Logging into switches using MFA

[carl_townshend]

Hi all

i could do with some advice, we need to use MFA when logging into our Cisco switches. We currently use windows radius.

ive tried setting up duo but cant get it to work, also tried the entra ID plugin on the windows radius server, that also fails

Has anyone in here got this working? Or know the best way to achieve this when logging into our devicrs

cheers

[Mark Elsen]

  - @carl_townshend                  Cisco switches don't support MFA

  M.

[carl_townshend]

Hi

yes I know that, but if you use radius you can get radius to trigger it.

NIST controls say you need MFA on privileged accounts which they are, so we need to find a way to enforce it 

[Mark Elsen]

    - @carl_townshend           Since the switch does not support native MFA it could be handled
                                             by backend authenticating solutions such as mentioned in :
                                             https://www.token2.com/pages/totpradius-mfa-for-ssh-access-to-cisco-switches

                                             I would then call this 'weak MFA' instead of strong native MFA

  M.

[msc1011000]

I would look into ways to secure the login in other ways, my solution would be one of the following:

• Limit line vty access to a VPN subnet and require MFA on VPN login (remember to have a fail-safe in case VPN service breaks)
• Secure a jump host with MFA like DUO or any other MFA provider and limit access from that.
• Configure user RSA public key user authentication and provide authorization through a radius service like ISE depending on group membership.

I've seen no customers do MFA on switch logins - it would also be tedious.

Let us know what you figure out:)

[Flavio Miranda]

@carl_townshend 

 The solution is possible, I use it on daily basis. I believe you should be able to accomplish this with DUO but I am not expert in DUO. I believe we have experts here in the forum. 

 You can try  posting here:

https://community.cisco.com/t5/duo-security/ct-p/duo-security

[mloraditch]

We use radius against NPS with the entra MFA plugin perfectly well. Our switches that still have this are 2960Xs and only have one interface so it's a pretty simple config. We have found that on some things we have to increase the radius timeout depending on the latency from device to the server.

What are your IOS or NPS logs saying when you try to authenticate? Are you sending the Cisco-AV-Pair attribute back to the switches?

[carl_townshend]

Hi, yes we send the AV pair back to the switches with the priv command on it for authorization.
What were the steps you took to get it working on NPS? our NPS currently works with normal radius, is it a case of just installing the entra nps extension ?

what happens when you login to a switch? I assume you put in your password and at that point it sends you a push to your authenticator app?

[mloraditch]

Yes you just install the extension and yes you get a push prompt when trying to authenticate.

[carl_townshend]

Hi

we have it working now, however the authorisation isn’t working, it should give priv level 15, it’s like the radius isn’t passing the av pair now. Did you get this working ?

[Mark Elsen]

  - @carl_townshend                 It depends on the scheme that you actually implemented in the end , I would
                                                 assume that if the radius server has to take additional steps in between for MFA
                                                 that the av pair info's could get lost

  M.

[carl_townshend]

What are our alternatives if they do get lost?

[Mark Elsen]

    - @carl_townshend       I don't see a way forward , because it is essentially a capability of the switch (MFA) or
                                         it should be. If you get these requirements from an official organization then create
                                         a TAC case at Cisco and ask 'their opinion'    on your MFA-requirements

  M.

[msc1011000]

Are you actually using the lower privilege levels for anything?

If not, you can just set the default privilege level to 15 and get straight to privileged exec mode by entered 'privilege level 15' under line vty.

Either that, or set an enable secret that everybody has to enter to get priv lvl 15.

You can enter 'debug radius ' during login to see if the attribute is received by the switch.

Was authorization working before you implemented MFA? 

[mloraditch]

Yes this works fine for us.