topic Re: Azure AD MFA with Cisco AnyConnect not working in Network Security

Azure AD MFA with Cisco AnyConnect not working

SPoodari — Wed, 30 Mar 2022 06:43:47 GMT

Simple setup but going me crazy since yesterday.

Cisco ASA Firepower 1010 with Anyconnect integration to Azure SAML.

I have followed the Cisco and MIcrosoft documents and configured exactly as mentioned (for about 5 times literally till now).

While i'm trying to connect, i can see the Azure login prompt, Azure singing me in, then HTML page not found response coming.

This vpn.company.com page can’t be found

No webpage was found for the web address: https://vpn.compnay.com/+CSCOE+/SAML/SP/ACS?tgname=Azure-MFA

HTTP ERROR 404

I've enabled debugs and couldn't find anything.

Mar 30 17:29:24 [SAML] get_lasso_signature_method:
Use SHA256 in SAML Request
Mar 30 17:29:24 [SAML] saml_add_config: SAML config added to list

Re: Azure AD MFA with Cisco AnyConnect not working

Jitendra Kumar — Wed, 30 Mar 2022 08:47:51 GMT

Hi ,

there is possible you missed any steps.

Please follow below tutorial that will guide you to step by step SAMLconfig .

https://www.youtube.com/watch?v=ORC0_0wsbQk

Thanks,

Jitendra

Re: Azure AD MFA with Cisco AnyConnect not working

SPoodari — Wed, 30 Mar 2022 09:04:56 GMT

Hi Jitendra,

I have followed literally each and every video on youtube on this.

but just now its came into light, that do we need anyconnect apex licenses for this to work? Any idea?

As per the documentation only Apex support SAML, we have AnyConnect VPN Peers.

Sampath

Re: Azure AD MFA with Cisco AnyConnect not working

Jitendra Kumar — Wed, 30 Mar 2022 09:44:57 GMT

I can see apex licenses added more capabilities to any connect VPN.

Below are the documents where SAML Authentication is also included.

https://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/200191-AnyConnect-Licensing-Frequently-Asked-Qu.html#anc8

Also you can take help from below documents if its help you.

https://www.optanix.com/practical-guide-deploying-saml-anyconnect/

Thanks,

Jitendra

Re: Azure AD MFA with Cisco AnyConnect not working

Jostein — Wed, 20 Apr 2022 14:25:44 GMT

We had the same fault. Runnin 7.0.1 ftd.

Had to change url in app settings in azure.

Replace the capital letters as follows.

https://vpn.compnay.com/+CSCOE+/saml/sp/acs?tgname=Azure-MFA

This worked for us, neither TAC or our cisco partner where able to figure it out.

Re: Azure AD MFA with Cisco AnyConnect not working

SPoodari — Thu, 21 Apr 2022 03:18:28 GMT

That's true, same worked for me as well. in my URL we have SAML/SP/ACS in caps.

The URL is freaking case sensitive.. where in the world a URL is case sensitive only god knows.

Re: Azure AD MFA with Cisco AnyConnect not working

Marvin Rhoads — Tue, 04 Oct 2022 13:19:51 GMT

@SPoodari the value of the tgname in https://vpn.company.com/+CSCOE+/SAML/SP/ACS?tgname=Azure-MFA is case sensitive. The tgname is the tunnel-group (or connection profile as referred to in ASDM) that is using SAML authentication. You should be able to verify it by point to the metadata page for the tunnel-group (as referenced in your AnyConnect enterprise app in Azure AD).

FYI the portion of a URL after the domain name (sometimes referred to as the URI) is and has always been case-sensitive.

Re: Azure AD MFA with Cisco AnyConnect not working

Erik Hoffmann — Tue, 16 Aug 2022 09:51:49 GMT

not only case sensitive, the syntax is already different. Microsoft says:

htetepes : / / YOUR_CISCO_ANYCONNECT_FQDN/+CSCOE+/SAML/SP/ACS

Thanks to the solution in this thread I finally made it... took 2 days to sort everything out...

Re: Azure AD MFA with Cisco AnyConnect not working

sysad43 — Tue, 04 Oct 2022 12:40:30 GMT

Having trouble with this myself. Are you all saying whats in the cisco AND MS doc is wrong? They both say

htps/<YOUR_CISCO_ANYCONNECT_FQDN>/+CSCOE+/saml/sp/acs?tgname=<Tunnel_Group_Name>

but its needs to all be caps?

Re: Azure AD MFA with Cisco AnyConnect not working

Marvin Rhoads — Tue, 04 Oct 2022 13:22:35 GMT

@sysad43 the section <YOUR_CISCO_ANYCONNECT_FQDN> is not case-sensitive. You replace your VPN address with that section (omitting the <> symbols). The remainder of the URI is case-sensitive, including the +CSCOE+ string and <Tunnel_Group_Name> section. For the last section, replace your tunnel-group name exactly as it appears in your running configuration, including any capitalization.

Re: Azure AD MFA with Cisco AnyConnect not working

sysad43 — Tue, 04 Oct 2022 13:25:28 GMT

Right, but above people seem to be saying that the SAML/SP/ACS part also needs to be caps. It isnt in the docs.

Re: Azure AD MFA with Cisco AnyConnect not working

sysad43 — Thu, 06 Oct 2022 13:35:02 GMT

Ive tried it both ways and still get same 404 error after MFA signin. One thing Im unsure of is, do I need to enable SSL access on the outside interface for this to work? We only have IKE2 enabled.

Re: Azure AD MFA with Cisco AnyConnect not working

Marvin Rhoads — Thu, 06 Oct 2022 17:43:29 GMT

@sysad43 Azure AD will be replying to the firewall via https to the SP (service Provider in SAML terminology) URL so, yes, SSL must be enabled.

Re: Azure AD MFA with Cisco AnyConnect not working

sysad43 — Wed, 12 Oct 2022 12:35:10 GMT

I figured as much. Im just subbing as the network admin while we try to find someone who wants the job, so Im learning as I go. I will try this as soon as I get the latest interim patch installed.

Re: Azure AD MFA with Cisco AnyConnect not working

Mike Schooley — Mon, 20 Feb 2023 14:11:09 GMT

also worked for me, changed SAML and SP to lowercase and worked.