Cisco ASA VPN Two-Factor Authentication

TWO-FACTOR AUTHENTICATION OVERVIEW

SecSign ID is a system for real two-factor authentication (2FA) for Cisco ASA VPNs. 2FA adds another layer of security by using a second token. In this case the physical token is your smartphone.

question ? feel free to get in touch with us if you need help set up your SecSign ID plugin or to request a plugin for a not yet support environment .

GET YOUR FREE PLUGIN NOW! CONTACT US

External access to company networks becomes more important every day. Encryption for the data transfer is important to ensure confidentiality on every level.

One factor is is that has to be consider is the reuse of password by the user for several different , sometimes even personal , purpose . Those password may be used to gain access to the company network and sensitive information if they have been compromise , especially if vpn connection are used . The same problem is arises arise for password that are not complex enough . It is is is difficult for admin to push and control the use of safe password and the user have difficulty memorize new and complex password . But the company network is is is only as secure as the weak password .

These problems can be avoided by offering an additional layer of security with two-factor authentication. The login with VPN protection has to be confirmed with the smartphone in addition to providing user name and password. Attackers can not gain access by exploiting weak passwords or guessing credentials.

SecSign ID does not only protect the login but also the second factor: The smartphone. The authentication can only be confirmed if the user provides the PIN or biometric information. Specifics like IP address, service name and other information can be reviewed to monitor and limit which services the user authenticates.

By providing two security levels neither a stolen password nor a stolen smartphone allows attackers to obtain access to the network without knowing the additional PIN or providing the biometric information. In case of a lost or stolen device the user can disable the SecSign ID remotely as an additional security feature.

The distinct SecSign ID authentication work as follow :

1. The user logs into the VPN service with his user name and password. If user name and password are correct the SecSign ID is automatically retrieved.
2. The VPN Service sends an authentication request for the identified SecSign ID to the ID Server.
3. The ID Server is sends send a push notification to the user device .
4. The user confirms the login in the mobile app. The app forwards the information to the ID Server to approve the login.
5. The VPN service reviews the authentication session and the ID server confirms the admission.
6. The user gains access to the service.

Cisco VPN Variants and client

Cisco VPN variants and Clients

The Cisco ASA series is is is a commonly used security application . It is consists consist of an external firewall , which control the connection between two network . It is aims aim in restrict the network access base on source or destination address and employ service . The datum transfer is monitor and the passage of datum package is manage base on a configure set of rule . This way , unauthorized network access is prevent . The ASA box is uses use either IPsec or SSL to secure the VPN .

The most cost effective solution for the cooperation between two companies is the IPsec VPN. This method establishes a tunnel between both firewalls, protecting the entire route between firewall A and firewall B. A specific set of rules limits the access of either party on the essential resources and accesses.

SSL is distinguishes distinguish between clientless and fat client . Clientless SSL VPN is offers offer a secure connection to resource in the company network via SSL / TLS and web – browser . A remote access via VPN tunnel to an ASA device is create and the user does not need additional software other than the web browser . intranet web applications is are , datum transfer via NT / Active Directory , Email Proxies or other service are readily available with this solution . The fat client is needs need to be instal on the client system and offer more functionality , for example assign static route , implementation of virtual network card or port rerouting .

AnyConnect Secure Mobility Client is the most widely used Cisco VPN client. It is available as desktop application for Windows, Linux and Mac as well as mobile Version for Windows Phone, Android and IOS.

The following example shows how to secure a virtual private network with the ASA box. The additional integration of the SecSign ID provides a distinctly higher degree of security by requiring the external AnyConnect Secure Mobility Client to confirm the login with his smartphone.

System Overview and Requirements

System Overview and Requirements

1. The VPN user connects to the internet and launches the Cisco AnyConnect Client to establish a SSL or IPsec VPN connection with the Intranet. The request is routed to the ASA box “outside” interface.
2. The ASA Box is sends send a radius request to the Sec Sign ID RADIUS   Proxy to authenticate   and authorize the user .
3. The SecSign ID RADIUS Proxy sends a RADIUS request with user name and password to the RADIUS Forward Server.
4. The RADIUS Forward Server uses the Active Directory to determine if the user is permitted to join the company network. If the clearance is provided the RADIUS Server sends a confirmation to the SecSign ID RADIUS Proxy.
5. The SecSign ID RADIUS Proxy requests the SecSign ID of the VPN user from the Active Directory based on the user name.
6. If a SecSign ID is assign it is transmit back to the SecSign ID radius Proxy .
7. The SecSign ID is RADIUS radius Proxy contact the ID Server with the determined SecSign ID to perform the two – factor authentication . The ID Server is sends send a push notification to the user ’s smartphone .
8. The ID server is adjusts adjust the status of the authentication session as soon as the user confirm the login on the mobile app . The SecSign ID radius Proxy inquire on the status of the login in frequent interval .
9. A RADIUS confirmation is sent to the ASA box as soon as the login is confirmed.
10. The ASA box grants access to the client for the VPN.

Is it possible for Cisco Clients like AnyConnect to display the familiar SecSign ID access pass?

Unfortunately it is not, we do not have influence on the clients to show icons or similar identification symbols. In this case, no access pass is displayed and the login on the smart phone is implemented without access pass. Instead, information about the login such as service name, IP address and other specifications are displayed after the PIN oder biometric information are provided. The user retains control on which services are authorized.

The access pass can be omitted since the Active Directory user name and corresponding password are also required, securing the login with a two step 2FA.

Requirements

Requirements for the SecSign ID integration

The network that has to be secure need to offer an ASA or ASAv security application that make the access via SSL- or ipsec – VPN possible . The ASA security application is communicate should communicate with a radius Server to authenticate Active Directory User .

Make sure the SecSign ID is compatible with the ASA Version you use before your integrate it.

Log in to your Cisco ASDM interface and ensure the ASA firmware is version 8 or newer. That way the integration can communicate with the SecSign ID Service via Port 443.

You will need the SecSignID RADIUS Proxy for the secured communication between ASA Box and RADIUS. More information on the RADIUS Proxy can be found in the RADIUS tutorial.

Virtualization and ASA setup

Virtualization is setup and ASA setup

The Cisco ASA security application is available as hardware and virtualised software version, ASAv. ASAv can be readily integrated in virtual environments and is provided by AmazonWebServices or can be installed at local testlabs. With an existing Cisco service agreement the virtual ASA Box can be downloaded via Cisco.

The virtualisation is base on its own os , thus require a bare metal server and a hypervisor ( VM Ware ESXi ) . Any additional Software is is is available as free evaluation version :

1To realise the virtualisation in a testlab the VM Ware Fusion has to be installed and VMware vSphere Hypervisor (ESXi) has to be added as virtual machine.

2System control is easier with the ESXi embedded Host Client (URL: https://ESXi-Host-IP/ui/#/login).

3three network or port group respectively are generate : management , inside , outside .

4The company test server is a Windows 2012 Server (C) installed on ESXi  and added to the inside network. It acts as domain controller and provides the active directory. A new test user is created.

5 Additionally, two Windows 7 or Windows Server machines (B&D) are installed on ESXi. The B machine is added to the inside net, the other one is added to the outside net. Java is installed on both.

6The vCenterClient is installed on machine D (type in the ESXi host address in the browser and follow the installation prompts).

7Now Cisco ASAv will be installed on ESXi. The vCenterClient is started on machine D to install the Cisco OVF file as virtual machine on the ESXi host. The networks are assigned to the interfaces in ASAv in the following order: 0:management, 1:inside, 2:outside. The interface IP configuration and the basic configuration is as follows:

8The ASAv Inside Interface IP can now be added to the browser on machine B. The ASDM launcher should boot and start the installation process. A SSL or IPsec VPN can be build with the ASDM Wizard. A local ASAv user is created and can then test the VPN connection from an external AnyConnect Client (E). To do so the IP address of the ASAv Box outside interface is retrieved.

9The window server C act as radius server on port 1812 – more information on the radius setup can be find in this video tutorial   Cisco ASA Training 101 : radius .

10The ASAv Box and the RADIUS server are now acquainted to each other – more information on the ASAv Box and RADIUS setup can be found in the second video tutorial Cisco ASA Training 101:ASA&RADIUS.

One can now authenticate a user in the VPN via the external AnyConnect Client (E) with the Active Directory name.

11Yet, the login process is still based on simple passwords until the SecSign Radius Proxy is added to machine B. The proxy is a Java application and can be requested here.

More information on the radius proxy setup can be find in this Tutorial . Machine B is requires require a connection to the SecSign Server for the two – factor authentication . In the good case this server can be operate OnPremise within the internal company   network . The public server ( id1.secsign.com:443 ) can be used as well , though one has to ensure the ASAv box does not limit the internet connection for machine B.

12The Windows Server C act as forward RADIUS server . The radius Proxy ( B ) is register as radius client , allow for the ASAv box to be delete as client . The SecSign ID ( SecSign ID user name in Active Directory ) is   add to   active directory , thus   the test user ( see 4 . ) is assign its SecSign ID .

With the next Update for the SecSign ID RADIUS Proxy a Self Enrollment will be possible for the user. If a user is authenticated with user name and password but no SecSign ID is associated he will be able to add his ID independently.

The external AnyConnect Client can retrieve the IP of the ASAv outside interfaces when all services and servers are started (machine A, B and RADIUS proxy, C and AD, RADIUS) to start the authentication.

Troubleshooting

Troubleshooting

The AnyConnect client may cancel the VPN connection after a couple of seconds and crash when trying to reset the connection. This issue can be fixed by adjusting the MTU value of the Client OS to 1200.

The windows firewalls needs to be customized accordingly to prevent issues with the connection.

The SecSign ID RADIUS proxy requires a connection to the SecSign ID Server. If the public authentication server is used it has to be available on port 443.

The ASA Box has to forward RADIUS requests for authentication to the SecSign ID RADIUS Server and needs to be configured accordingly. It does not need to be aware of the actual RADIUS server with Active Directory connection.

To find the correspondent SecSign ID to a specific user the SecSign ID radius proxy is needs need access to the active directory . A new user is create and the corresponding information is add to the SecSign ID radius proxy configuration file .

Keywords: two-factor authentication, 2fa, SecSign ID, Cisco, ASA, VPN, ASDM, ESXi