1. Yubico
  2. Business
  3. Guides

Securing Cisco AnyConnect with YubiKeys

Avatar
Clay Degruchy
Created - Updated

Summary

Leveraging Cisco AnyConnect to provide remote VPN access to corporate resources is vital to enable a remote workforce. More and more people are using Cisco AnyConnect and Cisco’s Adaptive Security Appliance (ASA) to perform work remotely. It is critical that strong two factor authentication is integrated into Cisco’s VPN solution. Cisco’s solution is mature and has a number of options to integrate authentication vendors. Natively, user certificates and specifically smartcards are supported. Additionally, Cisco provides SAML and RADIUS integrations with identity providers (IDPs). These standard patterns provide a simple way to integrate a company's IDP with Cisco’s VPN solution. A number of IDP vendors have good step-by-step guides on how to integrate their product with Cisco AnyConnect and ASA.  This guide will walk through setting up Duo’s RADIUS Service for a standard Cisco ASA Server so that Yubico OTP can be used for MFA. See appendix for other IDP partner’s RADIUS setup guides.

For organizations with non-standard or complex deployments, it is recommended to contact Yubico Sales for more information.

Network Overview

A high level overview of the network configuration is shown below

1.png

 

1 + 2.

Username and password entered (1), YubiKey is activated to generate the OTP which is passed along with the username and password (2)

3 + 4.

Username/Password+YubiOTP passed through to Cisco VPN Server

5 + 6.

Cisco hands off authentication to the authentication service via RADIUS

7

The Authentication Service splits the Username/Password and OTP, verifies U/P against the organization's AD. The public ID of the YubiKey is used to confirm the YubiKey is associated with the user.

8

If AD authentication is valid then the YubiOTP is validated by the authentication service, either by an internal validation server on prem or a cloud based validation service

9

If all factors are met the encrypted connection is made

Device Considerations

Yubico OTP is supported across all platforms as it is just seen as keyboard input but it is important to just check that you select the most appropriate hardware interface, ie USB-A, USB-C or even the Lightning based authenticator.

Cisco AnyConnect with YubiOTP Support per Operating System

 

Operating System

Support

Windows

Yes

MacOS

Yes

Linux

Yes

Android

Yes

Apple iOS

Yes

Example: Securing CiscoASA with DUO via RADIUS

In our example scenario we utilise an existing Duo implementation to extend the Yubico OTP authentication to the VPN infrastructure.  Authentication will be to the local Active Directory first followed by secondary authentication via the Yubico OTP.

2.png

1 + 2.

Username and password entered (1), YubiKey is activated to generate the OTP which is appended to the password, separated by a comma (2)

3 + 4.

Username/Password+YubiOTP passed through to Cisco VPN Server

5 + 6.

Cisco hands off authentication to the Duo Authentication Proxy via RADIUS

7

Duo Proxy splits the Username/Password and OTP, verifies U/P against AD

8

If AD authentication is valid then the YubiOTP is validated via the Duo platform

9

If all factors are met the encrypted connection is made

 

  1. Preparing the RADIUS Service

To enable RADIUS within Duo there are a couple of steps

  1. Enable the Cisco ASA VPN as a Duo application

  2. Install the Duo RADIUS proxy within the on-premises infrastructure

  3. Configure the connection between the local Cisco and the RADIUS proxy

 

  1. Duo Application

Enabling RADIUS as an application is straightforward

  1. Log into your Duo admin panel - https://admin.duosecurity.com

  2. Navigate to Applications->Protect an Application

  3. Search for “Cisco RADIUS VPN” and click Protect

  4. Make note of the Integration Key, Secret Key and API Hostname

  5. Apply any policies that are required for your home workers, in our example we are enforcing 2FA for our Working From Home users.

 

3.png

  1. Authentication Proxy

The Application Proxy acts as a RADIUS gateway between the local Cisco VPN and the Duo platform.  Again the process is fairly straightforward.

  1. Download the relevant gateway package

    1. Windows - https://dl.duosecurity.com/duoauthproxy-latest.exe

    2. Linux - https://dl.duosecurity.com/duoauthproxy-latest-src.tgz

  2. Refer to Duo documentation for the exact installation instructions, referenced at the end of this document.

  3. Create a configuration file based on the information noted down from Application configuration.

  4. Start the service

 

Example configuration file: 

 

[ad_client]

host=192.168.22.222

service_account_username=DuoSvcAcc

service_account_password=FakePassword

search_dn=DC=yubico,DC=com

 

[radius_server_auto]

ikey=12345678901234567890

skey=aBCDEf6gHIjKl6MN4OPq1rsABCde4fGhiJklMno2

api_host=api-xx12345x.duosecurity.com

radius_ip_1=192.168.22.111

radius_secret_1=AnotherFakePassword

failmode=safe

client=ad_client

port=1812

  1. Cisco RADIUS Enablement

Once the Duo platform and the local proxy service has been configured then the Cisco VPN itself needs to be enabled to authenticate via the RADIUS service.

Whilst we are focusing on Cisco this process should be fairly standard across all VPN solutions as we are using a well defined networking solution in RADIUS.

There are two main actions that are required on the Cisco VPN

  1. Create a AAA RADIUS authentication source

  2. Create or modify a VPN profile to use the new service

Again, refer to the full documentation for detailed steps but the basic configuration is shown below

AAA RADIUS Server config, using the “radius_secret” defined above

4.png

Once the RADIUS service has been defined it can be added to an existing profile or a new one can be defined

5.png

  1. Client Side usage

If users are already accustomed to using the Cisco AnyConnect client then there is very little change to how they already work. Additionally, there are no required changes to the users’ VPN client. The user flow is

  1. Start VPN client and select required profile if more than one

  2. Enter username in the appropriate field

  3. Enter password, followed by a comma, then touch the YubiKey to generate the OTP plus a carriage return

    E.g - Username: fred

             Password: Password12,cccccchuuuvngeklxtnkbbgiigfgbbtcxgbbbthfkvgr

 

6.png

 

DUO and Cisco resources

Admin Portal -

https://admin.duosecurity.com

Duo Installation Guide - 

https://duo.com/docs/ciscoasa-radius

Cisco RADIUS Guide - https://www.cisco.com/c/en/us/td/docs/security/asa/asa91/configuration/general/asa_91_general_config/aaa_radius.html

 

Sample of other partner’s Cisco VPN integration resources

Cisco smart card integration

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/107251-cac-anyconnect-vpn-windows.html

 

Okta  integration

https://www.okta.com/integrations/MFA-for-VPN/cisco/

 

Ping Identity integration

https://docs.pingidentity.com/bundle/pingid/page/czg1564020462789.html

 

RCDevs integration

https://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/213931-configure-anyconnect-secure-mobility-cli.html

 

GreenRocket integration

https://www.greenrocketsecurity.com/wp-content/uploads/2018/01/GreenRADIUS-and-Cisco-Remote-Access-Integration-Guide-2018.01.pdf