Cisco ASA Series Cli Configuration Manual page 916

Configuring the ASA for Cisco TrustSec Integration
Prerequisites
•
•
To configure the AAA server group for the ISE on the ASA, perform the following steps:
Command
Step 1
hostname(config)# aaa-server server-tag protocol
radius
Example:
hostname(config)# aaa-server ISEserver protocol
radius
Step 1
hostname(config-aaa-server-group)# exit
Step 1
hostname(config)# aaa-server server-tag
(interface-name) host server-ip
Example:
hostname(config)# aaa-server ISEserver (inside) host
192.0.2.1
Step 1
hostname(config-aaa-server-host)# key key
Example:
hostname(config-aaa-server-host)# key
myexclusivemumblekey
Step 1
hostname(config-aaa-server-host)# exit
Step 2
hostname(config)# cts server-group
AAA-server-group-name
Example:
hostname(config)# cts server-group ISEserver
Cisco ASA Series CLI Configuration Guide
1-12
The referenced server group must be configured to use the RADIUS protocol. If you add a
non-RADIUS server group to the ASA, the feature configuration will fail.
If the ISE is also used for user authentication, obtain the shared secret that was entered on the ISE
when you registered the ASA with the ISE. Contact your ISE administrator if you do not have this
information.
Chapter 1 Configuring the ASA to Integrate with Cisco TrustSec
Purpose
Creates the AAA server group and configures the
AAA server parameters for the ASA to communicate
with the ISE server.
Where server-tag specifies the server group name.
See Creating a Security Group on the ISE, page 1-8
for information.
Exits from the AAA server group configuration
mode.
Configures a AAA server as part of a AAA server
group and sets host-specific connection data.
Where (interface-name) specifies the network
interface where the ISE server resides. The
parentheses are required in this parameter.
Where server-tag is the name of the AAA server
group that you specified in step 1 in the server-tag
argument.
Where server-ip specifies the IP address of the ISE
server.
Specifies the server secret value used to authenticate
the ASA with the ISE server.
Where key is an alphanumeric keyword up to 127
characters long.
If the ISE is also used for user authentication, enter
the shared secret that was entered on the ISE when
you registered the ASA with the ISE.
See Registering the ASA with the ISE, page 1-8
information.
Exits from the AAA server host configuration mode.
Identifies the AAA server group that is used by Cisco
TrustSec for environment data retrieval.
Where AAA-server-group-name is the name of the
AAA server group that you specified in step 1 in the
server-tag argument.
Only one instance of the server group can be
configured on the ASA for Cisco TrustSec.
for