Tip: This article covers using YubiKeys with Cisco AnyConnect via RADIUS. For integrating Azure AD via SAML, see Protecting Cisco VPN connections in a Microsoft Environment with Yubico.

Summary

Leveraging Cisco AnyConnect to provide remote VPN access to corporate resources is vital to enable a remote workforce. More and more people are using Cisco AnyConnect and Cisco’s Adaptive Security Appliance (ASA) to perform work remotely. It is critical that strong two-factor authentication is integrated into Cisco’s VPN solution. Cisco’s solution is mature and has a number of options to integrate authentication vendors. Natively, user certificates and specifically smart cards are supported. Additionally, Cisco provides SAML and RADIUS integrations with identity providers (IdPs). These standard patterns provide a simple way to integrate a company's IdP with Cisco’s VPN solution. A number of IdP vendors have good step-by-step guides on how to integrate their product with Cisco AnyConnect and ASA.  This guide walks you through setting up Duo’s RADIUS Service for a standard Cisco ASA Server so that Yubico OTP can be used for MFA. See Cisco VPN integration resources from other partners for references to other IdP partners' RADIUS setup guides.

For organizations with non-standard or complex deployments, contact Yubico Sales for more information.

Network overview

A high level overview of the network configuration is shown below.

Device considerations

Yubico OTP is supported across all platforms as it is just seen as keyboard input, but it is important to check that you select the most appropriate hardware interface, i.e. USB-A, USB-C or Lightning.

Cisco AnyConnect with Yubico OTP support

Example: Securing CiscoASA with DUO via RADIUS

In this example scenario, an existing Duo implementation is utilized to extend the Yubico OTP authentication to the VPN infrastructure. Authentication will be to the local Active Directory first, followed by secondary authentication via the Yubico OTP.

1. Preparing the RADIUS service

To enable RADIUS within Duo, there are a couple of steps:

1. Enable the Cisco ASA VPN as a Duo application

2. Install the Duo RADIUS proxy within the on-premises infrastructure

3. Configure the connection between the local Cisco and the RADIUS proxy

2. Duo application

Enabling RADIUS as an application is straightforward:

1. Log into your Duo admin panel

2. Navigate to Applications ->Protect an Application

3. Search for Cisco RADIUS VPN and click Protect

4. Make note of the integration key, secret key and API hostname

5. Apply any policies that are required for your home workers. In this example, 2FA is enforced for users working from home.

3. Authentication proxy

The application proxy acts as a RADIUS gateway between the local Cisco VPN and the Duo platform. Again, the process is fairly straightforward:

1. Download the relevant gateway package

   • Windows - Duo admin panel/duoauthproxy-latest.exe

   • Linux - Duo admin panel/duoauthproxy-latest-src.tgz

2. Refer to Duo documentation for the exact installation instructions, referenced at the end of this article

3. Create a configuration file based on the information noted down from the application configuration

4. Start the service

Example configuration file: 

4. Cisco RADIUS enablement

Once the Duo platform and the local proxy service has been configured, the Cisco VPN itself needs to be enabled to authenticate via the RADIUS service.

While this article focuses on Cisco, this process should be fairly standard across most VPN solutions, as as this uses a well defined networking solution in RADIUS.

There are two main actions that are required on the Cisco VPN:

1. Create a AAA RADIUS authentication source

2. Create or modify a VPN profile to use the new service

Again, refer to the full documentation for detailed steps, but the basic configuration is shown below

AAA RADIUS server config, using the “radius_secret” defined above

Once the RADIUS service has been defined, it can be added to an existing profile, or a new one can be defined.

5. Client side usage

If users are already accustomed to using the Cisco AnyConnect client, then there is very little change to how they already work. Additionally, there are no required changes to the users’ VPN client. The user flow is:

1. Start the VPN client and select required the profile, if more than one exists

2. Enter the username in the appropriate field

3. Enter the password, followed by a comma, and then touch the YubiKey to generate the OTP plus a carriage return. For example:

   Username: fred

   Password: Password12,cccccchuuuvngeklxtnkbbgiigfgbbtcxgbbbthfkvgr

DUO and Cisco resources

• Duo admin portal
• Duo installation guide
• Cisco ASA: Configuring RADIUS servers for AAA

Cisco VPN integration resources from other partners

• Cisco AnyConnect VPN smart card integration
• Okta MFA for Cisco VPN
• Configuring Cisco ASA VPN for PingID MFA
• Configure AnyConnect Secure Mobility Client with one-time passwords
• Cisco Remote Access with GreenRADIUS 2FA - Integration Guide