> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation.

# Cisco Identity Services Engine

This procedure describes how to integrate a Cisco ISE Series Adaptive Security Appliance and Identity as a Service. The Cisco ISE allows your remote access Gateway (IPsec or SSL) to communicate with Identity as a Service. The Cisco ISE allows your remote access Gateway (IPsec or SSL) to communicate with Identity as a Service. You can integrate Identity as a Service with a RADIUS server. In this environment, the Identity as a Service RADIUS agent intercepts messages between the VPN server and the RADIUS agent.

## Supported authentication methods

| Authentication method                 | Notes                                                                                                                                                                                              | Supported protocols |
| ------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------- |
| Password                              | Password authentication is first-factor authentication with Identity as a Service password feature.                                                                                                | PAP                 |
| RADIUS                                | RADIUS authentication is first-factor authentication with a RADIUS server.                                                                                                                         | PAP                 |
| External                              | External authentication is first-factor authentication with an LDAP-compliant directory or a Windows domain controller through Kerberos.                                                           | PAP                 |
| Grid\*                                | Two-step authentication only.                                                                                                                                                                      | PAP                 |
| Token                                 | Hardware/software                                                                                                                                                                                  | PAP                 |
| Temporary Access Code                 |                                                                                                                                                                                                    | PAP                 |
| One-time password                     | Two-step authentication only                                                                                                                                                                       | PAP                 |
| Knowledge-based questions and answers | The RADIUS proxy only supports a single question and answer. For CHAP and MS-CHAP, the answer must be an exact match. Two-step authentication only.                                                | PAP                 |
| Risk-based                            | IP/Geolocation only. Machine authentication must be disabled from the risk-based policies. Normal or enhanced security level (not both). The VPN server must transmit the VPN client's IP address. | PAP                 |

warning

The PA-VM supports only CHAP authentication methods with RADIUS.

## Prerequisites

Complete the following steps before integrating your authentication system with Identity as a Service:

1. Install and configure your first-factor authentication resource using the documentation provided by the vendor. The first-factor authentication resource can be a RADIUS server or an external authentication resource (a Local DB, LDAP-compliant directory or Windows domain controller through Kerberos).
2. Install and configure the RADIUS appliance using the documentation provided by the vendor. The device must be able to route traffic before integrating with Identity as a Service.
3. Install and configure Identity as a Service and an Identity as a Service Gateway (containing a RADIUS proxy agent). Take note of the shared secrets, IP addresses, and ports you use. You need this information to configure the RADIUS appliance and first-factor authentication resource.
4. If you want to configure your RADIUS appliance and first-factor authentication resource to recognize Identity as a Service user groups, you must define the Identity as a Service user groups first.

## Integrate Cisco ISE

Complete the following steps to integrate Cisco ISE with IDaaS.

### Step 1: Configure Cisco ISE as an AAA client

The following procedure describes how to configure the Cisco ASA to use the Cisco ISE. It is assumed that you are familiar with the administration interface of the CiscoASAv Series appliance. All examples use the Cisco ASDM interface.

To set up the Cisco ASAv Series appliance, you must add the Cisco ISE as an AAA (Authentication Authorization Accounting) client, and then configure an IPSec connection profile, or a Clientless SSL connection profile, or both.

1. Log into the Cisco ASDM Version 7.4(1) or later.

note
Before you run the ASDM launcher you must install or downgrade the Java version 7 update 45.

2. Click the **Configuration** tab.

3. Click **Remote Access VPN**. The **Introduction** page appears.

   ![Introduction Page](/assets/images/introduction-page-8853e103d33b264d0856691c9581612b.png)

4. In the **Configuration** > **Remote Access** VPN tree menu, expand **AAA Local Users Setup** and select **AAA Server Groups**.

   The **AAA Servers** **Group** page appears.

   ![AAA Servers Group Page](/assets/images/aaa-servers-group-page-14f6f5171b9eefe8b9c0eb20665aa4d0.png)

5. In the **AAA Server Groups** pane, click **Add**. The **Add AAA Server Group** dialog box appears.

   ![Add AAA Server Group Dialog](/assets/images/add-aaa-server-group-dialog-2c3c22412fa01c60cea9e7e67029ac8f.png)

6. In the **Add AAA Server Group** page, do the following:

   1. In the **AAA Server Group** field, enter the name of your AAA server group (for example, Identity as a Service).
   2. In the **Protocol** drop-down menu, select **LDAP**.
   3. Enter **5** in the **Max Failed Attempt**s field.
   4. Leave the other settings at the default values.
   5. Click **OK** to save your new AAA server group and close the dialog box. You are returned to the **AAA Servers Group** page.

7. In the **AAA Server Groups** pane, select the server group you just created (for example, Identity as a Service).

8. In the **Servers in the Selected Group** pane, click **Add**. The **Edit AAA Server** dialog box appears.

   ![Edit AAA Server Dialog](/assets/images/edit-aaa-server-dialog-f61a0bc406acac9dbbe8f8a1ea968882.png)

9. Configure the new AAA server by doing the following:

   1. In the **Interface Name** drop-down menu, select the appropriate interface.

   note
   The interfaces in this menu are the interfaces that you configured when you installed your Cisco ASAv Series appliance. Select an interface on the corporate network side of the appliance where the Active Directory server can be reached.

   2. In the **Server Name or IP Address** field, enter the IP address or host name of the Active Directory.

   3. In the **Timeout** field, select **20** seconds or you can increase timeout settings as per the requirement.

   4. Select the **Enable LDAP Over SSL** check box.

   5. For the **Server Type**, select **Microsoft** from the drop-down list.

   6. In the **Base DN** field, enter the domain name (for example, if your Active Directory has a domain name such as user.mycompany.com, then you need to specify **Base DN** dc=igsuser,dc=mycompany,dc=com).

   7. From the **Scope** drop-down list, select **All Levels beneath the Base DN**.

   8. Enter the **Naming Attribute** name (for example, sAMAccountName).

   9. In the **Login DN** field, enter the login domain name (for example, cn=administrator,cn=users,dc=iguser,dc=mycompany,dc=com).

   10. In the **Login Password** field, enter the Active Directory administrator account password.

   11. Leave the other settings at the default values.

   12. Click **OK** to save the new server.

10. To add a new RADIUS server, in the **AAA** **Server Groups** pane, click **Add**. The **Add AAA Server Group** dialog box appears.

    ![Radius Server Add AAA Server Group Dialog](/assets/images/radius-server-add-aaa-server-group-dialog-9b30be516f7ba76ef5134f9343e141ec.png)

11. In the **Add AAA Server Group** page, do the following:

    1. In the **AAA Server Group** field, enter the name of your AAA server group (for example, Cisco ISE).
    2. In the **Protocol** drop-down menu, select **RADIUS**.
    3. Enter 5 in the **Max Failed Attempts** field.
    4. Leave the other settings at the defaults values.
    5. Click **OK** to save your new AAA server group and close the dialog box. You are returned to the **AAA Servers Group** page.

12. In the **AAA Server Groups** pane, select the server group you just created (for example, Identity as a Service).

13. In the **Servers in the Selected Group** pane, click **Add**. The **Add AAA Server** dialog box appears.

    ![Add AAA Server Dialog](/assets/images/add-aaa-server-dialog-fb8396ef21b66f04fdc7889ba465628c.png)

14. Configure the new AAA server by doing the following:

    1. In the **Interface Name** drop-down menu, select the appropriate interface.

    2. In the **Server Name or IP Address field**, enter the IP address or host name of the Cisco ISE.

    3. In the **Timeout** field, set the overall request timeout for VPN to at least **90** seconds.

    note
    You need to increase this value if you are using TVS (Mobile ST) authentication. This can also be confirmed by tracking how long a VPN request actual waits before it fails due to a timeout.

    4. In the **Server Authentication Port** field, enter the port number of the RADIUS server where the Identity as a Service RADIUS proxy sends requests. The default Identity as a Service port is 1812. The port number may change if you are configuring multiple groups to work with Entrust Identity as a Service.

    5. From the **Retry Interval** drop-down menu, select **10** seconds.

    6. In the **Server Secret Key** field, enter the Cisco ISE shared secret.

    7. If required, change any other values to meet your organization's requirements.

    note
    You can leave the **Common Password** field with the default value because it is only used with a RADIUS authorization server. Entrust Identity as a Service provides only authentication.

    8. Select the **Microsoft CHAPv2 Capable** check box.

    9. Click **OK** to save the new server.

15. If required, add another AAA server group.

### Step 2: Configure a clientless Web SSL connection profile

This configuration lets users establish a secure, remote-access VPN tunnel to the corporate network using a web browser.

1. Log into the Cisco ASDM Version 7.4(1) or later.

note
Before you run the ASDM launcher you must install or downgrade the Java version 7 update 45. Use Cisco documentation guide to download ASDM setup.

2. Click the **Configuration** tab.

3. Click **Remote Access VPN**. The **Introduction** page appears.

   ![Introduction Page](/assets/images/introduction-page-8853e103d33b264d0856691c9581612b.png)

4. Select **Clientless SSL VPN Remote Access (using Web Browser)** on the right-pane in ASDM.

5. Click the **ASDM Assistant** link. The **ASDM Assistant** search results appear.

   ![ASDM Assistant Search Results](/assets/images/asdm-assistant-search-results-dd34407d68fe9d0cbb4e3c455cc92011.png)

6. Scroll the **ASDM Assistant** search results until you see the **Clientless SSL VPN Connection Profile**, as shown in the above screenshot.

7. Click the **Clientless SSL VPN Connection Profile** link. The **Connections Profile** page appears.

   ![Connections Profile Page](/assets/images/connections-profile-page-db3d38c847bf49371aed0c2dfb1a87ea.png)

8. In the **Connections Profile** pane, click **Add**.

   The **Add Clientless SSL VPN Connection Profile** page appears.

   ![Add Clientless SSL VPN Connection Profile Page](/assets/images/add-clientless-ssl-vpn-connection-profile-page-4b0e5180683e0a3f5076d058f491f244.png)

9. In the tree view, select **Basic** and then complete the following:

   1. In the **Name** field, enter a name for the clientless connection profile.
   2. In the **Aliases** field, enter an alias for the connection profile. The alias is what the user will select from on the Web SSL login page. If the alias contains a space, enclose it in quotation marks (for example, "Sample Alias").
   3. For the **Authentication Method**, select **AAA**.
   4. From the **AAA Server Group** drop-down list, select the **Active Directory** server group.
   5. From the **DNS Server Group** drop-down list, select the **DefaultDNS** server group.
   6. In the **Servers** field, enter the IP address of the DNS server group.
   7. In the **Domain Name** field, enter the DNS domain name.
   8. From the **Group Policy** drop-down list, select a group policy.
   9. For the **Enable clientless SSL VPN** protocol setting:
      - Select this option when using browser-based SSL VPN access.
      - Deselect this option when using the AnyConnect client in Web Launch mode.

note
Consult the Cisco documentation for more information about this option.

10. In the tree view, expand **Advanced > Secondary Authentication**.

    ![Secondary Authentication Page](/assets/images/secondary-authentication-page-5acf6eb03bc1e0c24400c3d0f0c94699.png)

11. In **Server Group** drop-down list, select the secondary authentication type **Cisco ISE**.

12. Select the check box **Use primary username (Hide secondary username on the login page)** if you do not want to use the secondary username.

13. Click **OK** to close the **Add Clientless SSL VPN Connection Profile** dialog box.

14. In the tree view, expand **Clientless SSL VPN Access** and click **Connection Profiles**. The **Connection** **Profiles** page appears.

    ![Connection Profiles Page](/assets/images/connection-profiles-page-badb160d55d694c933fba5f6f1d4eba7.png)

15. Under **Login Page Setting**, select **Allow user to select connection profile on the login page** if you want to allow users to select a connection profile on the login page.

note
If you did not select the **Allow user to select connection profile on the login page** option, you must add a group URL to the connection profile.

16. Add a group URL to the connection profile by doing the following:

    1. In the tree view, expand **Clientless SSL VPN Access > Advanced** and select **Group Alias/Group URL**.

       ![Group Alias/Group URL Page](/assets/images/group-alias-group-url-page-8410dcd421b72fea8b6aff0913194da3.png)

    2. In the **Group URLs** pane, click **Add**. The **Add Group URL** dialog box appears.

       ![Add Group URL Dialog](/assets/images/add-group-url-dialog-2a33daeb4def725a3ab0bffe73c326bf.png)

    3. In the **URL** field, enter the URL with the group name. For example, `https://mycompany.com/salesvpn`

    4. Select the **Enabled** check box.

    5. Click **OK** to close the **Add Group UR**L dialog box and add the group URL.

17. Click **Apply** to save the changes.

18. You have now configured an Adaptive Security Appliance for groups configured to use a Web VPN tunnel.

### Step 3: Configure a Cisco AnyConnect VPN connection profile

This configuration establishes a VPN tunnel by Cisco AnyConnect VPN Client running on the user's PC. Once the network tunnel is established, the remote user can access the corporate network in the same way as being on-site.

1. Log into the Cisco ASDM Version 7.4(1) or later. The **Cisco ASDM home** page appears.

note
Before you run the ASDM launcher you must install or downgrade the Java version 7 update 45. Refer to the Cisco documentation guide for download ASDM setup information.

![Cisco ASDM Home Page](/assets/images/cisco-asdm-home-page-07bb3eaf81612742c9e5be850a1acbaf.png)

2. Click **Wizard > VPN Wizards > AnyConnect VPN Wizard** as shown.

   ![AnyConnect VPN Wizard](/assets/images/anyconnect-vpn-wizard-97e88767f71df8e6f218649d605d95ea.png)

   The **AnyConnect VPN Connection Setup Wizard** appears.

   ![AnyConnect VPN Connection Setup Wizard](/assets/images/anyconnect-vpn-connection-setup-wizard-3cdd18655a4fb9724ee34f2a9fa4d0dd.png)

3. Click **Next**. The **Connection Profile Identification** page appears.

   ![Connection Profile Identification Page](/assets/images/connection-profile-identification-page-76a53d38c0c9e5583d9142d9e350a8b7.png)

4. In the **Connection Profile Name** field, enter a name for your connection profile name, for example, AnyConnect-Profile.

5. From the **VPN Access Interface**, select the interface the remote access users will access for VPN connection from the drop-down list.

6. Click **Next**. The **VPN Protocols** page appears.

   ![VPN Protocols Page](/assets/images/vpn-protocols-page-3aaec06459dd1f6e6798f71dc064560c.png)

7. Select the **VPN Protocols** you would like to this connection profile to support (SSL, IPsec or both).

8. Select the **Device Certificate** from the drop-down list, or click **Manage** to create a self-signed certificate or deploy a certificate.

9. Click **Next**. The **Client Images** page appears.

   ![Client Images Page](/assets/images/client-images-page-76e1d9c029922845a1f481eed4012626.png)

10. Click **Add** to select an **AnyConnect Image** file. The **Add Any Connect Client Image** dialog appears.

11. Select **Browse Flash** or upload from the local folder if you have already downloaded AnyConnect *.pkg format file from the Cisco website.

    ![Add AnyConnect Client Image Dialog](/assets/images/add-anyconnect-client-image-dialog-4c1be7a98a3c334c6a6c34e18faf0f72.png)

12. Click **OK** and then click **Next**. You are returned to the **Client** **Images** page.

    ![Updated Client Images Page](/assets/images/updated-client-images-page-c832e52438291a75f9a608abafc29914.png)

13. Click **Next**. The **Authentication Methods** page appears.

    ![Authentication Methods Page](/assets/images/authentication-methods-page-221b9133c96fd680343056b6fbe0330c.png)

14. From the **AAA Server Group** drop-down list, select the **Active_Directory** server group, which you have added during AAA server group configuration.

    If you have not yet added an AAA Server, click **New** to create an AAA Server.

15. Click **Next**. The **Client Address Assignment** page appears.

    ![Client Address Assignment Page](/assets/images/client-address-assignment-page-fff4a3ec45442f6f4d9e628609a896f6.png)

16. From the **Address Pool** drop-down list, select the address pool name. If you have not yet added an address pool, click **New** to create.

17. Click **Next**. The **Network Name Resolution Servers** page appears.

    ![Network Name Resolution Servers Page](/assets/images/network-name-resolution-servers-page-81e884cc5313ae05b1591ab6fdb99f77.png)

18. In the **DNS Servers** field, enter the DNS Server IP address.

19. In the **Domain** **Name** field, enter the domain name.

20. Click **Next**. The **NAT Exempt** page appears.

    ![NAT Exempt Page](/assets/images/nat-exempt-page-e318b9d2adc06aed7466f6caba9b3b37.png)

21. Select **Exempt VPN traffic from the network address translation** check box.

22. From the **Inside Interface** drop-down list, select the inside interface.

23. In the **Local Network** field, select **any4.**

24. Click **Next**. The **AnyConnect Client Deployment** page appears.

    ![AnyConnect Client Deployment Page](/assets/images/anyconnect-client-deployment-page-44e93326d18edb8a7c7a0a4a3969d996.png)

25. Select the **Allow Web Launch** check box and then click **Next**. A **Summary** page appears.

    ![Summary Page](/assets/images/summary-page-9a33fc952c9c30ba88ca0fffe404ba66.png)

26. Click **Finish** to apply the AnyConnect configurations and close the VPN Wizard.

27. In the **Remote Access VPN** tree view, select **AnyConnect Client Profile**. The **AnyConnect Client Profile** page appears.

    ![AnyConnect Client Profile Page](/assets/images/anyconnect-client-profile-page-28a48920cafbf3b762c21a70a2636e48.png)

28. Click the AnyConnect profile that you have created and then click the **Edit** tab.

29. Click the **VPN tree** and select **Preferences (Part 2)** as shown to display the **Preferences (Part 2)** page.

    ![Preferences Part 2 Page](/assets/images/preferences-part-2-page-8b237ef35cff1268adeafce3040e0aa4.png)

30. Scroll the page until you see the **Authentication Timeout** settings.

31. In the **Authentication Timeout** field enter **90**. (This setting allows users to have enough time to get the new transaction challenge message on mobile soft token.)

    ![Authentication Timeout Setting](/assets/images/authentication-timeout-setting-583515bb9a3427409b9d6078457ece50.png)

32. Click **OK** and then click **Apply** to save the changes.

### Step 4: Configure Cisco Identity Service Engine

1. Log into the Cisco Identity Services Engine.

   ![Cisco ISE Login](/assets/images/cisco-ise-login-39caf6f3e1d8cec762e4816221cbbc46.png)

   The Cisco ISE dashboard appears.

   ![Cisco ISE Dashboard](/assets/images/cisco-ise-dashboard-78c8bbe5a0a6178c96caf1a7e6fa08d8.png)

2. In the Cisco ISE dashboard page, go to **Administration>Network Resources>Network Devices**. The **Network Device** page appears.

   ![Network Devices Page](/assets/images/network-devices-page-65b7c1cdb4ab073396432fe66c4801bf.png)

3. In the **Network Devices** page, perform the following.

   1. In **Network Devices**, click **Add.**
   2. In the **Name** field, enter `Cisco ASA`.
   3. In the **IP address** field, enter `Cisco ASA` IP address.
   4. Select **Radius Authentication** settings.
   5. In the **Radius UDP Settings> Shared Secret,** enter the same shared secret configured during AAA radius server on Cisco ASA.
   6. Click **Submit** to save the changes.

### Step 5: Configure Cisco ISE external identity resources

To configure Cisco ISE External Identity Resources

1. In the Cisco ISE dashboard page, go to **Administration>Identity Management>External Identity Sources**. The **External Identity Sources** page appears.

   ![External Identity Sources Page](/assets/images/external-identity-sources-page-239546f360cd7c5c093b90e87801f160.png)

2. In the **External Identity Sources>RADIUS Token**, do the following.

   1. Click **Add**. The **RADIUS Token Identity Sources** page appears.

      ![RADIUS Token Identity Sources Page](/assets/images/radius-token-identity-sources-page-e4a392b205dba1ad8b4f461074a1eecb.png)

   2. In **General>Name** field, enter name, for example, Identity as a Service.

   3. In the **Connection>Primary Server>Host IP**, enter the IP address of RADIUS server being used by Identity as a Service.

   4. In the **Connection>Primary Server>Shared Secret** field, enter a shared secret value.

   5. In the **Connection>Primary Server>Authentication Port** field, enter 1812.

   6. Leave the other settings at the default values.

3. Click **Save**.

### Step 6: Configure Cisco ISE external authentication policy

To configure Cisco ISE Policy

1. In the ISE Dashboard page, go to **Policy>Policy Sets>Default**. The **Policy Sets Default** page appears.

   ![Policy Sets Default Page](/assets/images/policy-sets-default-page-2b62c84ef45e19252ec9a157cbfc26ae.png)

2. Click **Authentication Policy** to expand the menu.

3. In the **Default** row under **Use**, select the RADIUS Token Identity Source you created in _Step 5: Configure Cisco ISE external identity resources_ (for example, Identity as a Service).

4. Click **Save**.

### Step 7: Add Cisco ISE to Identity as a Service

note

Entrust recommends that when multiple RADIUS applications are configured that each RADIUS application is given a unique shared secret.

1. Click Menu icon **>** **Security > Applications**. The **Applications** page appears.

2. Click **Add**. The **Select an Application Template** page appears.

3. Do one of the following:

   - Select **RADIUS and VPN Integrations** from the search drop-down list and scroll to find the application you want to add to IDaaS.
   - In the **Search bar**, enter a search option to filter for the application you want to add to IDaaS.

4. Click **Cisco ISE**. The **Add Cisco ISE** page appears.

5. Optional: Edit the **Application Name**.

6. Optional. Enter a **Description** for your application.

7. Optional. Add a custom application logo as follows:

   1. Click Circle Plus icon next to **Application Logo**. The **Upload Logo** dialog box appears.
   2. Click Arrow Up From Line icon to select an image file to upload.
   3. Browse to select your file and click **Open**. The **Upload Logo** **dialog box** displays your selected image.
   4. If required, resize your image.
   5. Click **OK**.

8. Click **Next**. The **Setup** page appears.

9. Click **Add** to next to **Hosts** to add the host name of the VPN server. The RADIUS agent receives the request on this host. The RADIUS Agent on the Gateway determines the RADIUS application the request is for based on the host name and port.

10. Enter the host name in the **Host** dialog box and then click **OK**. Repeat this step to add more host names.

11. In the **Port** field, enter the port on which the RADIUS agent accepts messages.

tip
Do not enter `8443` as the port number for this application. Port `8443` is used by the Entrust Identity Enterprise agent in your Gateway.

attention
The RADIUS agent uses the host name that sent a request and the port number that it received the request from to determine which RADIUS application made the request. Because of that:

    - Two RADIUS applications with the same port value cannot share any host names.
    - Two RADIUS applications that have one or more matching host names must have different port values.

12. In the **Shared Secret** field, enter the shared secret that is used by your VPN server. This is the RADIUS secret shared between your VPN server and the RADIUS server. The shared secret value must match a shared secret in your RADIUS client.

13. From the **Select** **RADIUS Agent** drop-down list, select the name of the Gateway containing the **RADIUS agent** to which this application will be assigned.

14. Optional: From the **Select RADIUS Attribute for IP Address** drop-down list, select the RADIUS attribute that corresponds to your IP location.

15. In the **Challenge Response Queue Max Time** field, set the number of seconds that the RADIUS agent waits for a response to first-factor authentication. The default value is 180 seconds.

16. In the **Challenge Response Queue Max Size** field, set the maximum number of second-factor challenge requests allowed in the queue of your RADIUS application. The default value is 1000 requests. The maximum value is 10,000.

17. In the **Request Cache Timeout** field, set the number of seconds to cache requests. The default value is 10 seconds.

18. From the **Character Set** drop-down list, select the character set used to decode and encode string values (including the user ID and password values) in RADIUS messages. The options are UTF-8 and ISO-8859-1.

19. Optional: Select **Log RADIUS messages** to enable RADIUS message logging. When enabled, messages for the RADIUS agent are logged to the same log file as the gateway logs.

20. Optional: Enable the **Authentication Settings**.

    1. Select **Enable Push Authentication Fallback** if you want to authentication to fallback to another authenticator in the event of a failure. If required, set the **Push Authentication Fallback Timeout** to the number of minutes before the push authentication times out.
    2. Select **When authenticating the user will be asked to select their second-factor authenticator**. When selected, after the user responds to the first-factor challenge, they are prompted to select their second-factor authenticator. The list of available second-factor authenticators is set by the resource rule.
    3. The following is a list of supported strings matched to the authentication types:
       - Grid: grid
       - Knowledge-based Authentication: kba
       - One-time password: email, sms, voice
       - Smart Credential Push: scpush
       - Temporary Access Code: tac
       - Token: token
       - Token push: push
    4. Select **Indicate if requests must include the message-authenticator attribute for incoming messages** to include the message-authenticator attribute for incoming messages.
    5. Select **Indicate if requests must include the message-authenticator attribute for outgoing messages** to include the message-authenticator attribute for outgoing messages.
    6. Select **Remove domain from user ID for incoming requests** to remove the `domain` value from the user ID during authentication when the user ID provided by the RADIUS client is in the format `domain\username` and the user ID in IDaaS is in the format `username`.
    7. Select **Indicate if Active Directory password authentication requests are handled by the same Gateway Instance that initiated the request** to require that Active Directory password authentication and change requests that are initiated as part of the RADIUS authentication are handled by any Gateway Instance in the same Gateway cluster that initiated it. If disabled, the request is handled by any Gateway Instance.
    8. Select **Enable one-step multi-factor authentication**. When enabled, the user enters their user ID and then their password and token response in the password field. If you select this option, second factor authenticators available in the resource rule are limited to token and temporary access code.
    9. Enter the **One-step multi-factor authentication security token length**. This is the length of the token or temporary access code response if you enable one-step multi-factor authentication.

21. Optional. **Add Response Attributes**. Response attributes are returned to the RADIUS application after successful authentication. Use this setting to configure RADIUS attributes to return information such as the user's group information to the VPN server.

    When adding response attributes, you optionally add group filters. For example:

example
Users in IDaaS may belong to one of the following groups CANADA, US, UK, FRANCE.

    The VPN server wants the FilterID attribute returned from the IDaaS RADIUS agent to be the value NA or EUROPE, depending on whether the user is in NA (Canada, US) or Europe (UK, France).

    To do this, use a RADIUS attribute filter for the FilterID attribute with a Groups value with the following filters:

    - match CANADA, replace NA
    - match US, replace NA
    - match UK, replace EUROPE
    - match FRANCE, replace EUROPE

    1. Set the **Response Attributes** as follows:

    2. Click Circle Plus icon **Add**. The **Add a Response Attribute** dialog box appears.

    3. Select the **RADIUS Attribute ID** from the drop-down list. The option you select depends on your VPN vendor.

    4. Select the **Value Type** from the drop-down list.

    5. TTo return a static value specific in the RADIUS attribute definition, select **Static** and enter a **Value** in the field and then click **Add.**

    6. To return the user's group membership, select **Group** and then optionally do the following:

       1. Click **Add** to add filters.
       2. Enter the **Match** and the **Replace** attribute filters.
       3. Click **Add** to add more attribute filters.
       4. If you add multiple filters, you can drag and drop them in order of preference.
       5. Select **Stop after matching filter** if you only want one the filter to return one value. Using the example above, if you want NA to have preference over Europe, make sure to list Canada and US in the list of filters.
       6. For Multiple Values Per Attribute, enter the **Value Separator** and then click **Add.**

    info
           If a user belongs to more than one group, you can either add a separate attribute to your RADIUS response for each group or you can combine all of the groups into a single attribute. For example, if the user belongs to G1,G2,G3 then you would

       - return a RADIUS response with three attributes
       - return a RADIUS response with one attribute and a value like "G1,G2,G3" where the , is defined in the Value Separator setting or a value like "G1 G2 G3" where the Value Separator is defined as a space.

    attention
           The default group separator is a space. If you have group names that are separated by a space, use another separator, such as a comma.

    7. Repeat these steps to add more response attributes.

22. Optional: Configure the **EAP Settings** to set up the application to use the EAP RADIUS authentication protocol.

    1. Select **EAP Enabled** to allow the RADIUS application to accept EAP messages.
       - When enabled, authentication messages with EAP content are treated as EAP requests. The application can accept only EAP authentication requests.
       - When disabled, incoming authentication requests are processed by the RADIUS application as a standard RADIUS authentication request (even if the request includes EAP content). In this case, the application can accept only standard RADIUS authentication requests.
    2. Select the **EAP Protocol** from the drop-down list. The options are PEAPv0 with MS-CHAPv2 and PEAPv1 with GTC.
    3. This setting defines the type of EAP authentication protocol that is performed on EAP requests received by the RADIUS application. Consult the configuration requirements of your VPN server to determine which EAP protocol to select.
    4. Select **Return MPPE Keys** to include the MPPE (Microsoft Point-to-Point Encryption) recv and mppe send keys in the Access-Accept message returned during a successful EAP authentication. The setting is enabled by default.
    5. Select **Use PEAPv1 label when calculating MPPE Keys** to use the PEAPv1 label when calculating the mmpe recv and mppe send keys.
    6. Leave the **Minimum TLS Version**, **Maximum TLS Version** and **Allow Weak Ciphers** at the default settings unless you have an older VPN and need to configure these settings to allow older versions of TLS or weaker ciphers to interoperate with older VPN servers that do not support the latest versions.

23. Configure the **Deprecated Settings** **if your RADIUS application is** connected to a Gateway version older than 3.0. These values are only required for backwards compatibility.

24. Select Token OTP Only, Password with second-factor, or No first-factor as the **Authentication Type.** This setting defines the level of authentication required to access a RADIUS application that relies on a gateway RADIUS agent configured before release 3.1.

warning
MSCHAPv2 authentication is not supported when **No first-factor** authentication is configured for the RADIUS application.

25. Click **Submit**.

### Step 8: Add a resource rule

See [Create resource rules](/docs/authentication-and-security/create-and-manage-resource-rules.md).

### Step 9: Test the integration using one of these methods:

#### Test using the Cisco VPN Client

1. Launch the Cisco VPN Client and click **New** to create a new VPN connection entry.

   The **Create New VPN Connection Entry** window appears.

   ![Create New VPN Connection Entry Window](/assets/images/create-new-vpn-connection-entry-window-d58dd6535a5ac6fce9e0ac0ed08789bc.png)

2. In the **Connection Entry** field enter a name for the connection entry (for example, Sales Remote).

3. Enter the IP or hostname of the ASA in the **Host** field.

4. Under the **Authentication** tab, ensure **Group Authentication** is selected.

5. Enter the IPSec Connection Profile information that was created previously. The password is the Pre-shared Key.

6. Click **Save**.

7. Click **Connect** on the newly created Connection Entry. You are prompted to authenticate.

   ![Cisco VPN Client Connect Prompt](/assets/images/cisco-vpn-client-connect-prompt-02e7679618eedbf85e76609108133440.png)

8. Enter the username and password of an Identity as a Service user. The password depends on the first-factor authentication that you have configured for Identity as a Service.

9. Click **OK**. You are prompted for your second-factor challenge.

#### Test using Web SSL

1. Open a web browser and navigate to the **Web SSL** login page.

   The **Login** page appears.

   ![Web SSL Login Page](/assets/images/web-ssl-login-page-e70174aee811574dc878f88527b46057.png)

2. Enter the username and password of an Identity as a Service user. The password depends on the first-factor authentication method defined.

note
Logging in as an Active Directory user causes a **2nd Password** field to appear on the login screen. The field accepts any value, but one must be entered to log in.

![Web SSL Challenge Prompt](/assets/images/web-ssl-challenge-prompt-e43406b79f77a7640fc9e7022f395ba5.png)

3. Enter the response for the second factor authentication.

   You should then be authenticated to the Web SSL.

   ![Web SSL Authenticated](/assets/images/web-ssl-authenticated-6607625c72858ed833da45556f9b3208.png)

#### Test using push notification

Test using the Entrust Identity app for push authentication

1. Log in with the correct first-factor username/password on your RADIUS client.
2. **Open the Entrust Identity app** on a mobile device.
3. **Unlock** (log in) using the identity you want to use to respond to the request.
4. **Tap Actions**.
5. Review the transaction summary details.
6. Tap **Confirm**.