2fa with locally signed certificate

[Infrastructure Team]

Hi all, I hope someone can help and share ideas.

We currently use Anyconnect VPN with AD and token for authentication, and I'm looking to change this to AD plus certificate.

We want to use an AD self signed certificate, which a specific group policy installs on the machine at first join to the domain (for wireless access). 

The requirement being, upon connection your AD credentials are verified, then have the DAP for that authentication group on the ASA (9.7) verify the existence of the cert on as an endpoint attribute as part of the authentication process.

I've seen many posts about using a proper CA etc, but nothing on how to check for a locally/self signed certificate.

Any pointers on how to set this up on the ASA?

Thanks in advance.

[Rob Ingram]

Hi,

What you want to do is configure a tunnel-group on the ASA with double authentication (certificate and UN/PW), you don't need to use DAP. When you say use a self signed certificate, I assume you mean a certificate issued by an Internal Windows CA rather than a public CA? If so, this example here shows how to configure a trustpoint on an ASA, enroll for a certificate and configure double authentication.

HTH