topic Re: Cisco ASA AnyConnect MFA options in Network Security

Cisco ASA AnyConnect MFA options

LovejitSingh1313 — Mon, 25 Jan 2021 02:52:58 GMT

Hello Experts @Richard Burts @balaji.bandi @Marius Gunnerud @Rob Ingram @Marvin Rhoads @Giuseppe Larosa

I am looking for options for 2nd factor authentication on Cisco ASA Any Connect VPN Connectivity? Please also what kind of additional license or packages need.

I never implemented anything else than Domain authentication for it.

Thanks

Re: Cisco ASA AnyConnect MFA options

Rob Ingram — Mon, 25 Jan 2021 07:48:27 GMT

@LovejitSingh1313

There many many MFA solutions, such as Cisco DUO https://duo.com or OCTA https://www.okta.com/products/adaptive-multi-factor-authentication/.

Re: Cisco ASA AnyConnect MFA options

Marvin Rhoads — Mon, 25 Jan 2021 08:34:03 GMT

In general, all of the MFA products (Duo, Okta, Microsoft etc.) are separate from the ASA and require their own licensing and administration. Each works well with an ASA (or FTD) remote access VPN; but it is generally recommended to take into account other systems in use or planned in your organization when choosing an MFA solution.

Re: Cisco ASA AnyConnect MFA options

balaji.bandi — Mon, 25 Jan 2021 11:05:58 GMT

You can have Duo is good, i also have good experience SAFEnet / or any MFA is good now a days. it is just addintional security for the layer of security.

Re: Cisco ASA AnyConnect MFA options

AViftrup — Mon, 25 Jan 2021 18:09:16 GMT

There's many possibilities to solutions you can implement.

You mention you know about domain integrations. If you're a user of Azure AD you can do O365 MFA with ASA along with SAML 2.0 - this will make your user management and MFA controllable from Office365 Administration.

Other solutions would be things like SMSPasscode which can fetch details by LDAP or Radius directly, and get 2FA by Call or SMS - newest version support app I believe as well.

Otherwise Cisco Duo MFA would be excellent, but comes with license requirements of course.

Re: Cisco ASA AnyConnect MFA options

LovejitSingh130013 — Mon, 13 Jun 2022 15:00:50 GMT

Hello @Marvin Rhoads @Rob Ingram @AViftrup @balaji.bandi

I had profile setup with Azure MFA and it is working flawless but Anyconnect only prompt for credentials and go through MFA first time and then keep connecting automatic.

I want that it should atleast reprompt for credentials once a week.

Re: Cisco ASA AnyConnect MFA options

Rob Ingram — Mon, 13 Jun 2022 15:15:30 GMT

@LovejitSingh130013 define the VPN timeout -vpn-session-timeout so the session ends after x minutes and the user is forced to re-authenticate.

Re: Cisco ASA AnyConnect MFA options

Mohammed al Baqari — Mon, 13 Jun 2022 17:23:19 GMT

Hi,

On ASA/FTD no additional licenss needed for MFA. There are many options to
proceed. Personally I prefer SAML SSO for AAD clients (don't go for MS
onprem MFA as it's EOL). Otherwise, DUO is the 2nd way to go.

**** please remember to rate useful posts