Substituting Okta for RSA

[fitzie]

We currently use ISE to process access requests from Global Protect users.  The remote GP VPN users are currently using RSA via RADIUS.  Works fine, so of course they want to change it up such that ISE forwards to Okta instead of RSA.  Both Okta and RSA already talk to our AD environment, so I think it's mostly a matter of creating a new External Identity Source in ISE, and updating the specific Policy Set to use this new source.

I've not configured ISE with SAML before, and was hoping to find somebody who has been down this road.

[Greg Gibbs]

SAML IdP can only be used for specific portal-based flows in ISE. See the Admin Guide for more info.

If you need to use SAML for VPN + MFA, you would likely need to move to a different flow where the VPN headend (ASA/FTD) performs the Authentication directly against Okta using SAML and then hands off to ISE to perform Authorization only.

VPN headend <-> Okta SAML authC -> ISE AuthZ only

Example ASA + Okta SAML config:
https://saml-doc.okta.com/SAML_Docs/How-to-Configure-SAML-2.0-for-Cisco-ASA-VPN.html

Example ASA RADIUS server config for ISE Authorization only:

aaa-server ISE_RAD protocol radius
 authorize-only
 interim-accounting-update
 dynamic-authorization