[ISE] Anyconnect user authentication with RSA, authorization with ISE local groups

[Bob Goal]

Hi Community,

I'm trying to configure Anyconnect 4.3 vpn access with ASA 9.6 with ISE 2.1 with RSA SecureId.

Desired flow: user establishes Anyconnect session with ASA. ASA uses RADIUS to communicate with ISE. ISE uses RSA SecurieID to check the passcode (authentication) and internal user database to verify user group and push appropriate attributes(authorization).

AuthC:

AuthZ:

The issue is that when I use SecureID at authentication phase, I must use it also in authorization. So my rules to match local for ISE user group does not match in authorization and I can't push policy to the user.

In Cisco ACS there is possible to create Identity Source Sequences to use one one search list for AuthC and other for AuthZ, it works fine:

In ISE there is option only for AuthC:

My final question: How to configure user authentication with SecureID Passcode and use local ISE groups for authorization?

[Bob Goal · Accepted solution]

I found a solution. You need to set "Password Type" on "RSA SecureID" for particular local user under: Administration > Identity Management > Identities > user like below:

[nspasov]

Good job on finding a solution to your own problem/question! Also, thank you for taking the time to come back and post it here!

Neno

[mj6833]

Was there a specific guide you used to setup ISE, ASA, and AnyConnect.  I'm working on the same thing you setup, but from scratch.   AnyConnect to ASA, ASA via RADIUS to ISE and ISE passing authentication to RSA.  Any link or document you have would be appreciated.

Thanks

[claudioparker]

I have same issue, authentication is OK, but authorization failed because the user not found in identity store, any workaround for this?