Intigration Duo with Cisco Firepower Threat Defense (FTD) VPN with AnyConnect

[rebazsalih]

Hello

I want to implement Duo integration with your Cisco Firepower Threat Defense (FTD) SSL VPN to add two-factor authentication to AnyConnect VPN logins.without using ISE

This Link (  https://duo.com/docs/cisco-firepower ) describs steps on how to do it and explains steps with video.

I following same steps ,but with No luck ,When I enter Username and Password it does not send me any Push and can not login to the Anyconnect,and when I test  aaa-server in Lina engine, it shows below error

ERROR: Authentication Server not responding: No active server found

Note:

• For intigration Duo Proxy with Active Directory , there is syc between them and we used that for Remote Desktop users and works perfectly, so there is no issue between due and AD
• there is conectivity between FTD and FMC to the Duo Proxy Server and Active directory

I need help on how to do it ,I tried in diffent ways and configuration but still with no luck,

and I cant find any ducumentation on how to do that from cisco side.

Regards

[Rob Ingram]

Hi,

How have you got your Duo proxy setup? Have you correctly configured the authproxy.cfg file?

What is the output of the authproxy.log? Any obvious errors? If so provide the output

HTH

[rebazsalih]

Thanks Rob for reply,

did you configured duo with FTD? I have a concern that it can not be done without ISE. 

As I mentioned, I did exactly what is done in the documentation, and I checked the authproxy file  authproxy_connectivity_tool.exe, all services are green and there is  not any error in authproxy.cnf

[Rob Ingram · Accepted solution]

Yes I've configured FTD directly with Duo proxy and ISE, both worked.

[rebazsalih]

Can you please share authproxy config file please, 

Or did you take any other steps rather than what is mentioned in the documentation. 

When adding RADIUS aerver in ftd, which one did yoi choos, base on routed or specific interface? 

[ajay.bhat]

Hi Rob 

Can you please help me setup DUO for anyconnect vpn users. I  have FTD and ISE in production for VPN users. Now we want to Add duo for 2nd factor authentication.

[Javanshir]

Hi are you solve the problem? 

[Javanshir]

Hello can you share me configuration? I use FTD and ISE for client vpn and want DUO for 2FA

[IvanAlvarenga25979]

Have you configured Cisco DUO using FDM 6.7 ( no FMC ) ?

[rebazsalih]

Hi Ivan

Please follow below documentation

Duo Two-Factor Authentication for Cisco Firepower Threat Defense (FTD) VPN with AnyConnect | Duo Security