Hi, everyone, and thanks for joining. My name is Carlos Moralez and I'm a technical customer success specialist. Today, I'll be walking you through the integration of dual single sign on with Cisco Secure Client demonstrating how it enhances the security of remote VPN access by providing a streamlined multi factor authentication and.00:06Experience that integrates seamlessly with your existing infrastructure, often without requiring major changes.00:25Here's what we will cover in this session. 1st, I'll give you a high level overview of how the integration works and why it is valuable. Then we'll break down the key components involved in the setup. And finally, we will walk through the end to end authentication flow so you can see how Duo SSO fits.00:37Into your VPN deployment. The objective is to secure streamlined remote access to corporate resources. This is achieved via Duo SSO for Cisco Secure Client VPN logins.00:56So what this integration enables? 1st, a single sign on experience for Cisco Secure Client VPN logins, simplifying authentication. Second, integrated multi factor authentication for all VPN access.01:13A crucial security enhancement. 3rd, a streamlined and consistent logging experience for all remote users reducing friction. 4th, centralized identity management for VPN access by leveraging existing identity providers via Duo SSO.01:28For MFA, Duo offers various methods that are shown on the right. Biometrics, a simple push notification, phone call verification, SMS passcodes, physical security keys, and verified push for added security.01:47Now let's look at the key components for our Cisco secure client VPN with dual SSO deployment. 1st, the dual cloud service. This is our single sign on identity provider orchestrating primary authentication and delivering the crucial second factor.02:04Like push or biometrics. Next, your firewall or VPN gateway, such as an ASA, FTD or Meraki MX. It handles VPN termination and authenticates users via SAML directly to the dual cloud.02:21Then we have the primary authentication source. This is where the initial user credentials or 1st factor are verified. It can be dual's own directory and on prem active directory, or Azure AD. Finally, the optional dual authentication proxy.02:38This component bridges the dual cloud service with your own on prem Active directory for factor verification if needed. When deploying Cisco Secure Client VPN with Duo SSO.02:57And using dual directory as the authentication source, the authentication flow proceeds as follows. A user initiates a logging attempt to the SAML service provider, which in this context is your firewall. The firewall then redirects the user's browsers.03:13To do a single sign on with a SAML request. The user, the the user provides their primary credentials which Duo verifies against the dual directory. Following this dual single sign on requires the user to complete two factor authentication.03:31Once the user successfully completes the dual two factor authentication, dual single sign on redirects the user's browser back to the SAML service provider, your firewall, with a successful response granting access.03:50All right. For this demonstration, we'll be showcasing the integration of dual Directory as our authentication source with the Meraki MX firewall for Cisco Secure Client VPN. Our focus remains on the essential configuration steps require.04:09To integrate multi factor authentication into these VPN sessions. Now, let's go over the configuration demo. In this demo, I will not cover enrolling users into a directory or setting user passwords. The focus will be on the configuration steps to integrate Cisco Secure Client on a Meraki many.04:25Alright, let's dive into the configuration. We'll start by setting up our Meraki MX to access SAML service provider for our VPN. 1st, within the Meraki dashboard, we'll navigate to security and SD WAN, and then click on appliance status.04:47From here, we will copy the host name of this appliance. Then we will go back to security and SD one and then click on client VPN. From here, we will click on Cisco secure client settings and make sure the client VPN is enabled.05:06Then we will scroll down to the authentication and policy section. And from the authentication type dropdown menu, we will select SAML. Here, in the SAML configuration Cisco secure client server URL.05:26Phil, we are going to paste the host name we just copied. And because I'm using a special port, I need to type in a column and the port that I'm using which is 4443.05:43If you are using the traditional 443 port, you don't need to do this. After that, we need to copy the full URL because we are going to use it, in the dual configuration. Importantly.05:58Instead of manually entering IDP details, you will see an option to upload identity provider metadata, which is this part. And we will come back to this after configuring Duo. Let's save our progress. Now let's switch over to the duo admin panel to configure.06:17Our SAML application. From the dual dashboard, we will go to applications and then click on application catalog. From the supported features dropdown menu, we will click on SSO. Here we are going to look for the Meraki secure client application.06:37Selecting this specific pre configure application will streamline much of the setup. And then let's click on add. Once the application is added, we will configure it by pasting the SAML configuration Cisco secure client server URL that we copied.06:57From our Meraki MX.07:17Notice that the user access by default is disabled for all users. You can enable it only for permitted groups, but for now, let's enable it for all users. Now let's save the application.07:23After saving our Duo application, Duo will provide us with the option to download the identity provider metadata XML file. This file contains all necessary information from Meraki to trust dual. So let's go ahead and download that information.07:47We'll then take that IDP metadata XML file. We download it from Duo and upload it directly into the Meraki client VPN settings. So let's go back to the Meraki dashboard and scroll all the way down to the SAML metadata file. Let's click here.08:07And update the most recent metadata file for it. After uploading it, save the configuration. With both Meraki and Duo configure it, let's see this in action.08:26I'll open the Cisco secure client and attempt to connect to our VPN endpoint. So I'm going to be using the Cisco Secure Client VPN application on my iPhone. You will see that.08:45Instead of directly prompting for credentials, the client redirects us to the dual single sign on page.09:05This is where the user will enter their primary credentials, authenticate against our directory, and after successfully primary authentication Duo will prompt for second factor.09:12I'll complete the dual push on my device after.09:28After successfully, completing 2nd factor authentication, the VPN accepts the connection and securesly connect me to my VPN. And you have it.09:45The Cisco secure client successfully connects secured by dual multi factor authentication, all seamlessly integrated with our Meraki MX. This demonstrates how Duo SSO provides a robust and user friendly authentication experience for your remote VPN users. Thank you very much for joining and hope I can see you next time.10:00Bye bye.10:20
