Configuring RSA Two-Factor Authentication

About this task:

 You can configure the RADIUS or AD server as the authentication agent in the RSA server, and use the server in Secure Firewall Management Center as the primary authentication source in the remote access VPN.

When using this approach, the user must authenticate using a username that is configured in the RADIUS or AD server, and concatenate the password with the one-time temporary RSA token, separating the password and token with a comma: password,token.

In this configuration, it is typical to use a separate RADIUS server (such as one supplied in Cisco ISE) to provide authorization services. You would configure the second RADIUS server as the authorization and, optionally, accounting server.

Before you begin:

Ensure that the following configurations are complete before configuring RADIUS two-factor authentication on Secure Firewall Threat Defense:

On the RSA Server

  • Configure RADIUS or Active Directory server as an authentication agent.

  • Generate and download the configuration (sdconf.rec) file.

  • Create a token profile, assign the token to the user, and distribute the token to the user. Download and install the token on the remote access VPN client system.

For more information, see RSA SecureID Suite documentation.

On the ISE Server

  • Import the configuration (sdconf.rec) file generated on the RSA server.

  • Add the RSA server as the external identity source and specify the shared secret.

Procedure

Do This

More Info

Step 1

Log on to your Secure Firewall Management Center web interface.

Step 2

Create a RADIUS server group.

RADIUS Server Group Options

Step 3

Create a RADIUS Server object within the new RADIUS server group, with RADIUS or AD server as the host and with a timeout of 60 seconds or more.

RADIUS Server Group Options

Note

The RADIUS or AD server must be the same server that is configured as the authentication agent in RSA server.

For two-factor authentication, make sure that the timeout is updated to 60 seconds or more in the Secure Client Profile XML file as well.

Step 4

Configure a new remote access VPN policy using the wizard or edit an existing remote access VPN policy.

Create a New Remote Access VPN Policy

Step 5

Select RADIUS as the authentication server and then select the newly-created RADIUS server group as the authentication server.

Configure AAA Settings for Remote Access VPN

Step 7

Deploy the configuration changes.

Deploy Configuration Changes