Lab 1.3 - Create the Access Policy

In this section, edit the policy using the Visual Policy Editor to enable users to login via AD+MFA, then transition to CertSSO.

Task - Open Visual Policy Editor

1. On the cert_sso profile line click edit under Per-Session Policy

   

2. Click the + (plus symbol) located on the fallback branch located between the Start and Deny boxes

   

3. Click the Logon Tab

4. Select Logon Page

5. Click Add Item

   

6. Add an additional field to the logon page by selecting password from the Type dropdown (line 3)

7. Enter OTP for Post Variable Name

8. Enter OTP for Session Variable Name

9. Enter OTP for Logon Page Input Field #3

10. Click Save

    

11. Click the + (plus symbol) located on the fallback branch located between the Logon Page and Deny boxes

    

12. Click the Authentication tab

13. Select RADIUS Auth

14. Click Add Item

    

15. Select radius_servers from the AAA Server dropdown box

16. Change the password source to %{session.logon.last.OTP}

17. Click Save

    

18. Click the + (plus symbol) located on the Successful branch located between RADIUS Auth and Deny boxes

    

19. In the Authentication tab, select AD Auth

20. Click Add Item

    

21. Select ad_servers from the Server dropdown box

22. Click Save

    

23. Click the + (plus symbol) located on the Successful branch located between AD Auth and Deny box

24. Click Add Item

    

25. In the Assignment tab, select Variable Assign

26. Click Add Item

    

27. Click Add new entry

    

28. Click change

    

29. Enter session.ssl.cert.whole in the custom variable field

    

30. Locate the F5CertSSO.f5lab.local.txt file in the C:\labs\class2\student_files directory.

    

31. Open the file with notepad++ and copy the contents of the file

    

32. Return to the Visual Policy Editor and paste the certificate into the custom expression field

33. Click Finished

    

34. Click Save

    

35. Click the Deny ending icon located on the fallback branch of the Variable Assign agent

    

36. Click Allow

37. Click Save

    

38. Click Apply Access Policy located in the top left corner to commit the policy changes