12-06-2019 09:01 AM
Hi Friends,
i've query regarding DUO MFA local Proxy server. we want to integrate ISE, ASA and Firepower with DUO MFA. as per Method mention in Documentation, we should Install Local Proxy server for these.
my question is do i've to install separate proxy server for Each Device or only Single Proxy Server will be sufficient ?
Thanks
Solved! Go to Solution.
12-06-2019 10:53 AM
Hi,
You could configure DUO Proxy as an External RADIUS Proxy server within ISE. Configure the ASA and Firepower devices to use ISE as the RADIUS servers, in the ISE authentication rules use the DUO External RADIUS Proxy to authenticate the users. You would only need 1 DUO Proxy Server, unless you add another for redundancy. You wouldn't need a dedicated DUO proxy for each device.
HTH
12-06-2019 12:43 PM
You could use the same authentication proxy for ISE/Cyberark
You can use a load balancer if you have one, as referenced here. However if you are proxying the request through ISE, you can specify 2 DUO authentication proxies and ISE would failover to the second if the first fails - so no need for load balancer. It depends if you want to active/active load balancing between the 2 servers.
12-06-2019 10:53 AM
Hi,
You could configure DUO Proxy as an External RADIUS Proxy server within ISE. Configure the ASA and Firepower devices to use ISE as the RADIUS servers, in the ISE authentication rules use the DUO External RADIUS Proxy to authenticate the users. You would only need 1 DUO Proxy Server, unless you add another for redundancy. You wouldn't need a dedicated DUO proxy for each device.
HTH
12-06-2019 12:30 PM
Dear RJI,
Thnaks for your Reply, I've below query
we want to Integrate DUO MFA for Below
1- DUO Integration with ISE (Local Proxy Server Required)
3- DUO Integration with CyberArK for PAM (Local Proxy Server Required)
all above mentione Devices required Local Proxy Server installation. I've 2 Queries
1- can we use single DUO local Authentication Proxy Server for ISE/CyberArk (any other Product which need Authentication Proxy server) or should we insatll separate, separete Proxy Servere for each Device ?
2- in case if we configure 2 x Authentication Proxy for High Availablity then do we need any Load Balancer for HA or can we achieve high availbility without external load Balancer ?
many Thanks for your reply
12-06-2019 12:43 PM
You could use the same authentication proxy for ISE/Cyberark
You can use a load balancer if you have one, as referenced here. However if you are proxying the request through ISE, you can specify 2 DUO authentication proxies and ISE would failover to the second if the first fails - so no need for load balancer. It depends if you want to active/active load balancing between the 2 servers.
12-06-2019 01:25 PM
Does it mean in case of CyberArk/PaloAlto/any non Cisco product I need external load balancer for Active/Active or Active/Standby for HA but for ISE I only need load balancer in case Active/Active ? If I want Active/Standby the no load balancer required ?
12-06-2019 01:33 PM
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide