FTD Anyconnect Client Certificate Authentication
Assume client PC has domain issued user certificate. When first time user connects to AC URL via browser, browser will prompt to ask user to select the certificate, which will be used for AC. authentication
Use Case A:
Authentication has Client Certificate Only, map username from UPN
Session Type: AnyConnect
Username : admin1@lab.local Index : 60
Assigned IP : 192.168.168.1 Public IP : 192.168.2.238
Protocol : AnyConnect-Parent SSL-Tunnel DTLS-Tunnel
License : AnyConnect Premium
Encryption : AnyConnect-Parent: (1)none SSL-Tunnel: (1)AES-GCM-256 DTLS-Tunnel: (1)AES-GCM-256
Hashing : AnyConnect-Parent: (1)none SSL-Tunnel: (1)SHA384 DTLS-Tunnel: (1)SHA384
Bytes Tx : 19527 Bytes Rx : 6112
Group Policy : Employees Tunnel Group : Cert-Auth
Login Time : 15:54:31 UTC Thu Oct 13 2022
Duration : 0h:00m:10s
Inactivity : 0h:00m:00s
VLAN Mapping : N/A VLAN : none
Audt Sess ID : c0a802040003c000634834b7
Security Grp : none Tunnel Zone : 0
>
Use Case B:
Add ISE for Authorization and Accounting, ISE is configured with Authorization only
ISE Authentication policy is bypassed
Add ISE for Authorization and Accounting, ISE is NOT configured with Authorization only
ISE Authentication policy is checked and failed, from capture, username and password are both "admin1@lab.local" in radius Request.
But user still connected even radius Reject is returned.
Miss-configuration Scenario 2:
Add ISE for Authorization and Accounting, ISE is NOT configured with Authorization only
ISE Authentication policy is checked and failed, from capture, username and password are both "admin1@lab.local" in radius Request.
On AC Connection Profile, enabled: "Allow connection only if user exists in Authorization database"
User got Authentication failed, couldn't connect to AC
Configure radius server for Authorization Only When Authentication Method is "Certificate Only"
When Radius ISE is configured with Authorize Only, Access-request has no User-Password Attribute and Service-Type is Authorize-Only(17), ISE will skip Authenticating Policy, then check Authorization Policy to allow or deny the user.
Use Case C:
When Authentication Methord is "Client Certificate & AAA", and Authorization is ISE, user gets prompt input username and password. there will be two Access-request, 1st is from Authentication, 2nd is from Authorization. if ISE is not Authorize only, both user-name and user-password will be admin1, caused 2nd Access-request get Access-Reject, even if the 1st one get Access-Accept, user will not able able to connect.
Conclusion:
As long as "Client Certificate" Authentication Method is used, ISE should be configured with Authorize Only.
===========
Configure Secure Client Certificate Authentication on FTD Managed by FMC
https://www.cisco.com/c/en/us/support/docs/security/secure-client-5/221839-configure-secure-client-certificate-auth.html
===============
Notes:
if the cert is not domain issued, the PC needs both cert and private key, CSR can be generated from PC computer or user store with task "Create custom request..."
Comments
Post a Comment