Anyconnect can integrate cisco ISE + O365

[jewfcb001]

HI All ,

I try to find the solution Cisco Anyconnect integrate Cisco ISE and O365 but cannot found and I found the solution in cisco site the solution is cisco DUO integrate with O365 instead ISE . I would like to confirm

If Solution with Cisco ASA with anyconnect VPN can integrate with picture below or not ? 

[balaji.bandi]

check this below thread :

https://community.cisco.com/t5/security-knowledge-base/anyconnect-azure-ad-saml-sso/ta-p/3810013

[Aref Alsouqi]

That is a valid design. What you would need to do is configure ISE with Duo to relay the authentication requests to Duo, which will in turn be integrated with your Azure AD.

[jewfcb001]

@Aref Alsouqi  

I would like to change some requirement . I have a small question . 

Can Anyconnect and integrate with microsoft authenticator + Azure AD or not?

[Aref Alsouqi]

Yes, AnyConnect can be integrated with Office 365 SMAL. Regarding the authenticator app, that is not an AnyConnect part, that is how you configure the users for multi factor authentication on Azure, if you allow them to be enrolled with the authenticator app, then they can go through the enrolment and use it to approve the AnyConnect authentication requests.

[jewfcb001]

@Aref Alsouqi 

Thank you for information .  I think that scenario need configure on ASA Firewall and Azure AD . 
If I need configure sperate group-policy on Firewall from Group Azure AD / ISE . 

My Scenario is  Anyconnect + Azure AD for Authentication and MFA and Cisco ISE do authorize or do something for support this scenario .

Can I do this scenario ?

[Aref Alsouqi]

Yes you can do that, however, given you have ISE on your deployment I would recommend to use ISE for both authentication and authorization. In that case you will integrate ISE with Azure MFA, and if the authentication passes the session will be authorized. The traffic flow would look like this:

- AnyConnect tries to connect to the ASA

- The ASA relays the authentication request to ISE

- ISE relays the authentication request to MFA

- MFA sends the push to the user mobile device

- The user approves the push

- ISE gets the "ok" from MFA

- ISE sends a message to the ASA stating the session is good to go

- The ASA creates the session for AnyConnect

[jewfcb001]

@Aref Alsouqi 

Thank you for information . But the customer need to direct integrate from ASA to Microsoft Authenticator . 

I think , We need SAML integrate from ASA to Azure AD . and use ISE do authorize because we need cisco ise in solution. Am i correct ? 

[Aref Alsouqi]

Yes, you are correct. You can integrate the ASA with Azure/SAML and once the authentication passes, the ASA will reach out to ISE for the authorization.