configure asa anyconnect vpn azure mfa saml

SAML on FTD is supported for authentication (version 6.7 onward) and authorization (version 7.0 onward).Some of the current limitations for SAML are: The configuration allows Anyconnect users to establish a VPN session authentication with a SAML Identity Service Provider. If your network is live, ensure that you understand the potential impact of any command. All of the devices used in this document started with a cleared (default) configuration.

The information in this document was created from the devices in a specific lab environment. Otherwise, verify that the time is manually synchronized between them. Note: If possible, use an NTP server to synchronize time between the FTD and IdP.

Firepower Management Center (FMC) version 6.7.0.

Firepower Threat Defense (FTD) version 6.7.0.

The information in this document is based on these software and hardware versions: Prerequisites RequirementsĬisco recommends knowledge of these topics: This will help us and others in the community as well.This document describes Security Assertion Markup Language (SAML) authentication on FTD managed over FMC. Please ' Accept the answer' if the information helped you.

Once the authentication is completed successfully, SAML assertion is issued for Cisco Anyconnect and the connection is established afterward.

User will be prompted for MFA if a Conditional Access policy is configured to trigger MFA for the Cisco Anyconnect enterprise application.

When it receives requests from VPN clients, it presents the Azure AD Sign-in page for the user to perform the first-factor authentication.

Cisco Anyconnect is available as an enterprise application in Azure AD and can be directly federated with Azure AD using SAML.

Azure MFA communicates with Azure AD to retrieve the user's details and performs the secondary authentication using a verification method configured to the user.

NPS Extension triggers a request to Azure AD MFA for the secondary authentication.

NPS Server connects to on-prem AD to perform the primary authentication for the RADIUS requests and, upon success, passes the request to the NPS extension.VPN appliance receives requests from VPN clients and converts them into RADIUS requests to NPS servers.

Configure asa anyconnect vpn azure mfa saml