Enable certificate authentication for NPS on ASA

[HuntLee304798]

Hi Cisco gurus,

For our AnyConnect VPN, I would like to enable certificate authentication for Microsoft Network Policy Server (NPS) with Cisco ASA.

I have tested and can get username/password auth with NPS, however I want to use certificate auth with NPS.  Is this supported by Cisco ASA? If so, anyone can point me to some sample config on ASA + NPS of what I need to setup?

Cheers,

Hunt

[Mohammed al Baqari]

Hi,

If you are referring to anyconnect client authentication using certificate
instead of username/password, yes this is supported. The authentication
will be verified by the CA server (not the NPS). NPS can be used for
authorization and download attributes after successful authentication.

https://community.cisco.com/t5/security-blogs/anyconnect-certificate-based-authentication/ba-p/3105546

**** please remember to rate useful posts

[HuntLee304798]

So NPS cannot be used for certificate authentication? Only for authorization?

[Aref Alsouqi]

It can, but the certificates management in itself can't be done by the NPS services themselves, for that you need to rely on a CA. NPS can accept EAP-TLS requests, and check the validity of the certificates presented by the clients, if it is valid, will carry on checking the authentication and authorization policies, but I don't believe it can do more in terms of certificate authentication.

[HuntLee304798]

Hi Aref,

In ASDM, i can see that there are six (6) options for authentication.  Which one should I choose so that the ASA will send EAP-TLS requests to Microsoft NPS?

1. AAA
2. AAA and Certificate
3. Certificate Only
4. SAML
5. Multiple Certificate and AAA
6. Multiple Certificate

Cheers,

Hunt

[Aref Alsouqi]

Reading again this thread, I think if you use certificate authentication that would be terminated on the ASA and possibly checked against the certificate revocation check through the CA, so your RADIUS server would never be aware about it. What you can try to do is to enable AAA and Certificate, that would allow the users to authenticate by typing their username and password connected to the AD through the RADIUS server, and also through certificate that will be terminated on the ASA.

[HuntLee304798]

Hi Aref,

I do not want to use username/password auth as these are for my remote mobile users.  Hence why I want to use certificate to authenticate.

Cheers,

Hunt

[Aref Alsouqi]

Then you can just select certificate only as the authentication method.

[HuntLee304798]

Hi Aref,

I tried that option before.  The ASA will authenticate the user based on their certificate, which is great!  Unfortunately, it does not pass the auth request to NPS.

Cheers,

Hunt

[Aref Alsouqi]

I don't believe there is a way to allow the ASA to pass the certificate authentication request to the RADIUS server. Even when using ISE, that will still be the case. I think the reason behind this is because in this case the ASA terminates the certificate authentication on itself, so it does not relay it anywhere. Also, as long as you configure the certificate revocation check via the CA, you don't really need to relay the certificate authentication. The ASA will accept the authentication requests only from the clients that have a certificate issued by the trusted CA configured on the ASA for authentication, then, the ASA would check against the CA to ensure the presented certificate is valid. Only if both these checks pass, the authentication is successful.

[Aref Alsouqi]

NPS in itself is a RADIUS server, it can't provide certificate authentication services, however, I think you can configure the NPS to accept EAP-TLS requests, but you still need a CA server to act as the PKI authority. From the ASA perspective, in addition to the AnyConnect configuration, you need to create the trust point that will be used for authentication.