Add a RADIUS external authentication object for Security Cloud Control

Add a RADIUS server to support external users for device management.

Note that supports only these six attributes in the access request of the RADIUS authentication:

NAS-IP-Address : Used in UI and CLI authentication
NAS-Identifier : Used in CLI authentication
NAS-Port : Used in UI and CLI authentication
NAS-Port-Type : Used in CLI authentication
Service-Type : Used in UI and CLI authentication
Calling-Station-Id : Used in CLI authentication

Note

NAS-Port attribute: The attribute value is dynamically generated and cannot be configured.
NAS-Port-Type attribute: The server always sets the attribute value to Virtual, regardless of whether the device is virtual or physical. of whether the is virtual or physical.
NAS-Identifier attribute: The attribute value is always sshd.
Service-Type attribute: supports only Login and Authenticate Only service types

Before you begin

Procedure

Step 1

Choose Administration > Users. Click External Authentication.

Step 2

Click Add icon () Add External Authentication Object and set the Authentication Method to RADIUS. Enter a Name and optional Description.

Step 3

Check the RADIUS Server-Enabled Message Authenticator check box. This requires the Message-Authenticator attribute in all RADIUS responses and ensures that every response from the RADIUS server is securely verified by the Firewall Threat Defense .

The feature is enabled by default for new RADIUS servers. Enable it for existing servers after the upgrade. Enable message authenticators to protect your firewalls from potential attacks. Ensure that your RADIUS server has the Message-Authenticator configuration.

Note	The Message-Authenticator attribute persists whether the feature is enabled or disabled. The server always requires this attribute. When the check box is enabled in the configuration, it also becomes a requirement from the Cloud-Delivered Firewall Management Center .

Step 4

For the Primary Server, enter a Host Name/IP Address. Then, change the Port from the default and then enter the RADIUS Secret Key.

Step 5

(Optional) Enter the Backup Server parameters, then provide the RADIUS-Specific Parameters.

Enter the Timeout in seconds before retrying the primary server, between 1 and 1024. The default is 30.
Enter the Retries before rolling over to the backup server. The default is 3.
In the fields that correspond to user roles, enter the name of each user or identifying attribute-value pair that should be assigned to those roles.

Separate usernames and attribute-value pairs with commas.

Example:

If you know all users who should be Security Analysts have the value Analyst for their User-Category attribute, you can enter User-Category=Analyst in the Security Analyst field to grant that role to those users.

Example:

To grant the Administrator role to the users jsmith and jdoe , enter jsmith, jdoe in the Administrator field.

Example:

To grant the Maintenance User role to all users with a User-Category value of Maintenance , enter User-Category=Maintenance in the Maintenance User field.
Select the Default User Role for users that do not belong to any of the specified groups.

After you change a user's role, save and deploy the updated external authentication object. Remove the user from the Users screen. The system adds the user when they log in again.

Step 6

(Optional) Define Custom RADIUS Attributes.

If your RADIUS server returns values for attributes not included in the dictionary file in /etc/radiusclient/, define those attributes. You must define them if you plan to use the attributes to set roles for users.You can locate the attributes returned for a user by looking at the user’s profile on your RADIUS server.

Note	Before you configure custom RADIUS attributes, obtain the Attribute ID and Type from the RADIUS server administrator. If there is a mismatch, the RADIUS packet capture displays the custom RADIUS attribute as `Unassigned Attribute`.

Enter an Attribute Name.

Enter an attribute name using alphanumeric characters. Separate words in an attribute name with dashes instead of spaces.
Enter the Attribute ID as an integer.

Enter an integer for the attribute ID. Make sure the attribute ID does not conflict with any existing IDs in the etc/radiusclient/dictionary file.
Choose the Attribute Type from the drop-down list.

You also specify the type of attribute: string, IP address, integer, or date.
Click Add to add the custom attribute.

When you create a RADIUS authentication object, a new dictionary file for that object is created on the device in the /var/sf/userauth directory. Any custom attributes you add are added to the dictionary file.

Example:

If a RADIUS server is used on a network with a Cisco router, you might want to use the Ascend-Assign-IP-Pool attribute to grant a specific role to all users logging in from a specific IP address pool. Ascend-Assign-IP-Pool is an integer attribute that defines the address pool where the user is allowed to log in, with the integer indicating the number of the assigned IP address pool.

To declare that custom attribute, you create a custom attribute with an attribute name of Ascend-IP-Pool-Definition , an attribute ID of 218 , and an attribute type of integer .

You could then enter Ascend-Assign-IP-Pool=2 in the Security Analyst (Read Only) field to grant read-only security analyst rights to all users with an Ascend-IP-Pool-Definition attribute value of 2.

Step 7

(Optional) In the CLI Access Filter area Administrator CLI Access User List field, enter the usernames that should have CLI access, separated by commas.

Enter usernames that match those on the RADIUS server. Usernames must be valid Linux usernames:

Maximum of 32 alphanumeric characters, plus period (.), hyphen (-), and underscore (_).

(_)
All letters must be lowercase.
"The username cannot start with a hyphen (-), cannot be composed entirely of numbers, and cannot include an at sign (@) or a slash (/).

Leave the field blank to disable RADIUS authentication for CLI access.

Note	Users with CLI access can gain Linux shell access with the expert command. Linux shell users can obtain root privileges, which can present a security risk. Make sure that you restrict the list of users with CLI or Linux shell access.

Note	Remove any internal users that have the same user name as users included in the shell access filter. For the Cloud-Delivered Firewall Management Center , the only internal CLI user is admin, so do not also create an admin external user.

Step 8

(Optional) Click Test to test Cloud-Delivered Firewall Management Center connectivity to the RADIUS server.

Step 9

(Optional) You can also enter Additional Test Parameters to test user credentials for a user who should be able to authenticate: enter a User Name and Password, and then click Test. Click Save. For more information, refer to Enable external authentication for users on the CDO.

Tip

If you mistype the name or password of the test user, the test fails even if the server configuration is correct. To verify that the server configuration is correct, click Test without entering user information in the Additional Test Parameters field first. If that succeeds, supply a user name and password to test with the specific user.

Example:

To test if you can retrieve the JSmith user credentials at the Example company, enter JSmith and the correct password.

Simple user role assignments

This figure illustrates a sample RADIUS login authentication object for a server running Cisco Identity Services Engine (ISE) with an IP address of 10.10.10.98 on port 1812. No backup server is defined.

The figure illustrates a sample RADIUS login authentication object for a Cisco Identity Services Engine (ISE) server, detailing parameters such as the server's IP address, port, timeout, and retry settings.

This example shows RADIUS-specific parameters, including the timeout (30 seconds) and number of failed retries before the Secure Firewall System attempts to contact the backup server, if any.

This example illustrates important aspects of RADIUS user role configuration:

Users ewharton and gsand are granted web interface Administrative access.

The user cbronte is granted web interface Maintenance User access.

The user jausten is granted web interface Security Analyst access.

The user ewharton can log into the device using a CLI account.

This graphic depicts the role configuration for the example:

The graphic illustrates the role configuration for users based on an attribute-value pair, showing how different user roles are assigned in the system.

Roles for users matching an attribute-value pair

You can use an attribute-value pair to identify users who should receive a particular user role. If the attribute you use is a custom attribute, you must define the custom attribute.

This figure illustrates the role configuration and custom attribute definition in a sample RADIUS login authentication object for the same ISE server as in the previous example.

In this example, however, the MS-RAS-Version custom attribute is returned for one or more of the users because a Microsoft remote access server is in use. Note the MS-RAS-Version custom attribute is a string. In this example, all users logging in to RADIUS through a Microsoft version 5.00 remote access server should receive the Security Analyst (Read Only) role, so you enter the attribute-value pair of MS-RAS-Version=MSRASV5.00 in the Security Analyst (Read Only) field.

The image illustrates the configuration of a RADIUS external authentication object, highlighting the MS-RAS-Version custom attribute and its value for users logging in through a Microsoft remote access server.