configure asa anyconnect vpn azure mfa saml

Ensure the security group associated with your ASAv appliances and NLB listeners are configured to allow traffic destined to User Datagram Protocol (UDP) port 1812 for authentication and authorization, and UDP port 1813 for accounting.

Duo Mobile application on your smartphone used for authentication.

You must set up at least one Duo user whose email address is associated with at least one user in Microsoft Active Directory.

A Duo license learn more about Duo licensing.

To deploy a directory quickly, see the Quick Start for Active Directory Domain Services on AWS.

An existing AWS Managed Microsoft AD directory, or Active Directory Connector, with at least one user.

Cisco ASAv Remote Access VPN appliances deployed in your AWS account using the AWS Quick Start with a default ‘LAB’ VPN connection profile.

Prerequisitesįor this walkthrough, you must have these prerequisites configured in your AWS account: We use Cisco Duo Authentication proxies to redirect the user authentication request to AWS Directory Service for Microsoft Active Directory (AWS Managed Microsoft AD) for primary authentication via LDAPv3, and Duo MFA for multi-factor authentication via TCP port 443.Ĭisco Systems is an AWS ISV Partner that helps customers optimize their cloud strategy by bringing together networking, security, analytics, and management. In this post, we show how to configure external authentication with Cisco ASAv on AWS for Remote Access VPN.

Cisco ASAv integrates with Cisco Duo to add multi-factor authentication to ASAv An圜onnect VPN connections. At the same time, Zero Trust dictates the use of multi-factor authentication (MFA) for those users.Ĭisco ASAv Remote Access VPN provides different types of authentication and authorization capabilities.

With an expansion of remote workers, organizations have scaled their VPN services in the cloud to connect users to corporate resources that may be hosted in the cloud and/or on-premises.Īn important design consideration for cloud-based client VPN service architectures is the choice of authentication mechanism to use for connecting remote users to VPN services.Ī common design is to use Microsoft Active Directory for managing and authenticating user identities into the corporate network.

Remote workers typically access corporate IT environment using virtual private network (VPN) services. By Dinesh Moudgil, Technical Marketing Engineer – Ciscoīy Muffadal Quettawala, Partner Solutions Architect – AWS

Configure asa anyconnect vpn azure mfa saml