CISCO ASA Two Factor Authentication configuration (NON-VPN)

[Abhijit Chakraborty]

Hello All Experts out here, hope you are having a good time and can spare some time to help me.

I have a requirement where I need to leverage two factor authentication for accessing servers behind a DMZ. I have searched a lot of sites but they all talk about how it can be done with a VPN session but I want 2FA for regular traffic from host residing in the Inside zone of the firewall to the servers in the DMZ zone.

The first factor is username password that will be using the LDAP server located on the Inside zone of the firewall.

The second factor is the One Time Safenet Token and the safenet server resides in the internet on the Outside zone of the firewall.

I have got below link which solves only part of the requirement
http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/113363-asa-cut-through-config-00.html

Can any of you please assist/ guide me to meet the requirement. A call with CISCO TAC did not help me :(

[Marvin Rhoads · Accepted solution]

When the ASA is acting as an authentication proxy (like in the document you mentioned) it only supports a single factor authentication in that respect.

You could make access to the DMZ require VPN even for internal clients. I have seen customer do this in a university setting where they segment staff-only resources from students.

Or you could implement 2FA on the servers themselves.

[Abhijit Chakraborty]

Hi Marvin, I am a fan of your posts and it is great to see your response here. Thank you.

We want to avoid 2FA on the servers as it will increase the overhead of managing them.

When you suggest VPN, are you suggesting a clientless VPN configuration here?

I have come to know the requirement I am talking about can be achieved with a checkpoint device without VPN configuration. So I thought CISCO ASA will also have a similar feature as well.

[Marvin Rhoads]

I wasn't specifically thinking client-based or clientless VPN.

But 2FA is supported for Cisco ASA VPNs. It is not an available feature for authentication proxy.

There will always be one feature or another that a given vendor has vs. another. It's up to you to decide whether that single feature is worth changing firewall vendors.