Hello,
I need to incorporate two factor authentication to our current VPN AnyConnect/ASA/ISE environment. Currently, users are able to authenticate using AD or RSA credentials, however, I need to force certain users based on AD groups to ONLY authenticate using RSA, and be denied service if they try to use their AD passwords... Without needing to add another internet facing ASA.
I am trying to use ISE with two external identity sources (Active Directory and RSA SecurID servers) for VPN AnyConnect access through an ASA. If users are members of specific AD groups they need to be forced to authenticate using their tokens to the RSA server through ISE. However, in every configuration I try the users are also able to enter their AD passwords and still authenticate. I need an authorization rule that says, "if users in AD group XYZ authenticate with AD credentials, then deny access, but allow access if they authenticate to RSA". But that does not seem to be an option with external identity sources, only local identity groups.
Is there a way to do this with ISE? I can't seem to find it.
Thank you in advance for any help.
