Imprivata as a RADIUS token server in ISE

[Ciscorocks]

Does anyone have documentation or a configuration guide on the integration of ISE and Imprivata for 2FA auth for SSLVPN?

[balaji.bandi]

as per I know Imprivata  its self an identity used in the medical field.

SSLVPN client connects to the remote access Server using ISE in the normal situation, where is the Imprivata device in the network?

now sure what the requirement is here, can you explain more?

[Ciscorocks]

I was wondering if there is a guide for setting up imprivata as a token server and using it as an external identity source in ISE. I found quite a bit of documentation for the set up with DUO but not imprivata. I’m assuming its about the same.

User connects to ssl vpn, FTDs send requests to ISE, ISE queries imprivata, and then Active Directory, push notification is sent to users phone and the user accepts the push and a radius accept is sent to imprivata to ISE to the FTD.

[balaji.bandi]

You need to test this, since ISE does everything what you looking to do, so most of them don't have any other identity requirement, 

check this ISE can be configured external authentication source :

https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/213239-configure-external-radius-servers-on-ise.html

[Ali Farooqi]

Anyone made it work? As far as i know Imprivata can do SAML but cannot be configured as external radius server in ISE.

[Greg Gibbs · Accepted solution]

I'm not familiar with Imprivata, but if it only supports SAML you will likely need to do the Authentication directly from the VPN headend (ASA, FTD, etc) then use ISE for Authorization only. This is the same flow that is used for SAML using AzureAD + MFA.