topic Re: Cisco Duo LDAPS migration to SAML with DAPS in VPN

Cisco Duo LDAPS migration to SAML with DAPS

LindseyJGreen — Fri, 28 Apr 2023 11:57:45 GMT

We currently use Cisco Duo with LDAPS for our SSL VPN Clients. On the firewall (ASA5508) we have Dynamic Access Policies in place, allowing certain Active Directory groups access to certain subnets.

When testing moving to SAML (Hybrid AzureAD with on prem domain controllers) for MFA, this no longer uses DAP.

How can we secure our different networks on a per user basis instead?

Thanks

Re: Cisco Duo LDAPS migration to SAML with DAPS

Salman Mahajan — Sun, 30 Apr 2023 20:47:15 GMT

Hi @LindseyJGreen If my understanding is correct , what you are saying here is when deploying SAML as an authentication for SSL VPN it does not use DAP ( Dynamic Access Policy ) . It is not true as DAP applies to all remote access and clientless sessions and cannot be disabled – it is always running from the moment the ASA is powered on .