SSL VPN and RSA on demand tokens

[kristofer]

Hi

I have tried scouring the web and can find nothing on how to get this working. We have our SSL VPN using RSA atm but would also like to be able to use the on demand version as well.

I have not been able to find any doco on how to enable this.

Any help in pointing me in the right direction would be great thanks

[Marcin Latosiewicz · Accepted solution]

Kris,

Any username/password authentication is (mostly) transparent for ASA.

ASA or any device performing authentication forwards a query containing credentials to the backend server which will respond with either acceptance, a reject or in some cases a challange.

One notable exception on RSA side is Adaptive Authentication (sometimes called tokenless) which requires additional customization on ASA.

The folks on RSA side are a smart bunch they can typically answer how their solution integrates with different vendors/solutions. If I'm readying this correctly (what I could find with a quick query) there are no additional considerations on ASA side save for defining the right server and pointing it as the authnetication service (and if needed NAT/ACL to allow users access to the server where you can request the token to be sent - typically in a DMZ).

I'm basing this on:

http://www.rsa.com/products/securid/datasheets/9240_SIDODA_DS_0310.pdf

and

http://www.rsa.com/experience/sid/ondemand.swf

M.

[viyuan700 · Accepted solution]

For RSA On demand Token there is NO config on ASA .Depending on how you want to deliver token by email or SMS you need to make changes in RSA Authentication Server  In Security Console you need to configure and also enable on demand in user profile. But all changes are in RSA

[kristofer]

thanks everyone, issue resolved