Cisco ASA- AnyConnect VPN - setting MFA

[LovejitSingh130013]

Hello Guys, 

@Rob Ingram  @balaji.bandi   @Richard Burts   @Joseph W. Doherty 

I had VPN setup with ASA with AD authentication with one of the server and its working flawless.

I want to setup 2 MFA with Duo or Azure MFA, which is better solution? 

Also, Is there any open-source options exist?

The other thing is when I want to setup MFA, I want to setup new instance/Profile of VPN where I can try this thing. 

The question how I can setup each instance/profile of vpn mapped to different dns entry?

Like for now, If I connect to vpn.xyz.com it gives me option to choose one of the both profiles. what I want is this:

vpn.xyz.com --> profile1

vpn2.xyz.com --> profile 2

Thanks,

[Rob Ingram · Accepted solution]

@LovejitSingh130013 

Well this is a cisco forum, so lets just say Cisco DUO is better. It's a matter of opininon/personal experience really.

You'll want to use group-url when configuring, check out this link.

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/98580-enable-group-dropdown.html

[Milos_Jovanovic · Accepted solution]

Hi @LovejitSingh130013,

As @Rob Ingram said, this is Cisco forum, so we prefer Duo. You have multiple integration options for Duo, and they are all well described. You also have an option to go for a trial with Duo , so you can test it.

I also agree with Rob, you don't need to use different DNS name, you can use different tunnel-groups for this.

BR,

Milos