Palo Alto & Cisco ISE Integration

[Jason Weids]

We are looking for a way to apply our ISE policies to users connecting to our global protect VPN. The objective is to authenticate the user & identify is they are using a trusted device i.e. a domain machine or a device that is a member of an identity group. 

[Surendra]

I believe you are talking about authenticating VPN users using ISE as a RADIUS server and check if the user is an authentic user and also the machine on which he is on. For VPN authentication, ISE will not know the machine from which the VPN is being done on especially when you are using a third party firewall and software as they would simply send a RADIUS request with the credentials that the user enters. Only user can be authenticated and provisioned access accordingly in this case.

[kthiruve · Accepted solution]

ISE is a RADIUS server, you can use this with any product that supports standard RADIUS implementation. That said, you need to make sure for your use case the Palo Alto product supports it. I know with ASA and Anyconnect you can send machine credentials.

https://community.cisco.com/t5/policy-and-access/vpn-machine-authentication/td-p/3200088

If you are trying to do two factor authentication then ASA supports two different way to authenticate users using VPN tunnel groups one of which could be ISE. Please look at offcampus use cases given below.

https://community.cisco.com/t5/security-documents/two-factor-authentication-on-ise-2fa-on-ise/ta-p/3636120

[manvik]

anyone got this working ? PA Globalprotect with ISE posture.

[hp.netwroking@kapitalbank.az]

how its ended for you ?

[manvik]

Globalprotect with ISE posture is not possible. ISE needs anyconnect agent for posturing.

[hp.netwroking@kapitalbank.az]

Yes, I mean Anyconnect used for posture, but laptop can still have a global protect on it, so I wonder if both of them on one laptop worked for you and if you had any problems with it? I personally see posture works incorrectly when Global protect available