can we use single DUO MFA local Proxy Server for ISE, ASA and Firepower same time ?

[hashimwajid1]

Hi Friends,

i've query regarding DUO MFA local Proxy server. we want to integrate ISE, ASA and Firepower with DUO MFA. as per Method mention in Documentation, we should Install Local Proxy server for these. 

my question is do i've to install separate proxy server for Each Device or only Single Proxy Server will be sufficient ?

Thanks

[Rob Ingram · Accepted solution]

Hi,

You could configure DUO Proxy as an External RADIUS Proxy server within ISE. Configure the ASA and Firepower devices to use ISE as the RADIUS servers, in the ISE authentication rules use the DUO External RADIUS Proxy to authenticate the users. You would only need 1 DUO Proxy Server, unless you add another for redundancy. You wouldn't need a dedicated DUO proxy for each device.

HTH

[hashimwajid1]

Dear RJI,

Thnaks for your Reply, I've below query

we want to Integrate DUO MFA for Below

1- DUO Integration with ISE (Local Proxy Server Required)

3- DUO Integration with CyberArK for PAM (Local Proxy Server Required)

all above mentione Devices required Local Proxy Server installation. I've 2 Queries 

1- can we use single DUO local Authentication Proxy Server for ISE/CyberArk (any other Product which need Authentication Proxy server) or should we insatll separate, separete Proxy Servere for each Device ?

2- in case if we configure 2 x Authentication Proxy for High Availablity then do we need any Load Balancer for HA or can we achieve high availbility without external load Balancer ?

many Thanks for your reply  

[Rob Ingram · Accepted solution]

You could use the same authentication proxy for ISE/Cyberark

You can use a load balancer if you have one, as referenced here. However if you are proxying the request through ISE, you can specify 2 DUO authentication proxies and ISE would failover to the second if the first fails - so no need for load balancer. It depends if you want to active/active load balancing between the 2 servers.

[hashimwajid1]

Does it mean in case of CyberArk/PaloAlto/any non Cisco product I need external load balancer for Active/Active or Active/Standby for HA but for ISE I only need load balancer in case Active/Active ? If I want Active/Standby the no load balancer required ? 

[Rob Ingram]

I was suggesting configuring whatever device ASA, Firepower etc to use RADIUS authentication with ISE as the authentication server, this would proxy the authentication request to DUO. You can define 2 DUO proxies within ISE without a load balancer, this would be Active/Standby. DUO document recommends using a load balancer for Active/Active, thus avoiding one server taking the entire load. Ultimately it would depend on your scenario and how much load you would likely put on the DUO proxy.