This article describes how to integrate Cisco ASA with RSA Authentication Manager using RADIUS. Cisco ASA is managed by Cisco’s cloud firewall management solution known as Cisco Defense Orchestrator (CDO).

Configure RSA Authentication Manager

Perform these steps to configure RSA Authentication Manager using RADIUS.
Procedure

1. Sign in to the Security Console and navigate to RADIUS > RADIUS Client.
2. Click Add New and provide the following details.
   1. Client Name: Give any suitable name.
   2. ANY client: Select the checkbox.
   3. IP Address Type: IPV4.
   4. IPv4 Address: Management IP or Data-Interface IP address of the SECURE ASA Firewall.
   5. Make/Model: Standard Radius.
   6. Shared Secret: This should be the same as what was configured on the Cisco side.
      
3. Click Save.

Configure Cisco Secure ASA using Cisco Defense Orchestrator

Perform these steps to configure to Cisco Secure ASA AnyConnect.
Procedure

1. Sign in to CDO and browse to Objects.
2. Click the + icon to create a new object.
   
3. On the Add ASA Identity Source page, provide the following details and click Continue.
   1. Define the Object Name for RADIUS Server Group.
   2. Select the Device Type in the drop-down list. 
   3. Select the RADIUS Server Group as the Identity Source Type.
       
4. Click the + icon to define the RADIUS Server.
   
5. Click Create New Radius Server.
   
6. Provide RADIUS Server Object Name, select Device Type, define Server Name or IP Address of primary authentication manager machine, and provide Authentication Port and Server Secret Key.
7. Click Add.
   
8. Select the newly created RADIUS Server within the RADIUS Server Group.
   
9. Save the RADIUS Server Group settings.
   
10. Sign in to CDO, browse to VPN > ASA/FDM Remote Access VPN Configuration > AnyConnect Connection Profiles and edit your profile.
    
11. For RADIUS, select AAA Only in the Authentication Type drop-down list and select your AAA Server Group in the Primary Identity Source for User Authentication drop-down list.
12. Click Continue.
    

The Primary Identity Source for User Authentication drop-down list must contain at least one entry. Add one if unavailable, and click OK.

The configuration is complete.

Return to Cisco Adaptive Security Appliance (ASA) - RSA Ready Implementation Guide.