cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
517
Views
8
Helpful
3
Replies
jhallam01
Beginner

2 Factor Options with AnyConnect

Hello,

We are currently using the AnyConnect VPN client and want to setup 2 factor authentication.  My research shows that there are 2 ways:

1. Token Based. Examples of this would be Duo or Google Authenticator etc

2. Certificate Based. Where the users computer it the 2nd factor through the presence of a certificate.

The company would like to use the certificate based method of 2 factor.  I have found quite a few article outlining this through the use of a local CA server to handle user certificates.  While this is an option, we would prefer not to have to manage a CA server.  The question I was asked (which I don't know the answer to) is "Can we set it up where all users use the same certificate as the 2nd factor instead of each user having a unique certificate?".  I know that doing it this way is probably not the "Best practice" way, but is it possible?  If it is possible, are there any resources (I couldn't find any) that outline the process for implementation?

Previously we were using IPSec.  To login we required the correct credentials, plus a custom profile that was provided to the user by us.  The custom profile was not available/accessible to users outside our network.  So factor 1 was the users credentials and factor 2 was the profile.

Thanks for the help. 

 

3 REPLIES 3
Peter Long
Beginner

Use the head end device as the CA Server (i.e. The Firewall)

Pete

Thank you for your response.

Was the "Securing Cisco SSL VPN’s with Certificates" supposed to be a link to an article?

bascheew
Beginner

I'd like to do the same thing.  Did you ever come up with a solution to using the same cert for all users?

Content for Community-Ad