cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
586
Views
0
Helpful
3
Replies
luckymike33
Beginner

Anyconnect static ip address with Azure MFA

Hi, 

 

Does anyone have any idea how to configure Anyconnect to obtain a static ip address when using an MFA app like Azure MFA. At the moment I have an ASA pointed towards a Microsoft NPS server with the Azure MFA extension. I have configured each user with a static ip address under the dial in tab. Without the MFA authentication, i.e. just authenticating against AD, the attributes can be passed down from the NPS server towards the ASA, but as soon as you enable the Azure MFA in the NPS - the attributes stop being passed down. 

 

I have also tried pointing the ASA at an ACS, which is configured to act as a Radius proxy, which then queries the NPS/MFA setup, with an identical user account also created in the ACS and a static ip address configured under each user account. But this fails too - due to 'Radius client encountering an error during processing flow'. 

 

I am now beginning to wonder if it is at all possible to configure a static ip address alongside a MFA solution, whether that is Azure/Duo etc. Can anyone help in anyway on this?

3 REPLIES 3
Mohammed al Baqari
VIP Advisor

I had similar problem but with ISE instead of NPS and fixed it with the
following:

- On ASA configured aaa authentication for anyconnect to point to MFA proxy
server (MFA frond-end)
- On ASA configured ISE as authorization server only.

This way the users authenticate with AD/MFA (with MS MFA App) and after
successful authentication, ISE with perform authorisation and provides the
IP address, DACL, AnyConnect mode (IKEv2 or SSL), etc.
Pablo
Cisco Employee

If you're using OATH or SMS for the 2FA challenge then you're hitting a limitation with the MFA NPS extension"

https://social.msdn.microsoft.com/Forums/sqlserver/en-US/1908fdad-51ba-46e3-ad51-a59c4f686c3e/anyconnect-client-using-nps-extension-with-sms-not-sending-avpair?forum=WindowsAzureAD

I've seen this AV pairs returned just fine with the App verification/Phone call.

HTH.

ShenzoWu03955
Beginner

Hi

 

Were you able to get to the bottom of this?

Content for Community-Ad