Hi
Just checking if my use case is possible.
I want to use ISE to handle an authentication request so that a user at my customer will go to a web page (presumably provided by ISE) to put in his/her credentials and get authenticated. Then, their status is evaluated in a firepower threat defense firewall ACL - if they are authenticated, they will be allowed through the firewall onto the customers process control network (PCN). These users can be defined in AD or in ISE or LDAP (they'd prefer ISE, so they have control over how users are created). I am unsure of how we can provide usernames back to FMC so that they can be listed in ACLs. Normally, FMC expects AD or LDAP - does ISE present itself in this way?
Customer's use case is to not put AnyConnect on the client. Although they do have AnyConnect, they cannot enforce it's usage to the contractors and 3rd party vendors who need access to the PCN. The way their solution works today is that the user signs in to a web page and that mapping of IP<->Username is then evaluated in their Juniper firewalls. They would prefer if we could just emulate the way their user community does this today.
We can communicate to RSA either though RADIUS or SDI protocol. for our POC, we currently have a RADIUS connection.
thx Dominic
Message was edited by: Krishnan Thiruvengadam
Dominic,
This is a public site. So please refrain from using Customer name, Cisco ID, phone number and your personal information going forward.
I have removed the customer name reference from the post above.
Thanks
Krishnan
