MFA for ISE admin access?

[reggie_obos]

Hello guys, is it possible to enable MFA for admin access to the ISE PAN? Im trying to use Ping ID for authentication and then our AD groups for authorization. But when I go to admin groups, it would only refer to  PingID as the source and not the AD. Thanks in advance!

[Aravind Ravichandran]

Hi,
MFA is not supported for ISE login. You can either use AD or ping I'd.

[hslai]

When using RSA or a generic RADIUS token source as the ID source for ISE web admin access, it is external authentication and internal authorization; that is, the authentication is using the RSA or the generic RADIUS token server while the authorization is based on the internal admin groups. The latter is accomplished by our creating a shadow admin user and assign it to the proper internal admin group for admin access. See the screen shot of a sample shadow admin user and the screen capture video of ISE admin web login using Duo MFA/2FA.

iseAdminDuoMFA_2019-10-20.mov

Video Player is loading.

Play Video

Play

Mute

Current Time 0:00

/

Duration 0:00

Loaded: 0%

0:00

Stream Type LIVE

Seek to live, currently behind liveLIVE

Remaining Time -0:00

1x

Playback Rate

Chapters

• Chapters

Descriptions

• descriptions off, selected

Captions

• captions settings, opens captions settings dialog
• captions off, selected

Audio Track

Picture-in-PictureFullscreen

This is a modal window.

Beginning of dialog window. Escape will cancel and close the window.

Text

ColorWhiteBlackRedGreenBlueYellowMagentaCyanTransparencyOpaqueSemi-Transparent

Background

ColorBlackWhiteRedGreenBlueYellowMagentaCyanTransparencyOpaqueSemi-TransparentTransparent

Window

ColorBlackWhiteRedGreenBlueYellowMagentaCyanTransparencyTransparentSemi-TransparentOpaque

Font Size

50%75%100%125%150%175%200%300%400%

Text Edge Style

NoneRaisedDepressedUniformDropshadow

Font Family

Proportional Sans-SerifMonospace Sans-SerifProportional SerifMonospace SerifCasualScriptSmall Caps

Reset restore all settings to the default valuesDone

Close Modal Dialog

End of dialog window.

Close Modal Dialog

This is a modal window. This modal can be closed by pressing the Escape key or activating the close button.

[reggie_obos]

Thank you for the reply! 

What i actually want to do is use AD groups and assign them to the internal admin groups instead of creating individual admin users. When I go to Admin > Admin Access> Admin Groups, select a group (i.e. Super Admin), and select "External", ISE uses the RADIUS token as the identity source. How can i change it to use AD for Authorization?

[hslai · Accepted solution]

Authorization on AD groups is available only when the AD join point selected as the external ID source for ISE admin. See Integrate ISE with MS Active Directory ...

For RSA or a generic RADIUS token server, the only option is to use the internal admin groups for authorizations.

[reggie_obos]

This is helpful. Thank you!

[Steven Williams]

are there instructions how to accomplish this in a step by step manner?

[karunanithi]

Hi 

I have a similar use case for ISE admin access using External RADIUS proxy with Okta Cloud. My request is not getting authenticated. Any steps I am missing I dont know. ISE version is 3.1

Any help ?

[Greg Gibbs]

Here is information on the flow and example ISE configuration with Duo MFA. I suspect you would need to take a similar approach with Okta if you're looking to use a RADIUS proxy flow.
https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/214813-configure-duo-two-factor-authentication.html

The other option would be using SAML, which was introduced as a feature enhancement in ISE 3.1.
https://www.cisco.com/c/en/us/td/docs/security/ise/3-1/admin_guide/b_ise_admin_3_1/b_ISE_admin_31_asset_visibility.html#task_h2d_4rn_znb