Documentation

Cisco ASA VPN

Duo integrates with your Cisco ASA VPN to add two-factor authentication to any VPN login. The SSL VPN integration supports inline self-service enrollment and authentication prompt. The IPsec integration works Cisco's desktop VPN client, and the SSL VPN integration works with desktop and mobile AnyConnect clients.

Integration Video

First Steps

Before starting, make sure that Duo is compatible with your Cisco ASA device. Log on to your Cisco ASDM interface and verify that your Cisco ASA firmware is version 8.3 - 9.1.

Then you’ll need to:

  1. Sign up for a Duo account
  2. Create a new Cisco SSL VPN integration to get an integration key, secret key, and API hostname. (See Getting Started for help.)
  3. Download the Duo Cisco integration package from the Duo administrative interface, and unzip it somewhere convenient such as your desktop.

Connectivity Requirements

This integration communicates with Duo’s service on TCP port 636. Also, we do not recommend locking down your firewall to individual IP addresses, since these may change over time to maintain our service’s high availability.

Modify the sign-in page

To add the Duo integration to your Cisco sign-in page:

  1. Log on to your Cisco ASA administrator web interface (ASDM).
  2. Click the Configuration tab and then click Remote Access VPN in the left menu.
  3. Navigate to Clientless SSL VPN AccessPortalWeb Contents. Then click Import.
  4. In the Source section, select Local computer, click Browse Local Files…, and find the Duo-Cisco-vX.js file extracted from the Duo-Cisco-vX-accountid.zip file downloaded earlier from the Duo admin console where vX will reflect the actual version of the Duo Cisco package and accountid is your organization’s Duo Account ID (visible on the Settings tab of the Duo admin interface) i.e. Duo-Cisco-v5-1234-5678-90.zip). After the file is selected, Duo-Cisco-vX.js will appear in the Web Content Path box.
  5. In the Destination section, select No in response to “Require authentication to access its content?”
  6. Click Import Now then click Apply
  7. Navigate to Clientless SSL VPN AccessPortalCustomization, select the Customization Object you want to modify, and then click Edit.
  8. In the outline on the left, click Title Panel (under Logon Page).
  9. Then type <script src="/+CSCOU+/Duo-Cisco-vX.js"></script> (replacing vX with the file version actually downloaded) in the Text: box. Click OK.
  10. Click Apply

Add the Duo LDAP server

  1. Navigate to AAA/Local UsersAAA Server Groups, click Add, and fill out the form:

    Server Group Duo-LDAP
    Protocol LDAP

  2. Click OK.
  3. Select the Duo-LDAP group you just added.
  4. In the Servers in the Selected Group section, click Add and fill out the form:

    Interface Name Choose your external, internet-facing interface (it may be called “outside”)
    Server Name or IP Address Your API hostname (i.e. api-XXXXXXXX.duosecurity.com)
    Timeout 60 seconds
  5. Check Enable LDAP over SSL and fill out the form (replacing INTEGRATION_KEY and SECRET_KEY with your integration-specific keys) :

    Server Port 636
    Server Type — Detect Automatically/Use Generic Type —
    Base DN dc=INTEGRATION_KEY,dc=duosecurity,dc=com
    Scope One level beneath the Base DN
    Naming Attribute(s) cn
    Login DN dc=INTEGRATION_KEY,dc=duosecurity,dc=com
    Login Password SECRET_KEY

  6. Click OK.
  7. Click Apply.

Configure the Duo LDAP server

  1. Navigate to Clientless SSL VPN AccessConnection Profiles
  2. Select the connection profile near the bottom and click Edit (the connection profile might be called “DefaultWEBVPNGroup”).
  3. Choose Secondary Authentication (under Advanced) from the left menu.
  4. Select Duo-LDAP from the Server Group list.
  5. Uncheck the Use LOCAL if Server Group fails check box.
  6. Check the Use primary username check box.
  7. Click OK.
  8. Click Apply.

Configure AnyConnect

If any of your users will be logging in through desktop or mobile AnyConnect clients (click here to learn more about Duo and AnyConnect), you’ll need to increase the AnyConnect Authentication Timeout so that users have enough time to use Duo Push or phone callback. Here’s how:

  1. Navigate to Configuration → Remote Access VPN → Network (Client) Access → AnyConnect Client Profile
  2. Click Edit
  3. In the left menu, navigate to “Preferences (Part 2)”.
  4. Scroll to the bottom of the page and modify the “Authentication Timeout (seconds)” setting to 60 seconds.
  5. Click OK.
  6. Click Apply to activate the new AnyConnect Client settings.

You now have an increased authentication timeout. This timeout will take effect after each client successfully logs into the VPN after applying the new profile.

Test Your Setup

Visit your Cisco ASA SSL VPN Service URL (it usually ends in /+CSCOE+/logon.html). After you complete the primary authentication, Duo enrollment/login should appear.

Using AnyConnect? Learn how Duo works with desktop and mobile AnyConnect clients.

Network Diagram

  1. Cisco SSL VPN connection initiated
  2. Primary authentication
  3. Cisco ASA connection established to Duo Security over TCP port 636
  4. Secondary authentication via Duo Security’s service
  5. Cisco ASA receives authentication response
  6. Cisco SSLVPN connection established