configure asa anyconnect vpn azure mfa saml

Configure ASA AnyConnect VPN with Azure MFA using SAML

In this blog post, we will guide you through the configuration steps required to set up Azure MFA with Cisco AnyConnect. If you are looking for an MFA solution for Cisco AnyConnect, then there is a good chance that you have heard of Duo and Azure AD.

To start, navigate to the Enterprise Applications section in Azure Active Directory (Azure AD) and select All Applications. Then, search for Cisco AnyConnect in the search box and click on it to add it from the gallery to your list of managed SaaS apps.

Next, copy all three URLs from the Set up Cisco AnyConnect section: VPN URL, Tunnel group name, and Trust-point of the identity certificate. In this example, assume the tunnel-group name is 'company-vpn', VPN URL is '' and the trust-point of the identity certificate is 'my-public-cert'.

On the Set up single sign-on with SAML page, find the Certificate (Base64) in the SAML Signing Certificate section and select Download to download the certificate file. Save it on your computer.

In the Reply URL text box, type Cisco ASA RA VPN 'Tunnel group' name, which is 'company-vpn'. In the Identifier text box, also type Cisco ASA RA VPN 'Tunnel group' name, 'company-vpn'.

To set up single sign-on with SAML, you need to enter values for the following fields:

* Reply URL: Cisco ASA RA VPN 'Tunnel group' name (e.g., company-vpn)

* Identifier: Cisco ASA RA VPN 'Tunnel group' name (e.g., company-vpn)

Make sure your ASA is running 9.8 or later code, and AnyConnect clients are version 4.6+.

Here are some additional requirements:

* ISE advertises SGT mappings to ASA via SXP

* Cisco ISE is configured with Authorization policies for each AD group

* Users and groups are already synced with Azure AD

* Authentication and authorization work with ISE

* You already have a working ASA AnyConnect setup

Optional: If you want to authenticate the AnyConnect users against Azure SSO/SAML to enforce MFA, you need to configure Azure MFA. Having Cisco ISE is optional for this to work.

In this configuration, we will use Azure AD SSO to authenticate users and then redirect them to the ASA AnyConnect VPN. To do this, follow these steps:

1. Go to the Anround Connect application and select Set up single sign-on.

2. Search for Cisco Anround Connect in the search box and click on it to add it from the gallery to your list of managed SaaS apps.

By following these configuration steps, you can set up Azure MFA with Cisco AnyConnect using SAML, providing an additional layer of security for your remote access users.

Configure asa anyconnect vpn azure mfa saml