ASA and RSA Securid and TMG

[markcervantes]

Not sure it it's even possible, have never used ASA. We have been tasked with implementing multifactor authentication.  Our plan is to use an ASA vpn with RSA. But our current VPN access is with TMG servers that are configured with their own access permissions. Is it possible to setup a anyconnect vpn connection integrated with RSA SecureID and then create a Microsoft pptp vpn connection to the TMG server in order to use its access rules? If it is possible please send me any reference docs.

[Jonatan Jonasson]

Regarding AnyConnect and RSA SecurID integration, yes that is possible and you can use either the SDI protocol or RADIUS between ASA & the SecurID AM.

There are implementation guides availabe from RSA (https://community.rsa.com/docs/DOC-62877 for example) and a number of posts on the Cisco community forums on the subject. This is usually pretty straightforward.

I'm not sure if you can then run Microsoft PPTP to the TMG gateway within the AnyConnect VPN connection.

However, considering additional packet overhead, complexity and I understand that the TMG is end of life, I would suggest that you would look at ways to redesign this remote-access scenario so you would not need multiple VPN solutions on top of each other.