Cisco ASA Integration with AuthPoint

Deployment Overview

This document describes how to set up multi-factor authentication (MFA) for Cisco® ASA (Adaptive Security Appliance) with AuthPoint as an identity provider. Cisco ASA must already be configured and deployed before you set up MFA with AuthPoint.

Cisco ASA can be configured to support MFA in several modes. For this integration, we set up RADIUS authentication with AuthPoint.

This integration was tested with version 9.12(2) of Cisco ASA 5506.

Cisco ASA Configuration for RADIUS Authentication

AuthPoint communicates with various cloud-based services and service providers with the RADIUS protocol. This diagram shows an overview of the configuration required for RADIUS authentication.

Before You Begin

Before you begin these procedures, make sure that:

• Cisco AnyClient VPN client users can authenticate through the Cisco ASA with a static password and successfully establish a VPN connection
• You have installed the Cisco AnyConnect Secure Mobility Client application
• You have installed and configured the AuthPoint Gateway (see About Gateways)
• A token is assigned to a user in AuthPoint

Configure Cisco ASA

Add the AuthPoint Gateway to the AAA Server Groups

To use the RADIUS authentication with Cisco ASA, you must configure a RADIUS server (AuthPoint Gateway) in the AAA Server Groups.

1. Run Cisco Adaptive Security Device Manager (ASDM).

2. Select Configuration.
3. Select Device Management > Users/AAA > AAA Server Groups.
4. Next to the AAA Server Groups section, click Add.
5. In the Add AAA Server Group window, in the AAA Server Group text box, type a name for the group.
6. From the Prorocol drop-down list, select RADIUS.
7. Click OK to save the AAA server group. Leave the default value for other settings.

8. Click OK to save the AAA Server Group.
9. From the AAA Server Groups list, select the AAA Server group you created.
10. Next to the Servers in the Selected Group section, click Add to add a AAA Server for the selected AAA Server group.

11. In the Add AAA Server window, from the Interface Name drop-down list, select the interface for connections to the AuthPoint Gateway.
12. In the Server Name or IP Address text box, type the IP address of the AuthPoint Gateway.
13. Leave Timeout set to the default value of 10.
14. In the Server Authentication Port text box, type the RADIUS server port. The default value for AuthPoint is 1812.
15. In Server Accounting Port text box, type the RADIUS server account port. The default value for AuthPoint is 1813.
16. In the Server Secret Key text box, type a shared secret key to use for communication with the RADIUS server (AuthPoint Gateway).
17. In the Common Password text box, type a password.

18. Click OK to save the AAA Server settings.

19. Click Apply to apply the settings.

Add Standard ACL for AuthPoint User Group

To set up the remote VPN connection, you must configure an access control list (ACL) in the firewall ACL for the VPN client users. The ACL name must match the name of the authentication user's AuthPoint group.

1. Select Firewall > Advanced > Standard ACL.
2. Click Add > Add ACL to add an ACL.
   The Add ACL window appears.
3. In the ACL Name text box, type a name. The ACL name must match the name of the authentication user's AuthPoint group.

4. Click OK to save the ACL.

5. Select your ACL.
6. Click Add > Add ACE to add ACE for your ACL.
   The Add ACE window appears.
7. From the Address drop-down list, select the internal network that VPN client users will access.

8. Click OK to save the ACE.

9. Click Apply to apply the settings.
10. Click Save.

Configure a VPN Connection

You must configure a VPN connection for RADIUS-based authentication in the Cisco ASA. In our example, we use Cisco AnyConnect VPN. AnyConnect is a VPN client that creates a secure, remote-access VPN tunnel to Cisco ASA.

Add a Group Policy for AnyConnect Connection

Tunnel groups identify the group policy for a specific connection. If a user is not assigned to a group policy, the default group policy for the connection is used. In our example, we set up a new group policy for AuthPoint authentication.

1. Select Remote Access VPN > Network(Client) Access > Group Policies.
2. Click Add > Internal Group Policy to add a Internal group policy.
   The Add Internal Group Policy window appears.
3. In the Name text box, type a name for your group policy.
4. Click More Options.
5. For Tunneling Protocols, deselect the Inherit check box. Select the Clientless SSL VPN, SSL VPN Client, IPsec IKEv1, and IPsec IKEv2 check boxes.

6. Select Advanced > Split Tunneling to configure Split Tunneling settings.
7. For Policy, deselect the Inherit check box. From the drop-down list, select Tunnel Network List Below.
8. For Network List, deselect the Inherit check box. From the drop-down list, select the Standard ACL group you added.

9. Click OK to save the group policy.

10. Click Apply to apply settings.

Define VPN Client Address Pool

VPN address pools define a range of addresses that AnyConnect remote clients can receive when you set up a remote VPN connection.

1. Select Remote Access VPN > Network (Client) Access > Address Assignment > Address Pools.
2. Click Add > IPv4 Address Pool to add an IPv4 address pool.
   The Add IPv4 Pool window appears.
3. In the Name text box, type a name.
4. In the Starting IP Address text box, type a start IP address.
5. In the Ending IP Address text box, type an end IP address.
6. In the Subnet Mask text box, type the subnet mask.

7. Click OK to save the address pool.

8. Click Apply to apply settings.

Upload AnyConnect Client Software

You must upload a designated image to the Cisco ASA for the AnyConnect VPN client. This image enables users to download the AnyConnect software from the Cisco ASA portal. If an AnyConnect image has not been uploaded, you are prompted to upload an image when you enable AnyConnect VPN Client access.

In this example, we use anyconnect-win-4.7.04056-webdeploy-k9.pkg.

1. Select Remote Access VPN > Network (Client) Access > AnyConnect Client Software.
2. Click Add to add the AnyConnect Client Software.
   The Add AnyConnect Client Image window appears.

3. Click Upload.
   The Upload Image window appears.
4. Click Browse Local Files and select the AnyConnect Client Image file.

5. Click Upload File.
6. In the Add AnyConnect Client Image window, click OK.

7. Click Apply.

Configure a Connection Profile for AnyConnect Connection

1. Select Remote Access VPN > Network (Client) Access > AnyConnect Connection Profiles.
2. In the Access Interfaces section, select the Enable Cisco AnyConnect VPN Client access on the interfaces selected in the table below check box.
3. In the Access Interfaces list, select the Allow Access and Enable DTLS check boxes for the interfaces configured for VPN connections.

4. In the Connection Profiles section, click Add.
5. In the Add AnyConnect Connection Profile window, in the Name text box, type a name for your AnyConnect connection profile.
6. In the Aliases text box, type an alias name.
7. From the AAA Server Group drop-down list, select the AAA server group that is used for authentication with the AuthPoint RADIUS resource.
8. In the Client Address Assignment section, type a DHCP Server IP address in the DHCP Servers text box or type a Client Address Pool for the VPN clients. In our example, we use the client address pool that we added.
9. In the Default Group Policy section, from the Group Policy drop-down list, select the group policy specified for authentication with the AuthPoint RADIUS resource.
10. Select the Enable SSL VPN client protocol and Enable IPsec(IKEv2) client protocol check boxes.
11. In the DNS Servers text box, type the IP address of the DNS server. In our example, we use a DNS server in the internal network that VPN clients could access.
12. If necessary, in the Domain Name text box, type the domain name.

13. Click OK to save the AnyConnect connection profile.
    The Add AnyConnect Connection Profile window closes.
14. In the Login Page Setting section, select the Allow user to select connection profile on the login page check box.

15. Click Apply.

Exempt VPN Traffic from Network Address Translation

If network address translation is enabled on the Cisco ASA, the VPN traffic must be exempted from this translation. In this case, we define VPN traffic network objects and then define a NAT rule for the VPN traffic.

1. Select Firewall > Objects > Network Objects/Groups.
2. Click Add-> Network Object .
   The Add Network Object window appears.
3. In the Name text box, type NETWOK_OBJ_192.168.100.0_24. This is the internal network that VPN clients will access.
4. From the Type drop-down list, select Network.
5. In the IP Address text box, type 192.168.100.0.
6. In the Netmask text box, type 255.255.255.0.
7. (Optional) Type a description for the network object.
8. Click OK.

9. Click Add to add another network object.
   The Add Network Object window appears.
10. In the Name text box, type NETWORK_OBJ_192.168.35.0_24. This is the VPN clients address pool network that we configured.
11. From the Type drop-down list, select Network.
12. In the IP Address text box, type 192.168.35.0.
13. In the Netmask text box, type 255.255.255.0.
14. (Optional) Type a description for the network object.

15. Click OK.

16. Select NAT Rules.
17. Click Add-> Add NAT Rule Before "Network Object" NAT Rules.
    The Add NAT Rule window appears.
18. From the Source Interface drop-down list, select internal.
19. From the Destination Interface drop-down list, select External.
20. From the Source Address drop-down list, select NETWOK_OBJ_192.168.100.0_24. This is the internal network that VPN clients will access.
21. From the Destination Address drop-down list, select NETWORK_OBJ_192.168.35.0_24. This is the VPN client address pool network we defined.
22. From the Service drop-down list, select any.
23. From the Source NAT type drop-down list, select Static.
24. In the Options section, select the Enable rule, Disable Proxy ARP on egress interface, and Lookup route table to locate egress interface check boxes.
25. Leave the default for all other settings.

26. Click OK to save the NAT rule.
    The Add NAT Rule window closes.
27. Click Apply.

Configure AuthPoint

Before AuthPoint can receive authentication requests from Cisco ASA, you must specify Cisco ASA as a RADIUS client resource In AuthPoint, resources are the applications and services that your users connect to. in AuthPoint. You must also create a Zero Trust authentication policy Authentication policies specify which resources users can authenticate to and which authentication methods they can use (Push, QR code, and OTP). for the Cisco ASA resource and you must bind the Cisco ASA resource to the AuthPoint Gateway.

Add a RADIUS Resource in AuthPoint

From the AuthPoint management UI:

1. From the navigation menu, select Resources. Click Add Resource.
   The Add Resource page opens.

2. From the Type drop-down list, select RADIUS Client.
   Additional fields appear.

3. On the RADIUS Client page, in the Name text box, type a name for this resource.
4. In the RADIUS client trusted IP or FQDN text box, type the Cisco ASA Internal interface IP address.
5. In the Value sent for RADIUS attribute 11 (Filter-Id) drop-down list, select User's AuthPoint group.
6. In the Shared Secret text box, type the shared secret for the Cisco ASA.

7. Click Save.

Add a Group in AuthPoint

You must have at least one user group in AuthPoint to configure MFA. If you already have a group, you do not have to add another group.

To add a WatchGuard Cloud-hosted group to the WatchGuard Cloud Directory:

1. Go to Configure > Directories and Domain Services.
2. Click the WatchGuard Cloud Directory domain name. If you have not yet added the WatchGuard Cloud Directory, click Add Authentication Domain and select the WatchGuard Cloud Directory.
   The New Group page appears.

3. In the Groups tab, click Add Group.
4. In the Group Name text box, type a descriptive name for the group.
5. (Optional) In the Description text box, type a description of the group.

6. Click Save.
   Your group is added to the WatchGuard Cloud Directory and to AuthPoint.

Add a Zero Trust Authentication Policy

Zero Trust policies specify which resources users can authenticate to and which authentication methods they can use.

You must have at least one Zero Trust authentication policy that includes the Cisco ASA resource. If you already have Zero Trust authentication policies, you do not have to create a new authentication policy. You can add this resource to your existing authentication policies.

Users that do not have an authentication policy for a specific resource cannot authenticate to log in to that resource.

To configure a Zero Trust authentication policy:

1. Go to Configure > Zero Trust. If you have a Service Provider account, you must select an account from Account Manager.
2. Click Add Policy.
3. Type a name for this policy.
4. In the Target section, from the Content drop-down list, select which groups this policy applies to. You can make multiple selections to add multiple groups.
5. In the Resources section, select the AuthPoint resources this policy applies to.
6. In the Conditions section, select the conditions that apply to this policy. When you add a condition to an authentication policy, the policy applies only to user authentications that match the policy and the policy conditions. For example, if you add a time schedule to a policy, the policy only applies to user authentications that occur within that time schedule. Users who only have a policy that includes a time schedule do not get access to the resource when they authenticate outside of the allowed times (because they do not have a policy that applies, not because authentication is denied). For more information, go to About Zero Trust Conditions

   For RADIUS authentication, policies that have a Network Location do not apply because AuthPoint does not have the IP address of the user.

   1. (Optional) To create a new condition, click Add New Condition. After you create a new condition, you must still add the condition to the policy.
   2. From the Type drop-down list, select the type of condition to add to the policy.
   3. From the Name drop-down list, select which condition of the chosen type to add to the policy.
   4. To add more conditions, repeat Step 6.

      If you add conditions to a policy, we recommend that you create a second policy for the same groups and resources without the conditions. Assign a higher priority to the policy with the policy objects. For more information about priority, go to About Zero Trust Policy Precedence.

7. In the Action section, select an option to specify whether to allow or deny authentications for the resources in this policy. In our example, we want to allow authentications.
   • Allow — Allow user groups in this policy access to the resources associated with this policy.
• Deny — Deny authentications when users in the groups associated with this policy try to authenticate to the resources associated with this policy.
8. If you allow access with this policy, select the check box for each authentication option users can select when they authenticate to resources in this policy with MFA.

   If you enable the push and OTP authentication methods for a policy, RADIUS client resources associated with that policy use push notifications to authenticate users.

   QR code authentication is not supported for RADIUS client resources.

   For RADIUS authentication, you append your OTP to the end of your password. Do not add a space. For example, password112233.

9. Click Save.
   Your policy is created and added to the end of the policy list.
10. Review the order of your policies and adjust as necessary. For more information about priority, go to About Zero Trust Policy Precedence.

Bind the RADIUS Resource to a Gateway

To use RADIUS authentication with AuthPoint, you must have the AuthPoint Gateway installed on your corporate network and you must assign your RADIUS resources to the Gateway in the AuthPoint management UI. The Gateway functions as a RADIUS server.

If you have not configured and installed the AuthPoint Gateway, see About Gateways.

1. From the navigation menu, select Gateway.
2. Select the Name of the Gateway.

3. From the RADIUS section, in the Port text box, type the port number used to communicate with the Gateway. The default ports are 1812 and 1645.

   If you already have a RADIUS server installed that uses port 1812 or 1645, you must use a different port for the AuthPoint Gateway.

4. From the Select a RADIUS Resource drop-down list, select your RADIUS client resource.
5. Click Save.

Add Users to AuthPoint

Before you assign users to a group, you must add the users to AuthPoint. There are two ways to add AuthPoint user accounts:

• Sync users from an external user database
• Add WatchGuard Cloud-hosted AuthPoint users

Each user must be a member of a group. You must add at least one group before you can add users to AuthPoint.

Test the Integration

To test the integration of AuthPoint and the configuration of your Cisco ASA, you can authenticate with a mobile token on your mobile device. For RADIUS resources, you can authenticate with a one-time password (OTP) or push (based on your authentication policy).

In this example, we show the OTP authentication method (users append the OTP for their token to their password).

1. Run the Cisco AnyConnect VPN client.
2. Type your Cisco ASA public address or IP address. Click Connect.

3. In the Security Warning dialog box, click Connect Anyway.

4. From the Group drop-down list, select your group for the VPN connection.
5. In the Username text box, type your user name.
6. In the Password text box, type your password and the OTP for your token (shown in the AuthPoint mobile app). Do not add a space between your password and your OTP.
7. Click OK.
   You are logged in successfully.