You don't have to set up a new Authentication Proxy server for each application you create. If you are already running a Duo Authentication Proxy server in your environment, you can use that existing host for additional applications, appending the new configuration sections to the current config. This Duo proxy server will receive incoming RADIUS requests from your Cisco ASA IPSec VPN, contact your existing local LDAP/AD or RADIUS server to perform primary authentication, and then contact Duo's cloud service for secondary authentication.

To integrate Duo with your Cisco ASA IPSec VPN, you will need to install a local Duo proxy service on a machine within your network. You should already have a working primary authentication configuration for your Cisco ASA IPSec VPN users before you begin to deploy Duo. First Stepsīefore moving on to the deployment steps, it's a good idea to familiarize yourself with Duo administration concepts and features like options for applications, available methods for enrolling Duo users, and Duo policy settings and how to apply them. See Duo Knowledge Base article 7546 for additional guidance. If your organization requires IP-based rules, please review Duo Knowledge Base article 1337.Įffective June 30, 2023, Duo will no longer accept TLS 1.0 or 1.1 connections or support insecure TLS/SSL cipher suites. This application communicates with Duo's service on SSL TCP port 443.įirewall configurations that restrict outbound access to Duo's service with rules using destination IP addresses or IP address ranges aren't recommended, since these may change over time to maintain our service's high availability.

Cisco ipsec vpn client free