Hey guys, I just got done writing a couple of documents on the community and it seriously took me 30 min to figure out how to edit and publish them. In fact, I had to do a google search to find a thread that was instructing me to hit the "options" button. Even then, it took me a few minutes to locate it :) We really need an "edit" button somewhere next to the document or even next to the "comment" button (if you are the owner/author) ... View more

Overview: In this setup, ISE will forward the TACACS+ authentication requests to the Duo Authentication proxy. The proxy will check AD and if the authentication is successful, the end user/admin will be send a "Duo Push." If the AD authentication fails, then the process will stop and no "Duo Push" will occur. Note: For integration with Duo, ISE and local (ISE) datastore, please visit the following link: https://community.cisco.com/t5/security-documents/draft-duo-mfa-integration-with-ise-for-tacacs-device/ta-p/3882063 Detailed Steps: Admin user initiates a shell connection to a network device where he/she uses Active Directory based credentials Network device forwards the request to the TACACS+ server (ISE) ISE sends the authentication request to Duo's Authentication Proxy The proxy forwards the request to Active Directory for the 1st factor  authentication Active Directory informs the Authentication Proxy if the authentication was successful Upon successful AD authentication, the Authentication Proxy sends an authentication request to Duo cloud for 2nd factor authentication Duo cloud sends a "push" to the admin user Admin user "approves" the "push" Duo informs the Authentication Proxy of the successful push Authentication proxy informs ISE of a successful Authentication ISE Authorizes the admin user Assumptions: You have good/solid understanding of AAA concepts and configurations Your network access devices (Routers, Switches, Firewalls, etc) are already configured for AAA (TACACS+) with ISE The ISE deployment is already integrated with Active Directory The ISE deployment is properly licensed Components Used: Active Directory running on Microsoft Server 2016 Cisco ISE running on version 2.6 - patch-1 Duo Authentication Proxy version 3.0.0 running on Windows 10 and Ubuntu 18 Step-1 - Duo System Configuration Login to your Duo account and click on "Applications" Search for "RADIUS" and click "Protect This Application" In a notepad copy and paste your Integration Key, Secret Key and API Hostname Step-2 - Download, Install and Configure Duo's Authentication Proxy Download the latest Duo Authentication Proxy from this URL: https://duo.com/docs/authproxy-reference Install the authentication proxy on your Windows or Linux machine (Installation Instructions are available in the link above). In this example, I have installed the primary Authentication Proxy on a Windows 10 machine while the secondary was installed on Ubuntu Configure the proxy by editing the  authproxy.cfg file: [ad_client] host=1.2.3.4 >>> IP Address of Primary AD Server host_2=4.3.2.1 >>> IP Address of Secondary AD Server service_account_username=duoservice >>> AD Service Account service_account_password=password1 >>> AD Service Account Password search_dn=DC=example,DC=com >>> AD Base information ! [radius_server_auto] ikey=xxxxxxxxxxxxxx >>> Your integration key (Step-1) skey=xxxxxxxxxxxxxx >>> Same as above api_host=xxxxxxxxxxxxxx >>> Same as above radius_ip_1=10.1.1.1 >>> IP address of primary ISE PSN radius_secret_1=xxxx >>> AAA secret radius_ip_2=10.1.1.2 >>> IP address of secondary ISE PSN radius_secret_2=xxxx >>> AAA secret failmode=safe client=ad_client >>> Instructs the proxy to use AD for 1st factor authentication port=1812 >>> RADIUS Port Start the proxy server(s) and check the proxy logs for any configuration/connectivity errors: Note: In Windows installations, make sure that the Windows Firewall is configured to allow connections for the authentication proxy: Step-3-Configuring ISE: Add Duo's Authentication Proxies Go to Administration > Identity Management > External Identity Sources > RADIUS Token > Click Add Give it a name Under the "Connection" tab, add the information from the Duo Primary and Secondary (If applicable) Authentication Proxies Make sure that the "Shared Secret" matches what you defined in Step-2 Change the "Server Timeout" to a value of 30 seconds or greater in order to avoid RADIUS timeouts Click "Save" Create Identity Source Sequence While on the same page, click on "Identity Source Sequences" and then click "Add" Give it a name Add the newly created RADIUS Token Server and your AD-Joint point to the "Selected" column in the "Authentication Search List" Click "Save" Create Device Admin Policies Navigate to "Work Centers > Device Administration > Device Admin Policy Sets" In this example, I have created a Policy Set that matches on both protocols (RADIUS and TACACS+) with the "Allowed Protocols" set to "Default Device Admin" Inside my policy set, I have the following policies: Authentication: Default rule set to check the "Identity Source Sequence" that we defined in the steps above which contains the RADIUS Token Servers ( Duo Authentication Proxies) and Active Directory: Authorization: Here I have a rule that checks if the authenticated user belongs either the "Domain Users" or "NS-ISE-IOS-Admins" groups that I have configured in AD. If the user belongs to one of these groups then I am returning back my pre-configured "Command Sets" and "Shell Profile."   Step-4-Add and onboard users in Duo Here you can configure Duo automatically sync with your Active Directory. However, this is out of scope for this document and the process that I am showing here is for manual creation of the user In the Duo console go to "Users > Add Users" The username here must match the username that exist in your Active Directory. In my example here, I am working with the username of "nspasov" After the user is added, you need to enroll the user with Duo . For more information on that you can reference Duo's documentation: https://duo.com/docs/enrolling-users Step-5-Testing Initiate connection (ssh or telnet) from a network device that is already added in ISE Use the AD credentials for the admin user Upon successful authentication, confirm that the user received a Duo Push After approving the Duo Push, the admin user should be now authenticated and authorized Your TACACS+ live logs in ISE should show Authentication requests against the Duo Authentication Proxies You can check the "authproxy" log file in your Authentication Proxy for any errors/issues   ... View more

Overview: In this setup, ISE will forward the TACACS+ authentication requests to the Duo Authentication proxy. The proxy will then punt the requests back to ISE for local user authentication. This can be a little bit confusing but it is necessary for organizations that want to utilize the local user database on ISE and not relay on external identity sources such as Active Directory, LDAP, etc. If the authentication is successful, the end user/admin will be send a "DUO Push." If the local ISE authentication fails, then the process will stop and no "Duo Push" will occur. Note: For integration with Duo, ISE and Active Directory, please visit the following link: https://community.cisco.com/t5/security-documents/duo-mfa-integration-with-ise-for-tacacs-device-administration/ta-p/3881767 Detailed Steps: Admin user initiates a shell connection to a network device where he/she uses Active Directory based credentials Network device forwards the request to the TACACS+ server (ISE) ISE sends the authentication request to Duo's Authentication Proxy The proxy forwards the request back to ISE for the 1st factor  authentication ISE informs the Authentication Proxy if the local authentication was successful Upon successful ISE authentication, the Authentication Proxy sends an authentication request to Duo cloud for 2nd factor authentication Duo cloud sends a "push" to the admin user Admin user "approves" the "push" Duo informs the Authentication Proxy of the successful push Authentication proxy informs ISE of a successful Authentication ISE Authorizes the admin user Assumptions: You have good/solid understanding of AAA concepts and configurations Your network access devices (Routers, Switches, Firewalls, etc) are already configured for AAA (TACACS+) with ISE The ISE deployment is properly licensed Components Used: Cisco ISE running on version 2.6 - patch-1 Duo Authentication Proxy version 3.0.0 running on Windows 10 and Ubuntu 18 Step-1 - Duo System Configuration Login to your Duo account and click on "Applications" Search for "RADIUS" and click "Protect This Application" In a notepad copy and paste your Integration Key, Secret Key and API Hostname Step-2 - Download, Install and Configure Duo's Authentication Proxy Download the latest Duo Authentication Proxy from this URL: https://duo.com/docs/authproxy-reference Install the authentication proxy on your Windows or Linux machine (Installation Instructions are available in the link above). In this example, I have installed the primary Authentication Proxy on a Windows 10 machine while the secondary was installed on Ubuntu Configure the proxy by editing the  authproxy.cfg file: [radius_client] host=1.2.3.4 >>> IP Address of Primary ISE PSN host_2=4.3.2.1 >>> IP Address of Secondary ISE PSN secret=xxxxxxxxxxxxx >>> AAA Secret (Needed later in ISE) ! [radius_server_auto] ikey=xxxxxxxxxxxxxx >>> Your integration key (Step-1) skey=xxxxxxxxxxxxxx >>> Same as above api_host=xxxxxxxxxxxxxx >>> Same as above radius_ip_1=10.1.1.1 >>> IP address of primary ISE PSN radius_secret_1=xxxx >>> AAA secret radius_ip_2=10.1.1.2 >>> IP address of secondary ISE PSN radius_secret_2=xxxx >>> AAA secret failmode=safe client=radius_client >>> Instructs the proxy to use ISE for 1st factor authentication port=1812 >>> RADIUS Port Start the proxy server(s) and check the proxy logs for any configuration/connectivity errors: Note:   In Windows installations, make sure that the Windows Firewall is configured to allow connections for the authentication proxy: Step-3-Configuring ISE: Create Admin Group and Admin User in ISE Create a local admin group by going to "Administration > Identity Management > Groups > User Identity Groups" and clicking the "Add" button. In my example, I have created a group called "NS-Network-Admins" Create a local admin user by going to "Administration > Identity Management > Identities > Users" and clicking the "Add" button. Make sure that you assign the user to the local ISE group that you created in the previous step. In my example, I have created a group called "nspasov" and have associated the user to the group that I created in the previous step called "NS-Network-Admins" Add Duo's Authentication Proxies as RADIUS Token Servers Go to   Administration > Identity Management > External Identity Sources > RADIUS Token > Click Add Give it a name Under the "Connection" tab, add the information from the Duo Primary and Secondary (If applicable) Authentication Proxies Make sure that the "Shared Secret" matches what you defined in   Step-2 Change the "Server Timeout" to a value of 30 seconds or greater in order to avoid RADIUS timeouts Click "Save" Create Identity Source Sequence While on the same page, click on "Identity Source Sequences" and then click "Add" Give it a name Add the newly created   RADIUS Token Server   and your   Internal Users   to the "Selected" column in the "Authentication Search List" Click "Save" Create Device Admin Policies Navigate to   "Work Centers > Device Administration > Device Admin Policy Sets" In this example, I have created a Policy Set that matches on both protocols (RADIUS and TACACS+) with the   "Allowed Protocols"set to   "Default Device Admin" Inside my policy set, I have the following policies: Authentication: Default rule set to check the "Identity Source Sequence" that we defined in the steps above which contains the RADIUS Token Servers (Duo Authentication Proxies) and the local ISE user database: Authorization: Here I have a rule that checks if the authenticated user belongs to the "NS-Network-Admins" group that we created earlier in ISE. If the user belongs to the group then I am returning back my pre-configured "Command Sets" and "Shell Profile." Add Duo's Authentication Proxies as Network Access Devices This step is required since the Authentication Proxies will punt the authentication requests back to ISE Go to "Work Centers > Device Administration > Network Resources > Network Devices" then click "Add"  Give the device a name Enter the IP Address of your Authentication Proxy Give the device to a "Type". In my example, I created a "Type of Device" called "NS-DUO-Proxy" Check the box for "RADIUS Authentication Settings" Enter the shared secret that you configured in your proxy during Step-2 Repeat the above process if you are using more than one Authentication Proxy Create a RADIUS Policy Set Again, this step is required since the Authentication Proxies are punting the authentication requests back to ISE. Thus, we will see RADIUS based authentications coming from Duo's Authentication Proxies and if we do not configure this, the requests will be dropped Go to "Policy > Policy Sets" and add a new Policy Set Here you want to make sure the conditions that you set are specific enough so this rule does not get hit/matched by other services/authentication methods In my example, I created a Policy Set called "NS-DUO-Proxy-Auth" where I am looking to match on two things: The Network Device Type must be "NS-DUO-Proxy" (I created this earlier when adding Duo's Authentication Proxies as Network Devices) The Protocol used must be RADIUS For "Allowed Protocols" I have used the "Default Network Access" In the Policy Set I have the following policies: Authentication: Default rule set to utilize the "Internal Users" identity store Authorization: Here I have a rule that would authorize users as long as they belong to the "NS-Network-Admins" group that I created in the steps above. If the user is part of the group then I am returning a simple "PerimitAccess" Authorization Profile (If you are using RADIUS based device administration, you can return different Authorization Profiles that match your requirements). Step-4-Add and onboard users in Duo In the Duo console go to "Users > Add Users" The username here   must   match the username that you configured in the ISE Identity Store in the previous steps. In my example here, I am working with the username of "nspasov" After the user is added, you need to enroll the user with Duo. For more information on that you can reference Duo's documentation: https://duo.com/docs/enrolling-users Step-5-Testing Initiate connection (ssh   or   telnet) from a network device that is already added in ISE Enter the username and password for the local admin user that you created in ISE. In my example, this is "nspasov" Upon successful authentication, confirm that the user received a   Duo Push After approving the   Duo Push, the admin user should be now   authenticated   and   authorized Your TACACS+ live logs in ISE should show Authentication requests against the Duo Authentication Proxies Your RADIUS live logs in ISE should show Authentication requests against ISE's local user data store. These requests should be sourced from Duo's Authentication Proxies You can check the "authproxy" log file in your Authentication Proxy for any errors/issues ... View more