Cisco ASA VPN and CIsco ISE Smart Card Authentication (Certificate Only)

[Johannes2110]

Hi all,

So I have Cisco ASA as VPN gateway and using certificate only for authentication because I am using Smart Card, and I also have Cisco ISE that have to AAA the VPN user, but I want the authentication for every user do not need to input the username and password, they use only the smart card for authenticate and login for the VPN access.

There is any possible way to do that?

Thanks

[balaji.bandi]

here is the one of the old document should help you to work for it.

http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107251-cac-anyconnect-vpn-windows.html

good thread for reference :

https://community.cisco.com/t5/identity-services-engine-ise/anyconnect-vpn-using-smart-card-and-ise/td-p/3501433

[Rahul Govindan · Accepted solution]

Interesting. I believe you can achieve this by using ISE (Radius) for Authorization only. Authentication will still happen via Certificate, but authorization will pick the username from the cert and send it to ISE. There you can use user/AD based policies to provide authorization permissions to the user (VPN filter etc.). You would have to add ISE as a Authorization server as seen below:

I have not personally tried this exact scenario, but see no reason why this would not work. 

[Johannes2110]

Hi Rahul,

Thank you that way is working