configure asa anyconnect vpn azure mfa saml

I’ll keep things rather high level but if you get stuck, please drop a comment below and I’ll do my best to answer. Lastly, having a basic understanding of ISE policy structure, conditions, and Authorization Profiles is also helpful. This blog will assume you already have some familiarity w/ configuring remote access VPN on Cisco Firepower devices through the FMC, as well as some familiarity defining ‘Enterprise Applications’ in Azure AD portal and the Duo Admin Portal. Our VPN setup separates ‘Employees’ from ‘Contractors’ and grants restricted access to ‘Contractor’ users connecting by assigning the ‘Contractor’ Group Policy for which they are authorized. This gives you the ability to differentiate different access rights based on the AD group the user belongs to. You can achieve this using Group Policies on the FTD based on authorization results from ISE, which can be leveraged to verify the user/group and return an attribute value to the FTD. You may only have one user type in your organization that needs VPN access (employees with full access), and this guide can still be used for these cases, but you may find this guide especially helpful if you need to restrict access based on different AD groups. This is helpful if you’d like to differentiate access based on the user’s group memberships.

The Group Policy would define specific details for that VPN connection (restrictions through ACL, split tunnels, client modules, etc). If successfully matching policy conditions, the ISE Authorization Profile will return a Cisco ASA/FTD VSA which the firewall will use to assign the VPN user to a specific Group Policy.

If properly authenticated with AAD/Duo, Authorization would then be sent to on-prem ISE server for Authorization. In addition, Azure would kick off a 2-Factor Authentication request against Duo using an Azure Conditional Access policy.

This blog will focus on using Cisco Secure Client (Formally known as Cisco Anyconnect) to establish a remote access VPN connection with a Cisco Secure Firewall (FTD) and have user authentication sent to Microsoft Azure Active Directory (AAD) via SAML request, which in turn would authenticate users using its local user store. There are multiple components to this solution, and while there are a few different approaches to accomplish the end goal, I wanted to focus on a solution that didn’t require an onsite Duo Authentication Proxy server. Firepower FTD Remote Access VPN SSO using SAML and Azure AD, with Azure AD Conditional Access to Duo 2FA, and Cisco ISE for Authorization and Group Policy Assignment

Configure asa anyconnect vpn azure mfa saml