Skip navigation
About Duo
Blog
Careers   Now Hiring!
Admin Login
Documentation

Duo Solutions for Cisco AnyConnect VPN with ASA or Firepower

Last Updated: March 6th, 2023

Contents

Related

Duo integrates with your Cisco ASA or Firepower VPN to add two-factor authentication to AnyConnect logins.

Duo can add two-factor authentication to ASA and Firepower VPN connections in a variety of ways. Learn more about these configurations and choose the best option for your organization.

Cisco ASA with AnyConnect

ASA SSL VPN using Duo Single Sign-On

Choose this option for the best end-user experience for ASA with a cloud-hosted identity provider.

With this SAML configuration, end users experience the interactive Duo Universal Prompt when using the Cisco AnyConnect Client for VPN. The interactive MFA prompt gives users the ability to view all available authentication device options and select which one to use, self-enroll new or replacement 2FA devices, and manage their own registered devices. Duo WebAuthn authenticators like Touch ID and security keys supported in recent ASA and AnyConnect software releases.

This configuration also lets administrators gain insight about the devices connecting to the VPN and apply Duo policies such as device health requirements or access policies for different networks (authorized networks, anonymous networks, or geographical locations as determined by IP address) when using the AnyConnect client.

Primary authentication and Duo MFA occur at the identity provider, not at the ASA itself.

Read the deployment instructions for ASA with Duo Single Sign-On

Requirements:

  • Duo Single Sign-On with a configured authentication source
  • Cisco ASA versions 9.7.1.24, 9.8.2.28, 9.9.2.1 or higher of each release
    • Use of WebAuthn authenticators supported in ASA firmware 9.17 or later with external browser support enabled.
  • AnyConnect 4.6 or later for normal authentication
    • Trusted Endpoints certificate verification requires AnyConnect versions 4.7.04056 (Windows), 4.8.00175 (macOS), or 4.8.00807 (iOS) or later.
    • Use of WebAuthn authenticators for 2FA and Duo Passwordless supported in AnyConnect 4.10.04065 or later.

Network Diagram:

Cisco ASA with Duo SSO
  1. VPN connection initiated to Cisco ASA.
  2. The ASA redirects to the Duo Single Sign-On (SSO) for SAML authentication.
  3. The user logs in with primary Active Directory credentials.
  4. Duo SSO performs primary authentication via an on-premises Duo Authentication Proxy to Active Directory (in this example).
  5. Duo Single Sign-On begins 2FA.
  6. User completes Duo two-factor authentication.
  7. Duo Single Sign-On redirects the user back to the ASA with response message indicating success.

ASA SSL VPN using Duo Access Gateway

Duo Access Gateway will reach end of life in October 2023. Customers may not create new DAG applications after May 19, 2022. Please see the Guide to Duo Access Gateway end of life for more details.

Learn more about Duo Single Sign-On, our cloud-hosted identity provider featuring Duo Central and the Duo Universal Prompt.

We recommend choosing ASA SSL VPN using Duo Single Sign-On instead of Duo Access Gateway.

With this SAML configuration, end users experience the interactive Duo Prompt when using the Cisco AnyConnect Client for VPN. The interactive MFA prompt gives users the ability to view all available authentication device options and select which one to use, self-enroll new or replacement 2FA devices, and manage their own registered devices.

This configuration also lets administrators gain insight about the devices connecting to the VPN and apply Duo policies such as device health requirements or access policies for different networks (authorized networks, anonymous networks, or geographical locations as determined by IP address) when using the AnyConnect client.

Primary authentication and Duo MFA occur at the identity provider, not at the ASA itself.

Read the deployment instructions for ASA with Duo Access Gateway

Requirements:

  • Duo Access Gateway or a third-party SAML IdP with Duo MFA (AD FS, Azure AD, etc.)
  • Cisco ASA versions 9.7.1.24, 9.8.2.28, 9.9.2.1 or higher of each release
  • AnyConnect 4.6 or later for normal authentication (Trusted Endpoints has specific AnyConnect version requirements. See the ASA with SAML document for details.)

Network Diagram:

Cisco ASA with Duo SSO
  1. VPN connection initiated to Cisco ASA, which redirects to the Duo Access Gateway for SAML authentication
  2. AnyConnect client performs primary authentication via the Duo Access Gateway using an on-premises directory (example)
  3. Duo Access Gateway establishes connection to Duo Security over TCP port 443 to begin 2FA
  4. User completes Duo two-factor authentication.
  5. Duo receives authentication response and returns that information to the Duo Access Gateway
  6. Duo Access Gateway returns a SAML token for access
  7. Cisco ASA VPN access granted

ASA SSL VPN using RADIUS

Choose this option for ASA and AnyConnect deployments that do not meet the minimum product version requirements for SAML SSO. With this configuration, end users receive an automatic push or phone call for multi-factor authentication after submitting their primary credentials using the AnyConnect Client or clientless SSL VPN via browser. Users may append a different factor selection to their password entry.

This configuration supports Duo policies for different networks (authorized networks, anonymous networks, or geographical locations as determined by IP address) when using the AnyConnect client, and supports configurable fail mode if the Authentication Proxy server cannot contact Duo's service.

Read the deployment instructions for ASA with RADIUS

Requirements:

Network Diagram:

Cisco ASA with Duo RADIUS
  1. Primary authentication initiated to Cisco ASA
  2. Cisco ASA sends authentication request to the Duo Authentication Proxy
  3. Primary authentication using Active Directory or RADIUS
  4. Duo Authentication Proxy connection established to Duo Security over TCP port 443
  5. Secondary authentication via Duo Security’s service
  6. Duo Authentication Proxy receives authentication response
  7. Cisco ASA VPN access granted

ASA SSL VPN using LDAPS

Direct LDAP connectivity to Duo for ASA SSL VPN will reach end of life on March 30, 2024. Customers may not create new Cisco SSL VPN applications after September 7, 2023. Please visit the article Guide to end of life for the Duo LDAP cloud service (LDAPS) used to provide 2FA for Cisco ASA, Juniper Networks Secure Access, and Pulse Secure Connect Secure SSL VPN for further details.

We recommend protecting ASA devices with a Duo solution that has long-term support, like ASA SSL VPN using Duo Single Sign-On or ASA SSL VPN using RADIUS.

When using this option with the clientless SSL VPN, end users experience the interactive Duo Prompt in the browser. The AnyConnect client does not show the Duo Prompt, and instead adds a second password field to the regular AnyConnect login screen where the user enters the word "push" for Duo Push, the word "phone" for a phone call, or a one-time passcode.

This configuration does not support IP-based network policies or device health requirements when using the AnyConnect client, and will always fail authentication if the ASA cannot contact Duo's service.

Read the deployment instructions for ASA with LDAPS

Requirements:

  • Cisco ASA firmware version 8.3 or later

Network Diagram:

Cisco ASA with Duo LDAPS
  1. Cisco SSL VPN connection initiated
  2. Primary authentication to on-premises directory
  3. Cisco ASA connection established to Duo Security over TCP port 636
  4. Secondary authentication via Duo Security’s service
  5. Cisco ASA receives authentication response
  6. Cisco SSL VPN connection established

Cisco Firepower with AnyConnect

FTD VPN using Duo Single Sign-On

Choose this option for the best end-user experience for FTD with a cloud-hosted identity provider.

With this SAML configuration, end users experience the interactive Duo Universal Prompt when using the Cisco AnyConnect Client for VPN. The interactive MFA prompt gives users the ability to view all available authentication device options and select which one to use, self-enroll new or replacement 2FA devices, and manage their own registered devices. Duo WebAuthn authenticators like Touch ID and security keys supported in recent Firepower and AnyConnect software releases.

This configuration also lets administrators gain insight about the devices connecting to the VPN and apply Duo policies such as device health requirements or access policies for different networks (authorized networks, anonymous networks, or geographical locations as determined by IP address) when using the AnyConnect client.

Primary authentication and Duo MFA occur at the identity provider, not at the FTD itself.

Read the deployment instructions for FTD with Duo Single Sign-On

Requirements:

  • Duo Single Sign-On with a configured authentication source
  • Cisco FTD version 6.7.0 or later managed by FMC version 6.7.0 or later
    • Use of WebAuthn authenticators supported in Firepower firmware 7.1.0 or later with external browser support enabled.
  • AnyConnect 4.6 or later for normal authentication
    • Trusted Endpoints certificate verification requires AnyConnect versions 4.7.04056 (Windows), 4.8.00175 (macOS), or 4.8.00807 (iOS) or later.
    • Use of WebAuthn authenticators for 2FA and Duo Passwordless supported in AnyConnect 4.10.04065 or later.

Network Diagram:

Cisco FTD with Duo SSO
  1. VPN connection initiated to Cisco FTD.
  2. The FTD redirects to the Duo Single Sign-On (SSO) for SAML authentication.
  3. The user logs in with primary Active Directory credentials.
  4. Duo SSO performs primary authentication via an on-premises Duo Authentication Proxy to Active Directory (in this example).
  5. Duo Single Sign-On begins 2FA.
  6. User completes Duo two-factor authentication.
  7. Duo Single Sign-On redirects the user back to the FTD with response message indicating success.

FTD VPN using RADIUS

Choose this option for Cisco Firepower Threat Defense (FTD) Remote Access VPN. With this configuration, end users receive an automatic push or phone call for multi-factor authentication after submitting their primary credentials using the AnyConnect Client or clientless SSL VPN via browser. Users may append a different factor selection to their password entry.

This configuration supports Duo policies for different networks (authorized networks, anonymous networks, or geographical locations as determined by IP address) when using the AnyConnect client.

Read the deployment instructions for Firepower with RADIUS

Requirements:

  • Duo Authentication Proxy
  • Cisco FTD version 6.3.0 or later managed by FMC version 6.3.0 or later

Network Diagram:

Cisco FTD with Duo RADIUS
  1. Primary authentication initiated to Cisco FTD
  2. Cisco FTD sends authentication request to the Duo Authentication Proxy
  3. Primary authentication using Active Directory or RADIUS
  4. Duo Authentication Proxy connection established to Duo Security over TCP port 443
  5. Secondary authentication via Duo Security’s service
  6. Duo Authentication Proxy receives authentication response
  7. Cisco FTD VPN access granted

Cisco Identity Services Engine with AnyConnect

ISE with RADIUS

Choose this option for Cisco Identity Services Engine. With this configuration, end users receive an automatic push or phone call for multi-factor authentication after submitting their primary credentials using the AnyConnect Client. Users may append a different factor selection to their password entry.

This configuration supports Duo policies for different networks (authorized networks, anonymous networks, or geographical locations as determined by IP address) when using the AnyConnect client.

Read the deployment instructions for ISE

Requirements:

  • Duo Authentication Proxy
  • Cisco ISE 2.4 or later

Network Diagram:

Cisco ISE with Duo RADIUS
  1. Primary authentication initiated to Cisco ISE
  2. Cisco ISE sends authentication request to the Duo Authentication Proxy
  3. Primary authentication using Active Directory or RADIUS
  4. Duo Authentication Proxy connection established to Duo Security over TCP port 443
  5. Secondary authentication via Duo Security’s service
  6. Duo Authentication Proxy receives authentication response
  7. Cisco ISE access granted