Cisco AnyConnect not prompting for username, password and MFA

[SatishJ11]

Hi All,

Last week I have upgraded by ASAv Firewall from 9-20-2-22 to 9-20-3 post that AnyConnect is not prompting for username, password and MFA(SAML) are not prompting for corporate laptops, if I access the VPN URL from external VPN prompts for username, password followed by MFA. Did anyone face this issue ? And if I want to enable authentication what needs to be done ?

Regards,

SJ

[ccieexpert]

you mean when you access it from a browser it works fine ? please attach a DART https://www.cisco.com/c/en/us/support/docs/security/secure-client/221919-collect-dart-bundle-for-secure-client.html

also any screenshots of what the ui is showing ?

[SatishJ11]

I mean to say if I access my VPN URL with FQDN in Cisco AnyConnect client, for corporate laptops it's not asking for username, password and MFA. It's official so I will not be able to share DART.

[Marius Gunnerud]

Interesting, I do know that sometimes you need to remove and add back the SAML configuration to make it work again.  Have you done that? 

[SatishJ11]

I can try this today and update here

[SatishJ11]

I have readded the SAML config under webvpn and tunnel-group, still no luck.

[ccieexpert]

can you make sure this is enabled:

Request IDP re-authentication at login—Select this option for the user to re-authenticate at each login, rather than have the SAML server re-use a previous authentication session. This option is enabled by default.

Also, use a browser incognito window to browse to the same url and see if there is a redirection and prompt for user/password / mfa.

[SatishJ11]

If I try in incognito window, VPN is asking for credentials.

What I could observe is that, that system which are connected to Windows like Microsoft Office 365 or say registered in Intune, those systems are getting connected to VPN automatically.