In this session we will be setting up remote access VPN using Certificate as an authentication mechanism but for Authorisation we will use Cisco ISE as a Radius Server.

1. Remote Access VPN ASA
Certificate Authentication
ISE Authorization
Dhruv Sharma

2. Introduction
• In this session we will configure Remote Access VPN on cisco ASA with authentication using
Certificate but Authorization using ISE via Active Directory.
• Certificate based authentication in conjunction with Anyconnect VPN, the certificate
authentication process terminates on the ASA. Since the ASA terminates the authentication
process without passing the certificate to ISE, So when the request comes to ISE it tries to process
a full authentication. There is no password in the TCP packet, thus authentication fails.
• Thus, we need to bypass Authentication on the ISE for such communication.
Certificate
Authentication
Locally on ASA
Active Directory
Authorization on
cisco ISE

3. Lab Topology

4. • Task 1: Certificate Based Authentication

5. Step 1 of 3: Install the
Root CA certificate into
ASA
• Install the Root CA into ASA

6. Step 2 of 3 – Setup
Tunnel Group
!
tunnel-group vpn.w365.vpnet.com general-attributes
tunnel-group vpn.w365.vpnet.com webvpn-attributes
authentication certificate
group-alias vpn.w365.vpnet.com enable
!

7. Step 3 of 3 – Setup Group Policies
!
group-policy GroupPolicy_sales.w365.vpnet.com internal
group-policy GroupPolicy_sales.w365.vpnet.com attributes
wins-server none
dns-server value 192.168.111.5
vpn-tunnel-protocol ikev2 ssl-client ssl-clientless
split-tunnel-policy tunnelspecified
split-tunnel-network-list value split-acl
default-domain value cisco.com
split-dns value cisco.com
address-pools value sales
webvpn
anyconnect keep-installer installed
anyconnect profiles value GroupPolicy_sales.w365.vpnet.com type
user
always-on-vpn profile-setting
!
!
group-policy GroupPolicy_finance.w365.vpnet.com internal
group-policy GroupPolicy_finance.w365.vpnet.com attributes
wins-server none
dns-server value 192.168.111.5
vpn-tunnel-protocol ikev2 ssl-client ssl-clientless
split-tunnel-policy tunnelspecified
split-tunnel-network-list value split-acl
default-domain value cisco.com
split-dns value cisco.com
address-pools value finance
webvpn
anyconnect keep-installer installed
anyconnect profiles value GroupPolicy_finance.w365.vpnet.com type
user
always-on-vpn profile-setting
!

8. Verification
• User Attempt to connect

9. Verification
• Certification Based Authentication is performed.

10. Verification
• User is successfully connected.

11. • Task 2: Setup Authorization

12. • Task 2: Part 1- Setup ASA for Authorization

13. Part 1: Step 1 of 2 -Setup ASA for Authorization
• Following extra configuration must be added into ASA
!
ciscoasa(config)# sh running-config aaa-server
aaa-server ISE protocol radius
interim-accounting-update
aaa-server ISE (management) host 192.168.111.6
key *****
!

14. Part 1: Step 2 of 2 -Setup ASA for Authorization
!
tunnel-group vpn.w365.vpnet.com type remote-access
tunnel-group vpn.w365.vpnet.com general-attributes
authorization-server-group ISE
authorization-required
tunnel-group vpn.w365.vpnet.com webvpn-attributes
authentication certificate
group-alias vpn.w365.vpnet.com enable
!

15. • Task 2: Part 2- Setup ISE for Authorization

16. Part 2: ISE: Step 1 of 6
• Add Network Device for ASA

17. Part 2: ISE: Step 2
of 6
• Perform Active Directory Integration and
fetch the AD Groups.

18. Part 2: ISE: Step 3 of 6
• Create right Authorization Profile

19. Part 2: ISE: Step 4 of 6
• Create Access Policy

20. Part 2: ISE: Step 5 of 6
• Authentication Policy

21. Part 2: ISE: Step 6 of 6
• Authorization Policy

22. Packet Capture Analysis

23. Packet Capture Analysis

24. Packet Capture Analysis

25. Packet Capture Analysis

26. Packet Capture Analysis