MFA on ASA 5508

[stevep001]

I do not see anywhere in the help documentation how to require MFA on our VPN. Is it possible?

[Rahul Govindan]

Are you talking about the Azure MFA with Anyconnect VPN? The MS guide below should help:

https://docs.microsoft.com/en-us/azure/multi-factor-authentication/multi-factor-authentication-advanced-vpn-configurations

[stevep001]

No, we do not have Azure. Am I going to have to buy/install other software?

[Rahul Govindan]

The ASA itself can do double authentication - AAA+certificate authentication. The certificate and AAA can be tied in together using the 'pre-fill username from certificate' option to get a pseudo two factor authentication.

http://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/116111-11611-config-double-authen-00.html

For true 2 factor authentication for VPN, it is recommended to use one of the commonly used services. Duo is one of the most common ones I have seen - works very well with the ASA in my experience. 

[stevep001]

Thanks

[Steph.Kindel]

Also, Crossmatch has a product called DigitalPersona which offers MFA support for your VPN which includes MFA for windows logon as well. Something worth checking out.