Cisco AnyConnect TWO-factor authentication with Cisco ISE (AD + One Time Password)

[rashish135@yahoo.co.in]

I required help to configure Cisco Any connect VPN two factor authentication with ISE. ISE have to authenticate users with Domain credentials as primary and One time Password (OTP) which ISE needs to send extracting phone information from AD.

Basically when user try to connect Cisco AnyConnect, ASA will ask radius authentication to ISE 2.2. ISE will verify the login credentials to domain controller and once user authentication pass, it should prompt for OTP as second factor authentication at the same time ISE have to send SMS to user mobile number which it can extract from domain controller.

Requesting you to help on implementing this solution.

Regards

Ashish Shah

[Francesco Molino]

Hi

What you're requesting is having ISE as otp server right?

Right now, there's no such option, no OTP generator.

You need to have an OTP server linked with ISE as external radius server.

This OTP will check with ISE for credentials verification and will request an otp.

You have paid solution like duo security or free solution like freeradius with Google auth

[rashish135@yahoo.co.in]

Hi

Thanks for the reply.

I am bit confused. Basically then how, ISE sends SMS for Guest portal.

We have OTP server as well, so how to set up Cisco ISE authentication policy for two factor authentication? 

[Francesco Molino]

ISE is capable in sending SMS using a SMS gateway for a fix message for guest authentication but doesn't have any OTP generator available for radius authentication.

What's your internal OTP server?
You authentication policy should be validated through an external radius that'll be your OTP server.

[rashish135@yahoo.co.in]

Hi

We have some third party OTP server with Windows Radius which we will be using now as an authentication server. So not involving ISE at all in authentication process.

Will there any configuration required related to 2 factor authentication on Cisco ASA? Currently i will be planning to do following tunnel-group configuration.

tunnel-group AnyConnect-Test type remote-access
tunnel-group AnyConnect-Test general-attributes
authentication-server-group RADIUS
default-group-policy AnyConnect
tunnel-group AnyConnect-Test webvpn-attributes
group-url https://test.xyz.com/Remote-VPN enable

Regards

Ashish Shah

[Francesco Molino]

Nothing to do on ASA, except the radius server for authentication that seems it has been already done.