Anyconnect with SAML on a router

[Richard Tapp]

We have managed to deploy SAML authentication for Anyconnect on our firewall estate with no issue

But we have one router running anyconnect and Google does not seem to throw up any config examples for this.

Has anyone ever managed to do this on a router, if so could you please share the saml config part for it.

[Cisco_Virtual_Engineer]

To configure SAML authentication for AnyConnect on an ASA router, follow these steps:

1. Create a Trustpoint and import the SAML certificate:

bash
crypto ca trustpoint AzureAD-AC-SAML
revocation-check none
no id-usage enrollment terminal
no ca-check
crypto ca authenticate AzureAD-AC-SAML
-----BEGIN CERTIFICATE-----
... PEM Certificate Text you downloaded goes here ...
-----END CERTIFICATE-----
quit


2. Provision your SAML IdP with the following commands:

bash
webvpn saml idp https://sts.windows.net/xxxxxxxxxxxxx/ - [Azure AD Identifier]
url sign-in https://login.microsoftonline.com/xxxxxxxxxxxxxxxxxxxxxx/saml2 - [Login URL]
url sign-out https://login.microsoftonline.com/common/wsfederation?wa=wsignout1.0 – Logout URL
trustpoint idp AzureAD-AC-SAML - [IdP Trustpoint]
trustpoint sp ASA-EXTERNAL-CERT - [SP Trustpoint]
no force re-authentication
no signature
base-url https://asa.example.com


3. Apply SAML authentication to a VPN tunnel configuration:

bash
tunnel-group AnyConnectVPN-1 webvpn-attributes
saml identity-provider https://sts.windows.net/xxxxxxxxxxxxx/
authentication saml
end
write memory


Make sure to replace the placeholders `[Azure AD Identifier]`, `[Login URL]`, and `[Logout URL]` with the actual values provided by your SAML identity provider (IdP).

It is also recommended to verify the configuration and troubleshoot any issues using the debug commands `debug webvpn saml 255`, `debug webvpn 255`, `debug webvpn session 255`, and `debug webvpn request 255`.

(Source: [Cisco - Configure ASA AnyConnect VPN with Microsoft Azure MFA through SAML](https://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/215935-configure-asa-anyconnect-vpn-with-micros.html))

[Richard Tapp]

Thanks, we did have this set. It turns out there is a slight issue on older versions of IOS and Azure.

We had multiple SAML profiles, each one created a new certificate  which we added to the ASA.

The trouble is the ASA could only have 1 SAML server with 1 certificate.

So the work around is to create you own certificate, upload that to each Azure side profile and also to the one SAML server on the ASA and it now all works fine.

We had one Cisco engineer on the case for about 4 hours with no success, when his shift ended and a new engineer came on, he spotted this issue in about 10 minutes and was fixed in under an hour.