What is the right AnyConnect-license for two factor authentication?

[swscco001]

Hello everybody,

our customer is planning two factor authentication (e.g. DUO) for
AnyConnect access to their FTDs.

I am not sure what license-license is the correct one. Is it enough
to use the Plus lisense or do they need the Apex license.

I did not find the answer in the AnyConnect ordering guide.

Thanks a lot for your hints!

Bye
R.

[balaji.bandi]

RA VPN license, any of the following: AnyConnect Plus, AnyConnect Apex, or AnyConnect VPN Only

Check here for License :

https://www.cisco.com/c/en/us/td/docs/security/firepower/621/configuration/guide/fpmc-config-guide-v621/licensing_firepower_system.html

You need to buy any connect license  (it come with 25 start with)

https://www.cisco.com/c/en/us/products/collateral/security/anyconnect-og.html

https://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/200191-AnyConnect-Licensing-Frequently-Asked-Qu.html#anc5

2Factor is additional cost depends on vendor you choose (like duo) or any other Google authenticator or 3rd party tokens

[Marvin Rhoads · Accepted solution]

Generally speaking AnyConnect is just passing whatever authentication credential(s) the user or endpoint provides to the headend device (ASA, FTD or router) and/or configured authentication server(s).

So you can equally use AnyConnect Plus, Apex or VPN only licenses in the basic 2FA use cases (i.e.  where the 2FA happens on the "back end").

If your 2FA is implemented via SAML (as is commonly the case with both Cisco Duo and Microsoft Azure AD with Authenticator) then  AnyConnect Apex licenses are required.

[swscco001]

Hi Marvin,

this was the information I needed.

Thanks a lot!

[ivhanez1212]

Hi Marvin,

Just wanted to ask, what other 2FA option is available for AnyConnect Plus (perpetual)?

I was trying to configure Azure MFA, I keep on getting failed to generate SAML AuthnRequest, then I saw your post that SAML needs Apex or VPN only license, saves me a lot of time in troubleshooting.

Thank you.

[Marvin Rhoads]

@ivhanez1212 you can do 2FA (e.g. Duo or other) with RADIUS.

I have done this both with Duo Authentication Proxy (with Duo of course) and Microsoft NPS (with MS Authenticator MFA)