ASA to ACS: how to distinguish different authentication methods?

Unanswered Question
May 1st, 2009
User Badges:

I have SSL VPN Clients connecting to an ASA 5520 using RADIUS to a backend Cisco ACS. I want to support two authentication options for the clients. The first is a certificate combined with an Active Directory username & password. The second is a token-name & one-time-password.

Setting these two authentication methods up on the ASA is no problem ... I can configure user selectable connection profiles that have the wanted authentication settings. The ACS can handle both the AD and token credentials.

Here's the problem. I need to be able to distinguish on the ACS if a connection request was certificate authenticated or not. I don't want users choosing to do a token/OTP connection and then entering in their AD credentials instead. the ACS won't know that this AD authentication request wasn't properly combined with a certificate.

I've used NAR settings in the past to control what user databases an AAA client can authentication against, however, if the two authentication methods are coming from the same AAA client (the ASA), what can I do?

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Jagdeep Gambhir Fri, 05/01/2009 - 11:14
User Badges:
  • Red, 2250 points or more

I guess this should be possible with a feature called NAP,( network access profiles). Here you can define which database to use for any specific request. We can filter request on the basis of attributes sent in the authentication request.



jkloet Fri, 05/01/2009 - 11:29
User Badges:

I'll have a read through that.



jkloet Mon, 05/04/2009 - 07:58
User Badges:

Any idea how I would go about setting the attributes on the authentication request coming from the ASA?

Thanks, Jeff


This Discussion