The Authentication Service splits the Username/Password and OTP, verifies U/P against the organization's AD. Username/Password+YubiOTP passed through to Cisco VPN ServerĬisco hands off authentication to the authentication service via RADIUS Username and password entered (1), YubiKey is activated to generate the OTP which is passed along with the username and password (2)

Network OverviewĪ high level overview of the network configuration is shown below See appendix for other IDP partner’s RADIUS setup guides.įor organizations with non-standard or complex deployments, it is recommended to contact Yubico Sales for more information. This guide will walk through setting up Duo’s RADIUS Service for a standard Cisco ASA Server so that Yubico OTP can be used for MFA. A number of IDP vendors have good step-by-step guides on how to integrate their product with Cisco An圜onnect and ASA. These standard patterns provide a simple way to integrate a company's IDP with Cisco’s VPN solution. Additionally, Cisco provides SAML and RADIUS integrations with identity providers (IDPs).

Natively, user certificates and specifically smartcards are supported. Cisco’s solution is mature and has a number of options to integrate authentication vendors. It is critical that strong two factor authentication is integrated into Cisco’s VPN solution. More and more people are using Cisco An圜onnect and Cisco’s Adaptive Security Appliance (ASA) to perform work remotely. Leveraging Cisco An圜onnect to provide remote VPN access to corporate resources is vital to enable a remote workforce.

Uninstall cisco web security mac