Cisco AnyConnect Dual Authentication Setup

[IT-LDI]

We are currently using Cisco AnyConnect 4.x to access remotely. We are also running Cisco Firepower, and have Active Directory running.

I will start with my first question on this.

1. Do I need to purchase another certificate for the 2nd authentication?

I did find this information from Cisco and hoping that this would be one way to do the dual authentication.

ASA AnyConnect Double Authentication with Certificate Validation, Mapping, and Pre-Fill Configuration Guide - Cisco

Thank you,

[balaji.bandi]

Are you looking Multi-Factor Authentication? what is the Version of FTD you running?

https://www.cisco.com/c/en/us/td/docs/security/firepower/640/relnotes/firepower-release-notes-640/features.html

[IT-LDI]

Yes I am looking at multifactor authentication for Cisco AnyConnect login. We are running Firepower 6.4.0.4 build 34. I see that the link shows that it can be done. 

It looks like maybe it can be done from the link you provided

Here's what we're running

Thank you

[balaji.bandi · Accepted solution]

yes it is possible, choose the 2 facto authentication method, like any token-based, or google authenticator or Azure (based on the requirement).

[IT-LDI]

It it possible with my version of FMC Firepower Management Console or must I upgrade it to have the Firepower Threat Defence? Is this just purchasing another Cisco License or do the ASA's need to be upgraded too?

[balaji.bandi]

For 2 Facto authentication - i do not believe you need extra License, you need to integrate with 2nd factory authentication with the vendor you choose.

[IT-LDI]

So it cannot be done directly through the FMC and a 3rd party application needs to be used. Is it because we are runniing the FMC and not FTD? I thought the link you provided showed that it was possible.

[balaji.bandi · Accepted solution]

FMC is just management tool to make changes on FTD.

below example give you some information :

https://www.cisco.com/c/en/us/support/docs/network-management/remote-access/215234-multi-factor-authentication-using-duo-l.html

2factor authentication :

https://www.cisco.com/c/en/us/td/docs/security/firepower/650/fdm/fptd-fdm-config-guide-650/fptd-fdm-ravpn.html