Contents

Cisco ASA Integration with AuthPoint

Deployment Overview

This document describes how to set up multi-factor authentication (MFA) for Cisco® ASA (Adaptive Security Appliance) with AuthPoint as an identity provider. Cisco ASA must already be configured and deployed before you set up MFA with AuthPoint.

Cisco ASA can be configured to support MFA in several modes. For this integration, we set up RADIUS authentication with AuthPoint.

This integration was tested with 9.8(1) of Cisco ASA 5506.

Cisco ASA Authentication Data Flow with AuthPoint

AuthPoint communicates with various cloud-based services and service providers with the RADIUS protocol. This diagram shows the data flow of an MFA transaction for a Cisco ASA.

Before You Begin

Before you begin these procedures, make sure that:

  • Cisco AnyClient VPN client users can authenticate through the Cisco ASA with a static password and successfully establish a VPN connection
  • You have installed the Cisco AnyConnect Secure Mobility Client application
  • You have installed and configured the AuthPoint Gateway (see About Gateways)
  • A token is assigned to a user in AuthPoint

Configure Cisco ASA

Add the AuthPoint Gateway to the AAA Server Groups

To use the RADIUS authentication with Cisco ASA, you must configure a RADIUS server (AuthPoint Gateway) in the AAA Server Groups.

  1. Run Cisco Adaptive Security Device Manager (ASDM).

  1. Select Configuration.
  2. Select Device Management > Users/AAA > AAA Server Groups.
  3. Next to the AAA Server Groups section, click Add.

  1. In the Add AAA Server Group window, in the AAA Server Group text box, type a name for the group.
  2. Click OK to save the AAA server group.

  1. Click OK to save the AAA Server Group.
  2. From the AAA Server Groups list, select the AAA Server group you created.
  3. Next to the Servers in the Selected Group section, click Add to add a AAA Server for the selected AAA Server group.

  1. In the Add AAA Server window, from the Interface Name drop-down list, select the interface for connections to the AAA server.
  2. In the Server Name or IP Address text box, type the IP address of the AuthPoint Gateway.
  3. In the Timeout text box, type 60.
  4. In the Server Authentication Port text box, type the RADIUS server port.
  5. In Server Accounting Port text box, type the RADIUS server account port.
  6. In the Server Secret Key text box, type a shared secret key to use for communication with the RADIUS server (AuthPoint Gateway).
  7. In the Common Password text box, type a password.

  1. Click OK to save the AAA Server settings.

  1. Click Apply to apply the settings.

Add Standard ACL for AuthPoint User Group

To set up the remote VPN connection, you must configure an access control list (ACL) in the firewall ACL for the VPN client users. The ACL name must match the name of the authentication user's AuthPoint group.

  1. Select Firewall > Advanced > Standard ACL.

  1. Click Add to add an ACL.
    The Add ACL window appears.
  2. In the ACL Name text box, type a name. The ACL name must match the name of the authentication user's AuthPoint group.

  1. Click OK to save the ACL.

  1. Click Add to add ACE for your ACL.
    The Add ACE window appears.
  2. From the Address drop-down list, select the internal network that VPN client users will access.

  1. Click OK to save the ACE.

  1. Click Apply to apply the settings.

Configure a VPN Connection

You must configure a VPN connection for RADIUS-based authentication in the Cisco ASA. In our example, we use Cisco AnyConnect VPN. AnyConnect is a VPN client that creates a secure, remote-access VPN tunnel to Cisco ASA.

Add a Group Policy for AnyConnect Connection

Tunnel groups identify the group policy for a specific connection. If a user is not assigned to a group policy, the default group policy for the connection is used. In our example, we set up a new group policy for AuthPoint authentication.

  1. Select Remote Access VPN > Network(Client) Access > Group Policies.

  1. Click Add to add a group policy.
    The Add Internal Group Policy window appears.
  2. In the Name text box, type a name for your group policy.
  3. Click More Options.
  4. For Tunneling Protocols, deselect the Inherit check box. Select the Clientless SSL VPN, SSL VPN Client, IPsec IKEv1, and IPsec IKEv2 check boxes.

  1. Select Advanced > Split Tunneling to configure Split Tunneling settings.
  2. For Policy, deselect the Inherit check box. From the drop-down list, select Tunnel Network List Below.
  3. For Network List, deselect the Inherit check box. From the drop-down list, select the Standard ACL group you added.

  1. Click OK to save the group policy.

  1. Click Apply to apply settings.

Define VPN Client Address Pool

VPN address pools define a range of addresses that AnyConnect remote clients can receive when you set up a remote VPN connection.

  1. Select Remote Access VPN > Network (Client) Access > Address Assignment > Address Pools.

  1. Click Add to add an IPv4 address pool.
    The Add IPv4 Pool window appears.
  2. In the Name text box, type a name.
  3. In the Starting IP Address text box, type an IP address.
  4. In the Ending IP Address text box, type an IP address.
  5. In the Subnet Mask text box, type the subnet mask.

  1. Click OK to save the address pool.

  1. Click Apply to apply settings.

Upload AnyConnect Client Software

You must upload a designated image to the Cisco ASA for the AnyConnect VPN client. This image enables users to download the AnyConnect software from the Cisco ASA portal. If an AnyConnect image has not been uploaded, you are prompted to upload an image when you enable AnyConnect VPN Client access.

In this example, we use Anyconnect-win-3.1.14018.

  1. Select Remote Access VPN > Network (Client) Access > AnyConnect Client Software.

  1. Click Add to add the AnyConnect Client Software.
    The Add AnyConnect Client Image window appears.

  1. Click Upload.
    The Upload Image window appears.
  2. Click Browse Local Files and select the AnyConnect Client Image file.

  1. Click Upload File.
  2. In the Add AnyConnect Client Image window, click OK.

  1. Click Apply.

Configure a Connection Profile for AnyConnect Connection

  1. Select Remote Access VPN > Network (Client) Access > AnyConnect Connection Profiles.

  1. In the Access Interfaces section, select the Enable Cisco AnyConnect VPN Client access on the interfaces selected in the table below check box.
  2. In the Access Interfaces list, select the Allow Access and Enable DTLS check boxes for the interfaces configured for VPN connections.

  1. In the Connection Profiles section, click Add.

  1. In the Add AnyConnect Connection Profile window, in the Name text box, type a name for your AnyConnect connection profile.
  2. In the Aliases text box, type an alias name.
  3. From the AAA Server Group drop-down list, select the AAA server group that is used for authentication with the AuthPoint RADIUS resource.
  4. In the Client Address Assignment section, type a DHCP Server IP address in the DHCP Servers text box or type a Client Address Pool for the VPN clients. In our example, we use the client address pool that we added.
  5. In the Default Group Policy section, from the Group Policy drop-down list, select the group policy specified for authentication with the AuthPoint RADIUS resource.
  6. Select the Enable SSL VPN client protocol and Enable IPsec(IKEv2) client protocol check boxes.
  7. In the DNS Servers text box, type the IP address of the DNS server. In our example, we use a DNS server in the internal network that VPN clients could access.
  8. In the Domain Name text box, type the domain name.

  1. Click OK to save the AnyConnect connection profile.
    The Add AnyConnect Connection Profile window closes.

  1. In the Login Page Setting section, select the Allow user to select connection profile on the login page check box.

  1. Click Apply.

Exempt VPN Traffic from Network Address Translation

If network address translation is enabled on the Cisco ASA, the VPN traffic must be exempted from this translation. In this case, we define VPN traffic network objects and then define a NAT rule for the VPN traffic.

  1. Select Firewall > Objects > Network Objects/Groups.

  1. Click Add.
    The Add Network Object window appears.
  2. In the Name text box, type NETWORK_OBJ_10.0.1.0_24. This is the internal network that VPN clients will access.
  3. From the Type drop-down list, select Network.
  4. In the IP Address text box, type 10.0.1.0.
  5. In the Netmask text box, type 255.255.255.0.
  6. (Optional) Type a description for the network object.
  7. Click OK.

  1. Click Add to add another network object.
    The Add Network Object window appears.
  2. In the Name text box, type NETWORK_OBJ_192.168.35.0_24. This is the VPN clients address pool network that we configured.
  3. From the Type drop-down list, select Network.
  4. In the IP Address text box, type 192.168.35.0.
  5. In the Netmask text box, type 255.255.255.0.
  6. (Optional) Type a description for the network object.

  1. Click OK.
  2. Select NAT Rules.

  1. Click Add.
    The Add NAT Rule window appears.
  2. From the Source Interface drop-down list, select internal.
  3. From the Destination Interface drop-down list, select External .
  4. From the Source Address drop-down list, select NETWORK_OBJ_10.0.1.0_24. This is the internal network that VPN clients will access.
  5. From the Destination Address drop-down list, select NETWORK_OBJ_192.168.35.0_24. This is the VPN client address pool network we defined.
  6. From the Service drop-down list, select any.
  7. From the Source NAT type drop-down list, select Static.
  8. In the Options section, select the Enable rule, Disable Proxy ARP on egress interface, and Lookup route table to locate egress interface check boxes.
  9. Leave the default for all other settings.

  1. Click OK to save the NAT rule.
    The Add NAT Rule window closes.
  2. Click Apply.

Configure AuthPoint

Before AuthPoint can receive authentication requests from Cisco ASA, you must specify the Cisco ASA client as a RADIUS resource in AuthPoint. You must also assign an access policy for the Cisco ASA RADIUS resource to the AuthPoint group that will authenticate through Cisco ASA.

Add a RADIUS Resource in AuthPoint

From the AuthPoint management UI:

  1. From the navigation menu, select Resources.
  2. From the Choose a Resource Type drop-down list, select RADIUS Client. Click Add Resource.

  1. On the RADIUS page, in the Name text box, type a name for this resource.
  2. In the Host text box, type the Cisco ASA Server Internal interface IP address.
  3. In the User ID drop-down list, select User Name.
  4. In the Shared Secret text box, type the shared secret for the Cisco ASA server.
  5. Click Save.

Add an Access Policy to AuthPoint

You must have at least one user group in AuthPoint for authentication with Cisco ASA, and you must assign an access policy for the Cisco ASA resource to that group. If you already have a group, you do not have to add another group.

In the AuthPoint management UI:

  1. From the navigation menu, select Groups.
  2. To add a new group, click Add Group. If you already have a group that you want to use, select the group to edit it.

  1. In the Name text box, type a descriptive name for the group.
  2. (Optional) In the Description text box, type a description of the group.

  1. In the Access Policy section, click Add Policy.

  1. In the Add Policy dialog box, from the Resource drop-down list, select the resource you want to add an access policy for.
  2. (Optional) To require that users type their password before they authenticate for this resource, select the Require Password Authentication slider.
  3. Select the authentication options that users in this group can choose from when they authenticate.

    For SAML resources, if you select more than one authentication option, users must choose one of the available options when they authenticate. For example, if you select OTP and Push, users can choose to type their OTP or approve a push to authenticate. You cannot require that they do both.

  1. Click Add.

  1. (Optional) Add one or more safe locations to your group. For more information about safe locations and detailed instructions to add them, see About Safe Locations.
  2. Click Save.

Before you assign users to a group, you must add them to AuthPoint. You can manually add user accounts or import user accounts from your LDAP database. For more information on how to add user accounts, see Add User Accounts.

Bind the RADIUS Resource to a Gateway

To use RADIUS authentication with AuthPoint, you must have the AuthPoint Gateway installed on your corporate network and you must assign your RADIUS resources to the Gateway in the AuthPoint management UI. The Gateway functions as a RADIUS server. For more information, see About Gateways.

  1. From the navigation menu, select Gateway.
  2. Select the Name of the Gateway.
  3. In the RADIUS section, in the Port text box, type the port number used to communicate with the Gateway. The default ports are 1812 and 1645.
  4. In the Select a RADIUS resource drop-down list, select your RADIUS client resource.
  5. Click Save.

Test the Integration

To test the integration of AuthPoint and the configuration of your Cisco ASA, you can authenticate with a mobile token on your mobile device. For RADIUS resources, you can choose one-time password (OTP) or push.

In this example, we show the OTP authentication method (users append the OTP for their token to their password).

  1. Run the Cisco AnyConnect VPN client.
  2. Type your Cisco ASA public address or IP address. Click Connect.

  1. In the Security Warning dialog box, click Connect Anyway.

  1. From the Group drop-down list, select your group for the VPN connection.
  2. In the Username text box, type your user name.
  3. In the Password text box, type your password and the OTP for your token (shown in the AuthPoint mobile app). Do not add a space between your password and your OTP.
  4. Click OK.
    You are logged in successfully.

Give Us Feedback  ●   Get Support  ●   All Product Documentation  ●   Technical Search