Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Community Member

Setting up 2 factor authentication to a PIX?

Hi guys, is it possible to set up 2 factor authentication using a tacacs+ server in the pix firewall? only want to use a tacacs+ server using aaa on the pix.

5 REPLIES
Community Member

Re: Setting up 2 factor authentication to a PIX?

It is dependant on your TACACS server having the 2 factor support. The PIX sends athentication request to the aaa server for serial|telnet|ssh|http|enable that I know of. If you are authenticating vpn clients via TACACS I am not sure off the top of my head.

cheers

Community Member

Re: Setting up 2 factor authentication to a PIX?

We are running accross the same thing here, my question is what tacacs+ or tacacs server supports two factor authentication?

Community Member

Re: Setting up 2 factor authentication to a PIX?

according to this article: "The Power Behind RSA SecurID® Two-factor User Authentication: RSA ACE/Server"

page 4of11 it seems that tacacs+ supports server sessions.

http://www.opsec.com/solutions/partners/downloads/rsa_securid_whitepaper.pdf

"Most leading remote access server, firewall,

VPN and router products have built-in RSA ACE/Agents for compatibility with RSA SecurID two-factor authentication. In addition, both TACACS+ and RADIUS authentication support RSA ACE/Server sessions."

anyways, in general, what is the best way to set up 2 factor authentication on a pix ?

Re: Setting up 2 factor authentication to a PIX?

Hi .. the best two factor authentication that I have come across is always RSA secureID. Basically you configure the AAA options in your PIX as radius client while the RSA ACE is the radius server.

This is a quick example that I have set up in the past using an ASA.

I hope it helps .. please rate it if it does !!!

aaa-server RADIUS_SERVERS protocol radius

aaa-server RADIUS_SERVERS host RSA_SERVER

timeout 5

key ********

tunnel-group GT_VPN_RSA type ipsec-ra

tunnel-group GT_VPN_RSA general-attributes

address-pool VPN_rsa_pool

authentication-server-group RADIUS_SERVERS

tunnel-group GT_VPN_RSA ipsec-attributes

pre-shared-key *

For configurating on a PIX running 6.XX you can check the command reference under aaa-server and vpngroup commands

http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_command_reference_book09186a008017284e.html

I hope it helps ... please rate it if it does !!!

Community Member

Re: Setting up 2 factor authentication to a PIX?

well, I dont want to radius at all if possible.

So if you dont have a radius server, what are my options?

500
Views
0
Helpful
5
Replies
CreatePlease to create content