FlexVPN - AnyConnect EAP-TLS Certificate-Based Client Authentication

[dlucas]

Need to find out if the following is currently possible with FlexVPN:

Certificate-based client and server authentication using AnyConnect w/ ISE as the central AAA server for both authentication and authorization. I was thinking EAP-TLS would work, but doesn't appear to be an option for the anyconnect client??

If I could authenticate the user cert locally on the router, and perform authorization on ISE that would be OK as long as I can do per-user authorization - specifically, if I remove the user out of AD (ISE is AD integrated) then authorization will fail.

My main goal is to do certificate-based authentication, but have the ability to remove a user's VPN access without needing to mess with CRL revocation checking (which is a pain to get working).

Any comments/suggestions is appreciated.

-Thanks

[Rob Ingram]

Hi,

You can do certificate authentication, authentication would only be between the router and client. Authorization could be sent to ISE, you would use the name mangler to extract an attribute from the certificate to send to ISE to identify the user.

From my experience, I don't believe you can link an attribute extracted from a certificate (e.g username value) using the name-mangler to an AD account.....because the name-mangler will send a password to ISE, the default is "cisco".....this password will obviously be incorrect in AD. If you wanted to do this for this FlexVPN Policy, you have to create local ISE users and point to the Local Identity Store, the password would be static. The user does not need to know this password, it is purely for authorization.

When it comes to the client configuration you would create a profile in AnyConnect VPN Profile Editor, select the authentication method as "IKE-RSA"

Alternatively you could use Aggregate Authentication, this will require the use of Username/Password (can be from AD Identity Store) and certificates. So you could then make the user of an AD group permitting them VPN access and remove them when you no longer want them to have access. In the AnyConnect client profile you'd select EAP-AnyConnect.

HTH