up vote 4 down vote favorite
share [g+] share [fb]

We have our Cisco network devices configured to authenticate network administrators using their domain accounts via RADIUS running on a Windows 2008R2 server with the network protection role. This works great for logging into the switch via SSH when configuring the devices.

We are now in the beginning stages of deploying smart cards for logins. Does anyone know of a way to login to a Cisco switch using a smart card instead of a domain username and password?

The SSH client we are using is Putty. Workstations are Windows 7. RADIUS is running on Windows 2008R2. We are running our own certificate authority on Windows 2008; network is not connected to the Internet.

We prefer to not have to purchase additional proprietary devices for this functionality.

link|improve this question
82% accept rate
1  
Using Cisco VPN Client, you can raise VPN-tunnel with the authorization through a smart card to your device and then use the Putty. But it is rather an alternative. – Cucumber Jun 28 '11 at 18:29
By using a smart card, do you mean like a RSA ID that generates numbers, and not a physical card you have to insert into a slot? – Aaron Aug 4 '11 at 10:56
Not the RSA device. A physical smart card that you insert into a reader and has PKI certificates. – murisonc Aug 8 '11 at 14:15
I'm not sure what you mean when you say you don't want to buy additional devices. Are these smart card readers already attached to the computers? So, you want to put the smart card into a computer and then be able to log into a router without passing any more "manual" credentials? – Aaron Sep 22 '11 at 20:34
Correct, we have smart card readers on the workstations and use these to logon to the domain by entering a PIN. I'd like to open an SSH session to the router using Putty and then just get prompted for the smart card PIN. Currently I have to enter my domain username and password which is passed to the NPS server for authentication. – murisonc Sep 22 '11 at 22:05
show 3 more comments
feedback

1 Answer

up vote 0 down vote

You can use the Cisco Secure Services Client. It works well but can be very difficult to setup. Here is cisco's datasheet for the product. The client works with both Cisco Secure ACS and Microsoft IAS RADUS services.

link|improve this answer
This application appears to be for authentication the user/device to the network using 802.1x. It does not appear to support authenticating the user logging into the network device using a smart card over SSH. – murisonc Jul 25 '11 at 22:52
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.