Configure FTD for Duo LDAP in Security Cloud Control

Step 1

Create a Duo LDAP identity source object for the Duo LDAP server.

1. In the Security Cloud Control navigation bar on the left, click Objects.

2. Click the to create an object > RA VPN Objects (ASA & FTD) > Identity Source.

3. Enter a name for the object, for example, Duo-LDAP-server.

4. Select the Device Type as FTD.

5. Click Duo Ldap Identity Source and click Continue.

6. In the Edit Identity Source area, provide the following details:

   • API Hostname: Enter the API Hostname that you obtained from your Duo account. The hostname should look like the following, with the X’s replaced with your unique value: API-XXXXXXXX.DUOSECURITY.COM. Uppercase is not required.

   • Port: Enter the TCP port to use for LDAPS. This should be 636 unless you have been told by Duo to use a different port. Note that you must ensure that your access control list allows traffic to the Duo LDAP server through this port.

   • Timeout: Enter the timeout, in seconds, to connect to the Duo server. The value can be 1-300 seconds. The default is 120. To use the default, either enter 120 or delete the attribute line.

   • Integration Key: Enter the integration key that you obtained from your Duo account.

   • Secret Key: Enter the secret key that you obtained from your Duo account. This key will subsequently be masked.

   • Interface used to connect to Duo Server: Select the interface that is used for connecting to Duo Server.

     • Resolve via route lookup: Select this option to use the routing table to find the right path. For creating a routing table, see Routing.

     • Manually choose interface: Select this option and choose one of the interfaces from the list. The default interface is the diagnostic interface, but this will work only if you configure an IP address on the interface. Note: Ensure that the selected interface is present on the same device you want to connect to Duo Server.

     • Click Add.

Step 2

(optional) Use the AnyConnect Profile Editor to create a profile that specifies 60 seconds or more for authentication timeout.

1. If you have not already done so, download and install the AnyConnect profile editor package. You can find this in the Cisco Software center (software.cisco.com) in the folder for your AnyConnect version. The base path at the time of this writing is Downloads Home > Security > VPN and Endpoint Security Clients > Cisco VPN Clients > AnyConnect Secure Mobility Client.

2. Open the AnyConnect VPN Profile Editor.

3. Select Preferences (Part 2) in the table of contents, scroll to the end of the page, and change Authentication Timeout to 60 (or more). The following image is from the AnyConnect 4.7 VPN Profile Editor; previous or subsequent versions might be different.

4. Choose File > Save, and save the profile XML file to your workstation with an appropriate name, for example, duo-ldap-profile.xml.

5. You can now close the VPN Profile Editor application.

6. In Security Cloud Control, upload RA VPN AnyConnect Client Profile.

Step 3

Create a group policy and select the AnyConnect profile in the policy.

1. In the Security Cloud Control navigation bar on the left, click Objects.

2. To edit an existing group policy, use the RA VPN Group Policy filter to view only the existing group policies and modify the policy that you want and save it.

3. To create a new group policy, click RA VPN Objects (ASA & FTD) > RA VPN Group Policy.

4. On the General page, configure the following properties:

   • Name — For a new profile, enter a name. For example, Duo-LDAP-group.

   • AnyConnect Client Profiles — Select the AnyConnect client profile object that you created.

5. Click Add to save the object.

6. Click Secure Connections > Remote Access VPN > ASA & FDM.

7. Click the remote access VPN configuration that you want to update.

8. In the Actions pane on the right, click Group Policies.

9. Click + to select the group policies that you want to associate with the VPN configuration.

10. Click Save to save the group policy.

Step 4

Create or edit the remote access VPN connection profile to use for Duo-LDAP secondary authentication.

1. On the Security Cloud Control navigation page, click VPN > Remote Access VPN Configuration.

2. Expand the remote access VPN configuration and click the connection profile that you want to update.

3. In the Actions pane on the right, click Edit.

4. Under Primary Identity Source, configure the following:

   • Authentication Type — Choose either AAA Only or AAA and Client Certificate. You cannot configure two-factor authentication unless you use AAA.

   • Primary Identity Source for User Authentication — Select your primary Active Directory or RADIUS server. Note that you can select a Duo-LDAP identity source as the primary source. However, Duo-LDAP provides authentication services only, not identity services, so if you use it as a primary authentication source, you will not see usernames associated with RA VPN connections in any dashboards, and you will not be able to write access control rules for these users. (You can configure fallback to the local identity source if you want to.)

   • Secondary Identity Source — Select the Duo-LDAP identity source.

     

     Note

     If username in Primary Identity Source and Secondary Identity Source are the same, we recommend enabling Use Primary username for Secondary login in the Advanced options in the Connection Profile. Configuring this way allows the end-user to use a single username for both primary and secondary identity sources.

5. Click Continue.

6. On the Group Policy page, select the group policy that you created or edited.

7. Click Continue.

8. Click Done to save your changes to the connection profile.

Step 5

Preview and Deploy Configuration Changes for All Devices.