An圜onnect 4.6 or later for normal authentication ( Trusted Endpoints has specific An圜onnect version requirements. See the ASA with SAML document for details.). VPN connection initiated to Cisco ASA, which redirects to the Duo Access Gateway for SAML authentication. An圜onnect client performs primary authentication via the Duo Access Gateway using an on-premises directory (example). 
Duo Access Gateway establishes connection to Duo Security over TCP port 443 to begin 2FA. Duo receives authentication response and returns that information to the Duo Access Gateway. 
Duo Access Gateway returns a SAML token for accessĬhoose this option for ASA and An圜onnect deployments that do not meet the minimum product version requirements for SAML SSO.With this configuration, end users receive an automatic push or phone call for multi-factor authentication after submitting their primary credentials using the An圜onnect Client or clientless SSL VPN via browser. Users may append a different factor selection to their password entry. Read the deployment instructions for ASA with RADIUS This configuration supports Duo policies for different networks (authorized networks, anonymous networks, or geographical locations as determined by IP address) when using the An圜onnect client.Cisco ASA firmware version 8.3 or later.Primary authentication initiated to Cisco ASA.Cisco ASA sends authentication request to the Duo Authentication Proxy.Primary authentication using Active Directory or RADIUS.Duo Authentication Proxy connection established to Duo Security over TCP port 443.
Secondary authentication via Duo Security’s service. Duo authentication proxy receives authentication response. When using this option with the clientless SSL VPN, end users experience the interactive Duo Prompt in the browser. The An圜onnect client does not show the Duo Prompt, and instead adds a second password field to the regular An圜onnect login screen where the user enters the word “push” for Duo Push, the word “phone” for a phone call, or a one-time passcode. Read the deployment instructions for ASA with LDAPS This configuration does not support IP-based network policies or device health requirements when using the An圜onnect client. Primary authentication to on-premises directory. Cisco ASA connection established to Duo Security over TCP port 636.
0 kommentar(er)
