Trusted Endpoints certificate verification requires An圜onnect versions 6 (Windows), 5 (macOS), or 7 (iOS) or later.An圜onnect 4.6 or later for normal authentication.Use of WebAuthn authenticators supported in ASA firmware 9.17 or later with external browser support enabled.Duo Single Sign-On with a configured authentication source.Read the deployment instructions for ASA with Duo Single Sign-On Primary authentication and Duo MFA occur at the identity provider, not at the ASA itself. This configuration also lets administrators gain insight about the devices connecting to the VPN and apply Duo policies such as device health requirements or access policies for different networks (authorized networks, anonymous networks, or geographical locations as determined by IP address) when using the An圜onnect client. Duo WebAuthn authenticators like Touch ID and security keys supported in recent ASA and An圜onnect software releases. The interactive MFA prompt gives users the ability to view all available authentication device options and select which one to use, self-enroll new or replacement 2FA devices, and manage their own registered devices.

With this SAML configuration, end users experience the interactive Duo Universal Prompt when using the Cisco An圜onnect Client for VPN.

Cisco ASA with An圜onnect ASA SSL VPN using Duo Single Sign-OnĬhoose this option for the best end-user experience for ASA with a cloud-hosted identity provider. Learn more about these configurations and choose the best option for your organization. Duo integrates with your Cisco ASA or Firepower VPN to add two-factor authentication to An圜onnect logins.ĭuo can add two-factor authentication to ASA and Firepower VPN connections in a variety of ways.

Cisco anyconnect vpn client