This document describes how to configure RADIUS Authentication and Authorization for the Firepower eXtensible Operating System (FXOS) chassis via Identity Services Engine (ISE).
The FXOS chassis includes the following User Roles:
Administrator - Complete read-and-write access to the entire system. The default admin account is assigned this role by default and it cannot be changed.
Read-Only - Read-only access to system configuration with no privileges to modify the system state.
Operations - Read-and-write access to NTP configuration, Smart Call Home configuration for Smart Licensing, and system logs, including syslog servers and faults. Read access to the rest of the system.
AAA - Read-and-write access to users, roles, and AAA configuration. Read access to the rest of the system.
Via CLI this can be seen as follows:
fpr4120-TAC-A /security* # show role
Role Name Priv
Contributed by Tony Remirez, Jose Soto, Cisco TAC Engineers.
Cisco recommends that you have knowledge of these topics:
Knowledge of Firepower eXtensible Operating System (FXOS)
Knowledge of ISE configuration
The information in this document is based on these software and hardware versions:
Cisco Firepower 4120 Security Appliance version 2.2
Virtual Cisco Identity Services Engine 126.96.36.1990
The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, make sure that you understand the potential impact of any command.
The goal of the configuration is to:
Authenticate users logging into the FXOS’s Web-based GUI and SSH by means of ISE
Authorize users logging into the FXOS’s Web-based GUI and SSH according to their respective User Role by means of ISE.
Verify the proper operation of authentication and authorization on the FXOS by means of ISE
Configuring the FXOS Chassis
Creating a RADIUS Provider using Chassis Manager
Step 1. Navigate to Platform Settings > AAA.
Step 2. Click the RADIUS tab.
Step 3. For each RADIUS provider that you want to add (Up to 16 providers).
3.1. In RADIUS Providers area, click Add.
3.2. Once the Add RADIUS Provider dialog box opens, enter the required values.
3.3. Click OK to close the Add RADIUS Provider dialog box.
Step 4. Click Save.
Step 5. Navigate to System > User Management > Settings.
Step 6. Under Default Authentication choose RADIUS.
Creating a RADIUS Provider using CLI
Step 1. In order to enable RADIUS authentication, run the following commands.
fpr4120-TAC-A# scope security
fpr4120-TAC-A /security # scope default-auth
fpr4120-TAC-A /security/default-auth # set realm radius
Step 2. Use the show detail command to display the results.
fpr4120-TAC-A /security/default-auth # show detail
Admin Realm: Radius
Operational Realm: Radius
Web session refresh period(in secs): 600
Session timeout(in secs) for web, ssh, telnet sessions: 600
Absolute Session timeout(in secs) for web, ssh, telnet sessions: 3600
Serial Console Session timeout(in secs): 600
Serial Console Absolute Session timeout(in secs): 3600
Admin Authentication server group:
Operational Authentication server group:
Use of 2nd factor: No
Step 3. In order to configure RADIUS server parameters run the following commands.
fpr4120-TAC-A# scope security
fpr4120-TAC-A /security # scope radius
fpr4120-TAC-A /security/radius # enter server 10.88.244.50
fpr4120-TAC-A /security/radius/server # set descr "ISE Server"
fpr4120-TAC-A /security/radius/server* # set key
Enter the key: ******
Confirm the key: ******
Step 4. Use the show detail command to display the results.
fpr4120-TAC-A /security/radius/server* # show detail