https://community.cisco.com/t5/network-security/2-mfa-for-cisco-anyconnect-vpn-with-microsoft-azure/m-p/5038222#M1109788 <P>Thank you Rob,</P><P>I don't have any identity certificate! so should I create new one and use it for SP certificate?</P> Tue, 12 Mar 2024 16:50:55 GMT TAC-itsupport 2024-03-12T16:50:55Z https://community.cisco.com/t5/network-security/2-mfa-for-cisco-anyconnect-vpn-with-microsoft-azure/m-p/5038212#M1109785 <P>Hello,</P><P>Ilm attempting to set up 2 MFA for Cisco AnyConnect VPN with Microsoft Azure. However, when I download the certificate from Microsoft and import it to the ASA, I receive an error message stating "trustpoint is not enrolled.</P><P>I have Cisco ASA 5506-x</P><P>ASA version:9.16(4) and ASDM 7.19 and AnyConnect version: 4.10</P><P>Here is the command I use:</P><P>crypto ca trustpoint AzureAD-AC-SAML<BR />revocation-check none<BR />no id-usage<BR />enrollment terminal<BR />no ca-check<BR />crypto ca authenticate AzureAD-AC-SAML<BR />-----BEGIN CERTIFICATE-----</P><P>******</P><P>-----END CERTIFICATE-----</P><P>quit</P><P>webvpn<BR />saml idp https://*********<BR />url sign-in https://********<BR />url sign-out https://******<BR />trustpoint idp AzureAD-AC-SAML<BR />trustpoint sp AzureAD-AC-SAML<BR />no force re-authentication<BR />no signature<BR />base-url <A href="https://*******" target="_blank">https://*******</A></P><P>After this command "trustpoint sp AzureAD-AC-SAML " I got error and said that trustpoint is not enrolled, Please enroll trustpoint !!!</P><P>How can I resolve this issue? Thanks</P> Tue, 12 Mar 2024 16:17:41 GMT https://community.cisco.com/t5/network-security/2-mfa-for-cisco-anyconnect-vpn-with-microsoft-azure/m-p/5038212#M1109785 TAC-itsupport 2024-03-12T16:17:41Z https://community.cisco.com/t5/network-security/2-mfa-for-cisco-anyconnect-vpn-with-microsoft-azure/m-p/5038218#M1109787 <P><a href="https://community.cisco.com/t5/user/viewprofilepage/user-id/1255230">@TAC-itsupport</a> the SP certificate trustpoint should be the existing identity certificate trustpoint used for remote access VPN connections, not the Azure IDP certificate (AzureAD-AC-SAML).</P> Tue, 12 Mar 2024 16:32:32 GMT https://community.cisco.com/t5/network-security/2-mfa-for-cisco-anyconnect-vpn-with-microsoft-azure/m-p/5038218#M1109787 Rob Ingram 2024-03-12T16:32:32Z https://community.cisco.com/t5/network-security/2-mfa-for-cisco-anyconnect-vpn-with-microsoft-azure/m-p/5038222#M1109788 <P>Thank you Rob,</P><P>I don't have any identity certificate! so should I create new one and use it for SP certificate?</P> Tue, 12 Mar 2024 16:50:55 GMT https://community.cisco.com/t5/network-security/2-mfa-for-cisco-anyconnect-vpn-with-microsoft-azure/m-p/5038222#M1109788 TAC-itsupport 2024-03-12T16:50:55Z https://community.cisco.com/t5/network-security/2-mfa-for-cisco-anyconnect-vpn-with-microsoft-azure/m-p/5038226#M1109789 <P><a href="https://community.cisco.com/t5/user/viewprofilepage/user-id/1255230">@TAC-itsupport</a> yes, typically this would be a public CA signed certificate to avoid certificate errors, but it could be signed by your internal CA such as Windows Server CA.</P> <P><A href="https://www.cisco.com/c/en/us/support/docs/security-vpn/public-key-infrastructure-pki/200339-Configure-ASA-SSL-Digital-Certificate-I.html" target="_blank">https://www.cisco.com/c/en/us/support/docs/security-vpn/public-key-infrastructure-pki/200339-Configure-ASA-SSL-Digital-Certificate-I.html</A></P> <P>&nbsp;</P> Tue, 12 Mar 2024 16:53:25 GMT https://community.cisco.com/t5/network-security/2-mfa-for-cisco-anyconnect-vpn-with-microsoft-azure/m-p/5038226#M1109789 Rob Ingram 2024-03-12T16:53:25Z https://community.cisco.com/t5/network-security/2-mfa-for-cisco-anyconnect-vpn-with-microsoft-azure/m-p/5038232#M1109790 <P>Thank you Rob.</P> Tue, 12 Mar 2024 17:04:29 GMT https://community.cisco.com/t5/network-security/2-mfa-for-cisco-anyconnect-vpn-with-microsoft-azure/m-p/5038232#M1109790 TAC-itsupport 2024-03-12T17:04:29Z