Contents

Cisco ASA Integration with AuthPoint

Deployment Overview

This document describes how to set up multi-factor authentication (MFA) for Cisco® ASA (Adaptive Security Appliance) with AuthPoint as an identity provider. Cisco ASA must already be configured and deployed before you set up MFA with AuthPoint.

Cisco ASA can be configured to support MFA in several modes. For this integration, we set up RADIUS authentication with AuthPoint.

This integration was tested with version 9.12(2) of Cisco ASA 5506.

Cisco ASA Configuration for RADIUS Authentication

AuthPoint communicates with various cloud-based services and service providers with the RADIUS protocol. This diagram shows an overview of the configuration required for RADIUS authentication.

Before You Begin

Before you begin these procedures, make sure that:

  • Cisco AnyClient VPN client users can authenticate through the Cisco ASA with a static password and successfully establish a VPN connection
  • You have installed the Cisco AnyConnect Secure Mobility Client application
  • You have installed and configured the AuthPoint Gateway (see About Gateways)
  • A token is assigned to a user in AuthPoint

Configure Cisco ASA

Add the AuthPoint Gateway to the AAA Server Groups

To use the RADIUS authentication with Cisco ASA, you must configure a RADIUS server (AuthPoint Gateway) in the AAA Server Groups.

  1. Run Cisco Adaptive Security Device Manager (ASDM).

Screenshot of the ASDM Home page

  1. Select Configuration.
  2. Select Device Management > Users/AAA > AAA Server Groups.
  3. Next to the AAA Server Groups section, click Add.
  4. In the Add AAA Server Group window, in the AAA Server Group text box, type a name for the group.
  5. From the Prorocol drop-down list, select RADIUS.
  6. Click OK to save the AAA server group. Leave the default value for other settings.

Screenshot of the add AAA Server Group page

  1. Click OK to save the AAA Server Group.
  2. From the AAA Server Groups list, select the AAA Server group you created.
  3. Next to the Servers in the Selected Group section, click Add to add a AAA Server for the selected AAA Server group.

Screenshot of the add Servers in the Selected Group page

  1. In the Add AAA Server window, from the Interface Name drop-down list, select the interface for connections to the AuthPoint Gateway.
  2. In the Server Name or IP Address text box, type the IP address of the AuthPoint Gateway.
  3. Leave Timeout set to the default value of 10.
  4. In the Server Authentication Port text box, type the RADIUS server port. The default value for AuthPoint is 1812.
  5. In Server Accounting Port text box, type the RADIUS server account port. The default value for AuthPoint is 1813.
  6. In the Server Secret Key text box, type a shared secret key to use for communication with the RADIUS server (AuthPoint Gateway).
  7. In the Common Password text box, type a password.

Screenshot of the add AAA Server page

  1. Click OK to save the AAA Server settings.

Screenshot of the add AAA Server done page

  1. Click Apply to apply the settings.

Add Standard ACL for AuthPoint User Group

To set up the remote VPN connection, you must configure an access control list (ACL) in the firewall ACL for the VPN client users. The ACL name must match the name of the authentication user's AuthPoint group.

  1. Select Firewall > Advanced > Standard ACL.
  2. Click Add > Add ACL to add an ACL.
    The Add ACL window appears.
  3. In the ACL Name text box, type a name. The ACL name must match the name of the authentication user's AuthPoint group.

Screenshot of the add ACL page

  1. Click OK to save the ACL.

Screenshot of the add ACL done page

  1. Select your ACL.
  2. Click Add > Add ACE to add ACE for your ACL.
    The Add ACE window appears.
  3. From the Address drop-down list, select the internal network that VPN client users will access.

Screenshot of the add ACE page

  1. Click OK to save the ACE.

Screenshot of the add ACE DONE page

  1. Click Apply to apply the settings.
  2. Click Save.

Configure a VPN Connection

You must configure a VPN connection for RADIUS-based authentication in the Cisco ASA. In our example, we use Cisco AnyConnect VPN. AnyConnect is a VPN client that creates a secure, remote-access VPN tunnel to Cisco ASA.

Add a Group Policy for AnyConnect Connection

Tunnel groups identify the group policy for a specific connection. If a user is not assigned to a group policy, the default group policy for the connection is used. In our example, we set up a new group policy for AuthPoint authentication.

  1. Select Remote Access VPN > Network(Client) Access > Group Policies.
  2. Click Add > Internal Group Policy to add a Internal group policy.
    The Add Internal Group Policy window appears.
  3. In the Name text box, type a name for your group policy.
  4. Click More Options.
  5. For Tunneling Protocols, deselect the Inherit check box. Select the Clientless SSL VPN, SSL VPN Client, IPsec IKEv1, and IPsec IKEv2 check boxes.

Screenshot of the Add Internal Group Policy page

  1. Select Advanced > Split Tunneling to configure Split Tunneling settings.
  2. For Policy, deselect the Inherit check box. From the drop-down list, select Tunnel Network List Below.
  3. For Network List, deselect the Inherit check box. From the drop-down list, select the Standard ACL group you added.

Screenshot of the Add Internal Group Policy page

  1. Click OK to save the group policy.

Screenshot of the Add Internal Group Policy page

  1. Click Apply to apply settings.

Define VPN Client Address Pool

VPN address pools define a range of addresses that AnyConnect remote clients can receive when you set up a remote VPN connection.

  1. Select Remote Access VPN > Network (Client) Access > Address Assignment > Address Pools.
  2. Click Add > IPv4 Address Pool to add an IPv4 address pool.
    The Add IPv4 Pool window appears.
  3. In the Name text box, type a name.
  4. In the Starting IP Address text box, type a start IP address.
  5. In the Ending IP Address text box, type an end IP address.
  6. In the Subnet Mask text box, type the subnet mask.

Screenshot of the Add IPv4 Poo page

  1. Click OK to save the address pool.

Screenshot of the Add VPN Client Address Pool page

  1. Click Apply to apply settings.

Upload AnyConnect Client Software

You must upload a designated image to the Cisco ASA for the AnyConnect VPN client. This image enables users to download the AnyConnect software from the Cisco ASA portal. If an AnyConnect image has not been uploaded, you are prompted to upload an image when you enable AnyConnect VPN Client access.

In this example, we use anyconnect-win-4.7.04056-webdeploy-k9.pkg.

  1. Select Remote Access VPN > Network (Client) Access > AnyConnect Client Software.
  2. Click Add to add the AnyConnect Client Software.
    The Add AnyConnect Client Image window appears.

Screenshot of the Add AnyConnect Client Image

  1. Click Upload.
    The Upload Image window appears.
  2. Click Browse Local Files and select the AnyConnect Client Image file.

Screenshot of the Upload Image

  1. Click Upload File.
  2. In the Add AnyConnect Client Image window, click OK.

Screenshot of the Add AnyConnect Client Image

  1. Click Apply.

Screenshot of the Add AnyConnect Client done Image

Configure a Connection Profile for AnyConnect Connection

  1. Select Remote Access VPN > Network (Client) Access > AnyConnect Connection Profiles.
  2. In the Access Interfaces section, select the Enable Cisco AnyConnect VPN Client access on the interfaces selected in the table below check box.
  3. In the Access Interfaces list, select the Allow Access and Enable DTLS check boxes for the interfaces configured for VPN connections.

Screenshot of the Add Access Interfaces Image

  1. In the Connection Profiles section, click Add.
  2. In the Add AnyConnect Connection Profile window, in the Name text box, type a name for your AnyConnect connection profile.
  3. In the Aliases text box, type an alias name.
  4. From the AAA Server Group drop-down list, select the AAA server group that is used for authentication with the AuthPoint RADIUS resource.
  5. In the Client Address Assignment section, type a DHCP Server IP address in the DHCP Servers text box or type a Client Address Pool for the VPN clients. In our example, we use the client address pool that we added.
  6. In the Default Group Policy section, from the Group Policy drop-down list, select the group policy specified for authentication with the AuthPoint RADIUS resource.
  7. Select the Enable SSL VPN client protocol and Enable IPsec(IKEv2) client protocol check boxes.
  8. In the DNS Servers text box, type the IP address of the DNS server. In our example, we use a DNS server in the internal network that VPN clients could access.
  9. If necessary, in the Domain Name text box, type the domain name.

Screenshot of the Add AnyConnect Connection Profile

  1. Click OK to save the AnyConnect connection profile.
    The Add AnyConnect Connection Profile window closes.
  2. In the Login Page Setting section, select the Allow user to select connection profile on the login page check box.

Screenshot of the Login Page Setting

Screenshot of the Add AnyConnect Connection Profile done

  1. Click Apply.

Exempt VPN Traffic from Network Address Translation

If network address translation is enabled on the Cisco ASA, the VPN traffic must be exempted from this translation. In this case, we define VPN traffic network objects and then define a NAT rule for the VPN traffic.

  1. Select Firewall > Objects > Network Objects/Groups.
  2. Click Add-> Network Object .
    The Add Network Object window appears.
  3. In the Name text box, type NETWOK_OBJ_192.168.100.0_24. This is the internal network that VPN clients will access.
  4. From the Type drop-down list, select Network.
  5. In the IP Address text box, type 192.168.100.0.
  6. In the Netmask text box, type 255.255.255.0.
  7. (Optional) Type a description for the network object.
  8. Click OK.

Screenshot of the Add Network Object

  1. Click Add to add another network object.
    The Add Network Object window appears.
  2. In the Name text box, type NETWORK_OBJ_192.168.35.0_24. This is the VPN clients address pool network that we configured.
  3. From the Type drop-down list, select Network.
  4. In the IP Address text box, type 192.168.35.0.
  5. In the Netmask text box, type 255.255.255.0.
  6. (Optional) Type a description for the network object.

Screenshot of the Add Network Object

  1. Click OK.

Screenshot of the Add Network Object

  1. Select NAT Rules.
  2. Click Add-> Add NAT Rule Before "Network Object" NAT Rules.
    The Add NAT Rule window appears.
  3. From the Source Interface drop-down list, select internal.
  4. From the Destination Interface drop-down list, select External.
  5. From the Source Address drop-down list, select NETWOK_OBJ_192.168.100.0_24. This is the internal network that VPN clients will access.
  6. From the Destination Address drop-down list, select NETWORK_OBJ_192.168.35.0_24. This is the VPN client address pool network we defined.
  7. From the Service drop-down list, select any.
  8. From the Source NAT type drop-down list, select Static.
  9. In the Options section, select the Enable rule, Disable Proxy ARP on egress interface, and Lookup route table to locate egress interface check boxes.
  10. Leave the default for all other settings.

Screenshot of the Add NAT Rule

  1. Click OK to save the NAT rule.
    The Add NAT Rule window closes.
  2. Click Apply.

Screenshot of the Add NAT Rule done

Configure AuthPoint

Before AuthPoint can receive authentication requests from Cisco ASA, you must specify the Cisco ASA client as a RADIUS resource in AuthPoint. You must also assign an access policy for the Cisco ASA RADIUS resource to the AuthPoint group that will authenticate through Cisco ASA.

Add a RADIUS Resource in AuthPoint

From the AuthPoint management UI:

  1. From the navigation menu, select Resources.
  2. From the Choose a Resource Type drop-down list, select RADIUS Client. Click Add Resource.

  1. On the RADIUS Client page, in the Name text box, type a name for this resource.
  2. In the RADIUS client trusted IP or FQDN text box, type the Cisco ASA Internal interface IP address.
  3. In the Value sent for RADIUS attribute 11 (Filter-Id) drop-down list, select User's AuthPoint group.
  4. In the Shared Secret text box, type the shared secret for the Cisco ASA.

Screenshot of AuthPoint Resources

  1. Click Save.

Add an Access Policy to AuthPoint

You must have at least one user group in AuthPoint for authentication with Cisco ASA, and you must assign an access policy for the Cisco ASA resource to that group. If you already have a group, you do not have to add another group.

In the AuthPoint management UI:

  1. From the navigation menu, select Groups.
  2. To add a new group, click Add Group. If you already have a group that you want to use, click the Name of your group to edit it.

  1. In the Name text box, type a descriptive name for the group.
  2. (Optional) In the Description text box, type a description of the group.

  1. In the Access Policy section, click Add Policy.

  1. In the Add Policy dialog box, from the Resource drop-down list, select the resource you want to add an access policy for.
  2. (Optional) To require that users type their password before they authenticate for this resource, select the Require Password Authentication toggle.
  3. Select the authentication options users in this group can choose from when they authenticate.

    For RADIUS resources, you can only choose OTP or Push. RADIUS resources cannot use the QR code authentication option.

  1. Click Add.
    The access policy for your resource is added to the list.

  1. Click Save.

Before you assign users to a group, you must add them to AuthPoint. You can manually add user accounts or import user accounts from your LDAP database. For more information on how to add user accounts, see Add User Accounts.

Bind the RADIUS Resource to a Gateway

To use RADIUS authentication with AuthPoint, you must have the AuthPoint Gateway installed on your corporate network and you must assign your RADIUS resources to the Gateway in the AuthPoint management UI. The Gateway functions as a RADIUS server. For more information, see About Gateways.

  1. From the navigation menu, select Gateway.
  2. Select the Name of the Gateway.
  3. In the RADIUS section, in the Port text box, type the port number used to communicate with the Gateway. The default ports are 1812 and 1645.
  4. In the Select a RADIUS resource drop-down list, select your RADIUS client resource.
  5. Click Save.

Test the Integration

To test the integration of AuthPoint and the configuration of your Cisco ASA, you can authenticate with a mobile token on your mobile device. For RADIUS resources, you can choose one-time password (OTP) or push.

In this example, we show the OTP authentication method (users append the OTP for their token to their password).

  1. Run the Cisco AnyConnect VPN client.
  2. Type your Cisco ASA public address or IP address. Click Connect.

test start

  1. In the Security Warning dialog box, click Connect Anyway.

Warning

connectting

  1. From the Group drop-down list, select your group for the VPN connection.
  2. In the Username text box, type your user name.
  3. In the Password text box, type your password and the OTP for your token (shown in the AuthPoint mobile app). Do not add a space between your password and your OTP.
  4. Click OK.
    You are logged in successfully.

test pass

Give Us Feedback  ●   Get Support  ●   All Product Documentation  ●   Technical Search