify credentials.

If you need to authenticate different TACACS+ service(login vs enable), you can do it as Hsing pointed out above.

Hope it clarifies.

Thanks

Krishnan

[data-dynamic]

Hello Krishnan ,

Thanks for the answer.

Greeting Mario