Anyconnect VPN integration with Cisco DUO without separate AD or RADIUS server

[AmeyaThorat63010]

Hi!

I am planning to deploy Cisco ASA with Anyconnect for enabling remote access VPN. I am also planning to integrate Cisco DUO with Anyconnect for Multifactor Authentication. I want to create local users on ASA for VPN authentication without having a separate Active Directory or RADIUS server. Will Cisco DUO support such scenario where there is not separate Active Directory/RADIUS server for primary? Can Cisco DUO query ASA for verifying username and password before sending request to DUO cloud for Second Factor Authentication?

[Karsten Iwen]

Yes that works. The primary authentication runs against the local database and if that succeeds the DUO LDAP is queried for the secondary authentication. I run this scenario at home. 

https://duo.com/docs/cisco#asa-ssl-vpn-using-ldaps