[KB3481] How do I configure my Cisco® ASA SSL VPN device for use with ESET Secure Authentication?

Introduction

This article describes how to configure a Cisco® ASA SSL VPN device to authenticate users against an ESA Server. Before proceeding, verify that you've installed the RADIUS Server component of ESET Secure Authentication and can access the RADIUS service that allows external systems to authenticate users.

Before your Cisco® ASA SSL VPN device can use the ESA Server to authenticate users via RADIUS, it must be set up as a RADIUS client on the ESA Server. Next, your server running the ESA RADIUS service must be setup as a RADIUS Server on the Cisco® ASA SSL VPN device. Once these configurations have been specified, you can start logging into your Cisco® ASA SSL VPN device using ESA OTPs.

Step I - RADIUS client configuration

To allow the Cisco® ASA SSL VPN device to communicate with your ESA Server, you must configure the Cisco® ASA SSL VPN device as a RADIUS client on your ESA Server:

1. Log in to ESA Web Console.
2. Navigate to Components > RADIUS and locate the hostname of the server running the ESA RADIUS service.
3. Click the hostname, then click Create New Radius Client.
4. In the Basic Settings section:
   1. Give the RADIUS client a memorable name for easy reference.
   2. Configure the IP Address and Shared Secret for the Client so that they correspond to the configuration of your VPN appliance. The IP address is the internal IP address of your appliance. If your appliance communicates via IPv6, use that IP address along with the related scope ID (interface ID).
   3. The shared secret is the RADIUS shared secret for the external authenticator that you will configure on your appliance.
5. In the Authentication section apply the settings shown in Figure 1-1 below.

Figure 1-1

ESA has now been configured to communicate with the Cisco® ASA SSL VPN device. You must now configure the Cisco® ASA SSL VPN device to communicate with the ESA Server.

Step II - Configure your Cisco® ASA device

Follow the steps below:

1. Log into your Adaptime Services Device Manager.
2. Navigate to Configuration → Remote Access VPN.
3. Click Clientless SSL VPN → Connection Profiles and ensure that the check box below Allow access is selected on the relevant interface (see Figure 2-1, step 1).
4. Click Add under Connection Profiles (see Figure 2-1, step 2).
   1. Navigate to the Basic tab of the Add Clientless Remote Access Connection Profile window.
   2. Type a name for your connection profile (for example, ESA).
   3. Ensure that the authentication method is set to AAA only.
   4. Click Manage in the Authentication section and define a new service group:
      1. Click Add under AAA Service Groups.
      2. Enter a name for the new group (for example, ESA-RADIUS), ensure that the protocol is set to to RADIUS and click OK.
      3. Select your Server Group and click Add in the Servers in selected group panel.
      4. Set the following parameters to the values shown below (see Figure 2-2):
         1. Interface Name: The ASA interface on which your ESA RADIUS server may be reached
         2. Server Name or IP Address: The hostname/IP address of your ESA RADIUS server
         3. Timeout: 30 seconds
         4. Server Authentication Port: 1812
         5. Server Account Port: N/A since ESA does not support RADIUS accountint, but set to 1813
         6. Retry Interval: 10 seconds
         7. Server Secret Key: Your RADIUS server shared secret (see Figure 1-1)
         8. Microsoft CHAPv2 Capable: Not selected
      5. Click OK
      6. Click OK

Figure 2-1

Figure 2-2

Step III - Test the connection

To test the newly configured connection:

1. Connect to your ASA VPN using an account with Mobile Application 2FA using ESA enabled. When prompted for a password, append the OTP generated by the Mobile Application to your AD password. For example, if the user has an AD password of Esa123 and an OTP of 999111, type Esa123999111.

Troubleshooting

If you are unable to authenticate via the ESA RADIUS server, ensure you have performed the following steps:

1. Run a smoke test against your RADIUS server, as per Verifying ESA RADIUS Functionality.
2. If no faults were fixed and you are still unable to connect, revert to an existing sign-in configuration (that does not use 2FA) and verify that you are able to connect
3. If you are still able to connect using the old settings, restore the new settings and verify that there is no firewall blocking UDP 1812 between you VPN device and your RADIUS server
4. If you are still unable to connect, contact ESET technical support.