cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
2545
Views
0
Helpful
4
Replies
khaled1985
Beginner

Configure OKTA MFA for Cisco Anyconnect VPN

Hi, we want to use OKTA as MFA authentication and I below what I did:

  • Create an Authentication, Authorization, and Accounting (AAA) Server Group on the Cisco ASA using the ADSM management software.
  • Create one AAA Server Profiles within the AAA group.
  • Configure the Cisco ASA to use the AAA group for VPN access.

I'm putting my username and password and prompt showing up to put the authentication cod received the it show me login filed.

 

The error is (authentication challenged no error)

 

Please advice if you configured OKTA to authenticate with Anyconnect or if you know the solution.

 

aaa-server OktaRadiusGroup protocol radius
 max-failed-attempts 5
aaa-server OktaRadiusGroup (inside) host 10.x.x.x
 timeout 20
 key *****
 authentication-port 1812
 no mschapv2-capable

 

4 REPLIES 4
Rahul Govindan
Advocate

Are you following this guide?

 

https://help.okta.com/en/prod/Content/Topics/integrations/cisco-radius-intg.htm

 

You might want to run "debug radius all" on the ASA when you test so that you can see what is happening. Also, run a packet capture on the ASA as below:

 

capture capi interface <lan-interface-name> match ip host <asa-lan-interface-ip> host <okta-server> 

 

then "show capture capi" after the test.

Yes, I followed the same guide.

 

When I try to test the server from ASDM getting below error:

Authentication Challenged: No error 

 

Below is the packet capture when I try to connect from AnyConnect:

6 packets captured

   1: 08:49:04.249498       asa-lan-interface.51617 > okta-server.1812:  udp 657
   2: 08:49:05.584228       okta-server.1812 > asa-lan-interface.51617:  udp 220
   3: 08:49:06.160056       asa-lan-interface.51617 > okta-server.1812:  udp 747
   4: 08:49:06.755743       okta-server.1812 > asa-lan-interface.51617:  udp 172
   5: 08:49:16.361751       asa-lan-interface.51617 > okta-server.1812:  udp 747
   6: 08:49:16.880813       okta-server.1812 > asa-lan-interface.51617:  udp 39
6 packets shown

 

Below is the packet capture when I try to test from ASDM:

8 packets captured

   1: 08:49:04.249498       asa-lan-interface.51617 > okta-server.1812:  udp 657
   2: 08:49:05.584228       okta-server.1812 > asa-lan-interface.51617:  udp 220
   3: 08:49:06.160056       asa-lan-interface.51617 > okta-server.1812:  udp 747
   4: 08:49:06.755743       okta-server.1812 > asa-lan-interface.51617:  udp 172
   5: 08:49:16.361751       asa-lan-interface.51617 > okta-server.1812:  udp 747
   6: 08:49:16.880813       okta-server.1812 > asa-lan-interface.51617:  udp 39
   7: 08:50:32.104074       asa-lan-interface.51617 > okta-server.1812:  udp 87
   8: 08:50:33.321470       okta-server.1812 > asa-lan-interface.51617:  udp 220
8 packets shown

Was anyone able to resolve this? We'd like to use SAML and not RADIUS. 2020-04-10_8-22-46.pngThanks

 

 

 

Content for Community-Ad