AnyConnect implentation with Duo on MX

[FCalderone]

Hello,

I am looking to implement AnyConnect with Duo 2FA on the MX applicance.  I have found documents to implement AnyConnect and it mentions authentication can be accomplished via SAML and IdP from Duo.  But it is not very clear on how this is accomplished.  Am I protecting the MX in Duo with DAG or am I protecting Azure AD in Duo?  Is there preferred method of implementing AnyConnect and Duo on the MX?

[CptnCrnch]

If I were to design this, I'd highly recommend using the DAG.

It'd look like this:

• Client connects to your MX that's configured for SAML authentication
• MX is authenticating users against DAG
• DAG is acting as the IDP using Azure AD as primary credential (and possibly integrating into Conditional Access)

[FCalderone]

That is the path I was thinking.  But we do not have Azure AD only onprem LDAP and RADIUS.

[CptnCrnch]

As described within https://duo.com/docs/dag-linux you're absolutely able to use an internal LDAP server as Primary Credential provider.

In your case, you could also leverage Duo Authentication Proxy that will be used as RADIUS server for your MX. AuthProxy itself will use your internal LDAP directory for authenticating users then.

DAG on the other hand is able to act as your starting point into an interesting journey into SSO. 😉

[PhilipDAth]

I wouldn't recommend anyone deploy Duo DAG now.  Duo Central is a similar newer product but 100% cloud-based.  It is included in all Duo subscriptions.

https://duo.com/docs/duo-central 

Personally, I have converted all of my Duo DAG customers to Duo Central now.

Duo Central can authenticate against either Active Directory or Azure AD.  I would authenticate against whatever is the most "authoritative" source in your network.

Duo central also lets you add cool features like inline AD password reset (for users with expired passwords), passwordless login (although this does not work with AnyConnect yet ...), trusted computer requirements, device health requirements, etc.