Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Is this two-factor authentication?

Hi all,

Two factor authnetication is considered be any two of the following.

1) Something you know

2) Something you have

3) Something you are

I want to know whether any of you would consider the following as two factor authentication...

A preconfigured copy of the cisco software VPN client including conenction details of an IPSec VPN (this includes the pre share key). And authentication to a windows domain configured on the VPN end point (a Cisco ASA).

One way to look at it is that the "something you have" is the Pre-configured Cisco VPN Client. And the "Something you know" is your Windows domain username and password.

Any thoughts?

What is the accepted wisdom on 2 factor authentication?

Can the Pre-configured VPN client be considered 1 of the authentication factors?

Many Thanks

Andy

4 REPLIES
Gold

Re: Is this two-factor authentication?

To me, strong authentication means at least some component of the authentication is out of band. Lots of folks think differently though.

Alternatively, you might call is weak[er] 2-factor;-) Does the "pre-configured client" mean that the software is somehow validated too? Will the shared key be the same for everyone? Will it ever change? An RSA token would be more secure. Still, it's certainly better than just a username/password. What are you trying to protect against?

New Member

Re: Is this two-factor authentication?

The cisco vpn software client stores the IKE preshared key. This is the "something i have". This is the same key for everyone and is unlikely to change very often (if ever).

The username and password is the "something i know", and this is different for each user.

I know im going to be asked by auditors whenther we have 2 factor authentication for remote access vpn users. And I wanted to know if our current setup could be thought of as 2 factor.

Personally i dont think it is. And i agree that some kind of RSA token solution would be better.

Thanks

Andy

New Member

Re: Is this two-factor authentication?

we had that same setup and it did NOT pass for 2 factor, because the pre-shared key is not unique for every VPN user/machine. We had to implement RSA tokens to pass the audit. Your auditors may say the same.

New Member

Re: Is this two-factor authentication?

Thank you to both of you for helping me with this issue. At least i know where i stand with the auditors. This will give me leverage tim implement additional token authentication.

Cheers

Andy

924
Views
10
Helpful
4
Replies