Anyconnect Mobility client setup suggestions

[gp1200x]

We have used IPSEC with  VPN 30XXs and ACS 4.3 (or 4.2?) for years with the older VPN clients but with Windows 10 we can no longer make it work. Time to switch to Anyconnect.   We have a few ASA 5510/5520s with Anyconnect Premium peer  support so we can move off IPsec. I have it working using TLS with the ACS  but I think we need a new AAA server upgrade too.

Questions.. What is the best / cheapest way to utilize somewhat of a two factor authentication. Currently it seems using the ACS that only a user name and password (no group user/psw) is used to authenticate in. A paid cert on the 55xxs to avoid the security issue is not a problem but certs for each client would be cumbersome to manage. ICS seems to be the way to go for managing users unless there is a easier/cheaper compatible product.   

Any directions of the best way to go would be appreciated since there appears to be a lot of options - all with additional costs. We want full IP connectivity like we have with IPsec since we also have Citrix GW for specialized connections. 

The only options I might want is to check for an antivirus service. We do not allow split tunneling for users allow I had it working during testing (Split tunneling only for admin users).

We will stay with Anyconnect 3.x since it is free and supported for 3 more years from what I read. AC 4.x seems to imply additional client charges from what we currently have.

Thanks!  

[Marvin Rhoads · Accepted solution]

If you're handy with Windows server and want to stay on the low cost route, then issue the users certificates using SCEP proxy via the ASA. Then their issued certificate is the first authentication method and the second one is their password.

You can even setup the ASA to pull the username from the certificate automatically and prevent the user from typing in anything else if you so desire.

Have a look at Cisco Live presentation "BRKSEC-3053 Practical PKI for Remote Access VPN" from San Diego 2015. It is a very thorough guide for doing this (and alternatively using ISE as well).

https://www.ciscolive.com/online/connect/sessionDetail.ww?SESSION_ID=83702&backBtn=true

If you want to go third party, I have been very favorably impressed by the Duo Security 2FA solution. You do pay a recurring fee but its pretty reasonable priced. They have some step by step guides that are very well done.

https://www.duosecurity.com/docs/cisco

[gp1200x]

Thanks...Very informative and a nice place for me to start running with it. It's basically the same way I was thinking of doing it more than 7 years ago when I looked into it but IPSEC and ACS just  keep working flawlessly with every Win upgrade. Win 10 finally broke that scenario.