Multifactor authentication with ISE and Free RADIUS with Google authenticator

[Tibor Bajnok]

Hi All,

Our current deployment is: authenticate AnyConnenct users using ISE local accounts and ISE as authorization server sending dACL to Firepower (according to user group):

AnyConnect  ->  Firepower  ->  ISE  -> dACL ->  Firepower

We tried to build Multifactor Authentication with Free RADIUS (with Google authenticator – RFC2865 compliant) as external RADIUS server of ISE. The MFA is successfull as shown below:

AnyConnect  ->  Firepower  ->  ISE  ->  Free RADIUS

                                                              separate username, password and 6 digits PIN

                                                              check 6 digits PIN

                                                              ask back to ISE for user password

                                                              ISE answer: password OK

                ISE  <-  Access-Accept   <-  Free RADIUS

Our problem is that, though multifactor authentication is successful, ISE did not send any dACL to Firepower.

Does Anyone have any experience in this? Is it possible to keep the above scenario and make ISE send dACL to Firepower?

Thank in advance

Tibor

[M. Wisely]

In your radius server sequence, have you enabled 'On Access-Accept, continue to Authorization Policy' on the advanced tab?

[Tibor Bajnok]

Thank you for your idea. We tried it but as turned out our policy has some weakness. We have to rearrange things.

[paul]

I am sure the continue to authorization option will work, but a cleaner approach in my opinion if you don't need any special AV pairs back from free RADIUS is to define the free RADIUS servers as RADIUS token servers in ISE.  Doing this treats the RADIUS servers just like any other external identity source and your policy sets all work the same. 

[Tibor Bajnok]

Authentication is also successful when Radius acts as Token server, but after authentication ISE needs Group-ID to determine the necessary dACL. ISE waits it from Radius but Radius is not aware of it plus it should be sent via AV pair. ISE does not want to use its own Group-ID for authorization.

[paul]

Are these users also in AD?  I usually don't use any attributes coming back from the token server.  I just want it to run the MFA process and give me a yes/no.  Then in the authorization phase you can do all the AD group checks you want to assign the correct DACL.  I like having the AD group checking and control in ISE so everything is apparent.