2

I have an integration problem between RSA SecurID and Microsoft AD described in the picture below:

1.The user needs to connect to private network via VPN and authenticates to the Firewall via its username and RSA token
2.The credentials are send to the Firewall
3.The firewall is integrated with AD and resends the credentials to its local AD DC
4.The AD DC is integrated with RSA AM and when it sees that a user from the domain needs authentication it asks if the tokencode is correct
5-6-7.All steps are just replies to previous requests.

In my current state I can do the same flow but if I use user/password in the AD, otherwise said without using any RSA token authentication and RSA AM Server. I saw the official AD FS integration with RSA guide but it doesnt seem like it is describing this case. The idea behind is to separate the Firewall from comunicating with the RSA AM Server and if later I add other devices that authenticate with AD user they will have no need to know if the user provides local Domain password or RSA token code.

If there someone that knows how this can be done or point me to something read I'll sencerely ask him to read. Thanks in advance.

Improve this question
3
  • This seems like a very tedious and expensive way to authenticate (if you can get it to work) when you could just use smartcard authentication and avoid pass the hash penetration?
    – Jim B
    Sep 7, 2014 at 1:03
  • You set Active Directory as the authentication source in RSA SecurID AM, then you set up the Radius server in RSA AM, then you configure your Cisco ASA (as an example) to use the RSA server as its Radius proxy. So, your end user will log in to the VPN using his or her Active Directory username, combined with his or her RSA secret PIN plus token digits. Open sesame.
    – Ryan Ries
    Sep 7, 2014 at 2:44
  • Thank you for the fast respons Jim, Ryan. I'm using checkpoint as Firewall vendor and it has a direct native integration with RSA AM, so currently, both my Firewall and RSA AM are polling users and groups from the AD and exactly as you suggested the AD is defined as an Identitty source in the RSA AM. On top of that the Checkpoint is authenticating user from AD with their tokens agains the RSA AM and it works fine, but I would like, if possible, to find a way to remove the connection between the Firewall and the RSA AM and make the AD authenticate the users.
    – Atanas Atanasov
    Sep 7, 2014 at 6:38

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .