topic Re: What is the right AnyConnect-license for two factor authentication in Network Security

What is the right AnyConnect-license for two factor authentication?

swscco001 — Fri, 10 Sep 2021 11:43:11 GMT

Hello everybody,

our customer is planning two factor authentication (e.g. DUO) for
AnyConnect access to their FTDs.

I am not sure what license-license is the correct one. Is it enough
to use the Plus lisense or do they need the Apex license.

I did not find the answer in the AnyConnect ordering guide.

Thanks a lot for your hints!

Bye
R.

Re: What is the right AnyConnect-license for two factor authentication

balaji.bandi — Fri, 10 Sep 2021 12:35:16 GMT

RA VPN license, any of the following: AnyConnect Plus, AnyConnect Apex, or AnyConnect VPN Only

Check here for License :

https://www.cisco.com/c/en/us/td/docs/security/firepower/621/configuration/guide/fpmc-config-guide-v621/licensing_firepower_system.html

You need to buy any connect license (it come with 25 start with)

https://www.cisco.com/c/en/us/products/collateral/security/anyconnect-og.html

https://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/200191-AnyConnect-Licensing-Frequently-Asked-Qu.html#anc5

2Factor is additional cost depends on vendor you choose (like duo) or any other Google authenticator or 3rd party tokens

Re: What is the right AnyConnect-license for two factor authentication

Marvin Rhoads — Fri, 10 Sep 2021 12:39:14 GMT

Generally speaking AnyConnect is just passing whatever authentication credential(s) the user or endpoint provides to the headend device (ASA, FTD or router) and/or configured authentication server(s).

So you can equally use AnyConnect Plus, Apex or VPN only licenses in the basic 2FA use cases (i.e. where the 2FA happens on the "back end").

If your 2FA is implemented via SAML (as is commonly the case with both Cisco Duo and Microsoft Azure AD with Authenticator) then AnyConnect Apex licenses are required.

Re: What is the right AnyConnect-license for two factor authentication

swscco001 — Mon, 13 Sep 2021 05:26:47 GMT

Hi Marvin,

this was the information I needed.

Thanks a lot!

Re: What is the right AnyConnect-license for two factor authentication

ivhanez1212 — Tue, 19 Sep 2023 16:03:56 GMT

Hi Marvin,

Just wanted to ask, what other 2FA option is available for AnyConnect Plus (perpetual)?

I was trying to configure Azure MFA, I keep on getting failed to generate SAML AuthnRequest, then I saw your post that SAML needs Apex or VPN only license, saves me a lot of time in troubleshooting.

Thank you.

Re: What is the right AnyConnect-license for two factor authentication

Marvin Rhoads — Tue, 19 Sep 2023 16:13:02 GMT

@ivhanez1212 you can do 2FA (e.g. Duo or other) with RADIUS.

I have done this both with Duo Authentication Proxy (with Duo of course) and Microsoft NPS (with MS Authenticator MFA)