Cisco anyconnect configuration how to#
Cisco anyconnect configuration install#
Cisco anyconnect configuration update#
Cisco anyconnect configuration software#

In the 'Install Certificate' window, select the Install from a file option and then click the Browse. Navigate to Certificate Management в†’ CA Certificates. Log on to your Cisco ASA administrator web interface (ASDM).Д¬lick the Configuration tab and then click Device Management in the left menu. If you did not already do so, download the DigiCert High Assurance EV Root CA and DigiCert SHA2 High Assurance Server CA certificates from the DigiCert site for installation on your ASA. To install the DigiCert root and intermediate CA certificates used by Duo's service on your ASA:

Cisco anyconnect configuration update#

If you plan to update to 9.13(1) or later after configuring Duo, it's a good idea to install the DigiCert CA certificates now.

If your device is running 9.13(1) you'll need to install the DigiCert CA certificates on your ASA so that it can establish the secure LDAP connection to Duo.

Cisco anyconnect configuration software#

ASA software versions 9.13(1) and later perform certificate validation for secure LDAP connections. Don't share it with unauthorized individuals or email it to anyone under any circumstances! Install the DigiCert CA CertificatesДuo's cloud service secures SSL traffic with certificates issued by DigiCert. Secure it as you would any sensitive credential. The security of your Duo application is tied to the security of your secret key (skey).

If your ASA software version is 9.13(1) or later, download the DigiCert High Assurance EV Root CA and DigiCert SHA2 High Assurance Server CA certificates from the DigiCert site for installation on your ASA.

You will need to upload this to your ASA. This file is customized for your account and has your Duo account ID appended to the file name (after the version).

Download the Duo Cisco package from your Cisco SSL VPN application's properties page in the Duo Admin Panel, and unzip it somewhere convenient such as your desktop.

See Protecting Applications for more information about protecting applications in Duo and additional application options. You'll need this information to complete your setup. Click Protect to the far-right to configure the application and get your integration key, secret key, and API hostname.

Log in to the Duo Admin Panel and navigate to Applications.Д¬lick Protect an Application and locate the entry for Cisco ASA SSL VPN in the applications list.

You should already have a working primary authentication configuration for your SSL VPN users before you begin to deploy Duo, e.g.

Cisco anyconnect configuration how to#

Log on to your Cisco ASDM interface and verify that your Cisco ASA firmware is version 8.3 or later.Д«efore moving on to the deployment steps, it's a good idea to familiarize yourself with Duo administration concepts and features like options for applications, available methods for enrolling Duo users, and Duo policy settings and how to apply them. If you need to protect connections that use Cisco's desktop VPN client (IKE encryption), use our Cisco IPSec instructions.Д«efore starting, make sure that Duo is compatible with your Cisco ASA device. Please refer to the Duo for Cisco Anењњonnect VPN with ASA or Firepower overview to learn more about the different options for protecting ASA logins with Duo MFA.

Primary and Duo secondary authentication occur at the identity provider, not at the ASA itself. This deployment option features Duo Single Sign-On, our cloud-hosted SAML 2.0 identity provider. The SAML VPN instructions feature inline enrollment and the interactive Duo Prompt for both web-based VPN logins and Anењњonnect 4.6+ client logins. The Anењњonnect RADIUS instructions do not feature the interactive Duo Prompt for web-based logins, but does capture client IP informations for use with Duo policies, such as geolocation and authorized networks. This integration expressly supports Cisco ASA VPN and is not guaranteed to work with any other VPN solution. This Duo ASA SSL VPN configuration supports inline self-service enrollment and the Duo Prompt for web-based VPN logins, and push, phone call, or passcode authentication for Anењњonnect desktop and mobile client connections that use SSL encryption. Duo integrates with your Cisco ASA VPN to add two-factor authentication to any VPN login.