topic Re: Duo MFA with Cisco ISE and FTD RAVPN in Deployment Strategy

Duo MFA with Cisco ISE and FTD RAVPN

Ibrahim-Sharif — Mon, 11 Dec 2023 07:24:43 GMT

Dear all,

Hope you are doing well.

I have Cisco FTD configured with remote access VPN and Cisco ISE for AAA services using the local user database on the ISE itself, and now I intend to add the 2FA using Cisco Duo.

After completing the configuration on the Cisco ISE and preparing the Cisco Duo Auth proxy, I'm facing an issue with the primary authentication "ISE username & password":

Error performing primary authentication: RADIUS auth request timed out

Allow concat is configured, but is not supported with MS-CHAPv2 authentications. Did you try to concatenate your second factor to your password?

Returning response code 3: AccessReject
(('10.171.22.110', 22043), user1@local, 17): Sending response
dropping packet from 10.171.22.110:1812 - unrecognized ID in response packet: 9

In the attached screenshot you can see the traffic flow and topology, as well as the Cisco Auth proxy configuration file.

I would appreciate your input in addressing this issue.

Thank you,

Ibrahim

Re: Duo MFA with Cisco ISE and FTD RAVPN

MHM Cisco World — Mon, 11 Dec 2023 08:01:16 GMT

I need to see

Radius server config

Connection profiles/AAA

Take screenshots for this and share here let me check it

MHM

Re: Duo MFA with Cisco ISE and FTD RAVPN

Ibrahim-Sharif — Mon, 11 Dec 2023 10:31:35 GMT

Hello @MHM Cisco World

Thank you for your reply, I have attached a screenshot for all required points, so what I'm doing is when the request comes to the FTD it's configured with AAA server (ISE nodes), and the ISE is configured with External radius server (Duo Auth Proxy) which will send the first authentication (Username and Password) to the ISE.

Also, I can see this error message, so do you think if we enable the MS-CHAPv2 on the Cisco Duo it will work?

allow concat is configured but is not supported with ms-chapv2 authentications. Did you try to concatenate your second factor to your password?

Knowing that this setup is working fine with Active Directory as an external identity for authentication.

Thank you,

Ibrahim

Re: Duo MFA with Cisco ISE and FTD RAVPN

alfred — Fri, 06 Jun 2025 06:43:53 GMT

Hello Ibrahim,

Did you manage to integrate Duo MFA with FMC/ISE for RAVPN users?

We have already got FMC/ISE integrated with RAVPN and want to introduce Duo to the mix, do you have any pointers for me?

Re: Duo MFA with Cisco ISE and FTD RAVPN

Ken Stieers — Fri, 06 Jun 2025 12:09:23 GMT

2 ways

1.
ISE 3.3 or later can integrate with Duo directly
2.
you can use the Duo.Auth Proxy. Have FMC/FTD send its radius queries to the auth proxy and the Auth Proxy can query ISE.

Re: Duo MFA with Cisco ISE and FTD RAVPN

ergin.sezgin — Wed, 02 Jul 2025 07:24:00 GMT

Hi,

use pass_through_all

https://duo.com/docs/radius