Watchguard Firebox integrate with ISE (Radius)

[PatricioMansilla47964]

Hi everyone,

I'm looking for info about how to integrate vpn users of Watchguard Firebox to ISE, i tried to find out documentation about it but nothing relevant.

anyone could you help me?

Thanks.

[Francesco Molino · Accepted solution]

Hi

I believe you want to authenticate your users against ISE and that’s it?
If so, there’s nothing much to do. Your Watchguard has to be declared as a simple NAD and ISE with a standard policy-set (as if it was any other device like Cisco).
Is it what you’re looking for? If not, can you please detail the integration you’re looking for. I don’t think watchguard has any more possible integration but you can look at Cisco ise 3rd party compatibility matrix or ask watchguard directly.

[PatricioMansilla47964]

Hi Francesco,

Thank you for you help, at least now the watchguard vpn client (Firebox) is authenticating on ISE, this is my first step, but now i want to make a posture assessment (i need to implemente compliance measures), i don't now if that is possible or only available for anyconnect?

Thanks in advance.

Regards.

Patricio

[Francesco Molino]

For posture over VPN you'll need to have anyconnect and so a Cisco firewall. On this client, you will need to deploy the posture module.
Another solution I like more is to use a software like Rapid7, Tenable,.. you can integrate to ise and right after an authentication, ISE will trigger a scan of the machine to get a cvss score (could be with or without an agent installed on the machine). Based on this score you can trigger a push of acl, deny access... but this will be possible if your whatchguard supports any radius attribute like that.