integrate Cisco vManage on version 20.12.4 with Cisco DUO for MFA func

[lalit-agrawal]

Hello,

I want to integrate Cisco SDWAN Manager (vManage) on version 20.12.4 with Cisco DUO for MFA. I do not find vManage as protected application on DUO portal.

Regards,

Lalit Agrawal

[balaji.bandi]

yes possible check the release notes and guide :

https://www.cisco.com/c/en/us/td/docs/routers/sdwan/release/notes/controllers-20-12/rel-notes-controllers-20-12.html

Note : there may be some issue Multi-tenant (hope this is single tenant) - then you may look for 20.15.X code

[abebeTelus]

The problem is there is no documentation on DUO side showing how to configure this. SD-WAN Manager is not in the list of applications when we go to "protected applications". The setting on SDWAN Manager seems straight-forward but there is no clue give how to configure this on DUO portal.

[Cristian Matei]

Hi,

   You should find all your answers here: https://community.cisco.com/t5/protecting-applications/duo-sso-integration-for-cisco-vmanage/td-p/4901767

Best,

Cristian.

[DuoKristina]

Hello, it looks like the SD-WAN instructions for Duo left out a necessary prerequisite step of creating a Duo application. I believe you need to create an Auth API application and use that application's integration key, secret key, and API hostname to complete the SD-WAN MFA configuration.

Instructions for creating an Auth API application can be found here: https://duo.com/docs/authapi#first-steps

I left feedback on the SD-WAN documentation requesting they add the missing step.

[abebeTelus]

Thanks @DuoKristina. I figured to use the AUTH API to create the authentication credentials. Another issue I found is that when we disable MFA from SDWAN Manager GUI, it does not completely remove the config, we have to login to the CLI and delete from there.

[DuoKristina]

You might want to leave feedback about your experience disabling MFA on the SD-WAN document as well so they might add it as a warning.