VPN Anyconnect : Auth' OKTA + Authoriz' ISE

[cisco.13]

Hello,

Because OKTA returns only one radius attribute, I need to configure a Cisco VPN Anyconnect by:
- Authentication with an OKTA Radius server: allow to validate user credentials
- Authorization with an ISE server: allows to return several radius attributes (class, IP pool, ...)

Can you help me please?

Thank you

[Rob Ingram]

@cisco.13 you could send aaa to ISE. ISE can proxy authentication requests to okta. Once authentication is passed ise will authorise the session.

[cisco.13]

@Rob Ingram thank you for your reply,
can you share the procedure or screenshots of the ISE configuration please?

Thank you

[cisco.13]

Hello,

I succeeded to authenticate with okta and add the authorizations on ISE
question, how can I authorize only a specific group from okta?

Thank you

[cisco.13]

Hello,

I succeeded to authenticate with okta and add the authorizations on ISE
question, how can I authorize only a specific group from okta?

Thank you