Hello and welcome to protecting an app with Duo two Fa and one Manuel more Ramirez security customer success specialist at Cisco. In this video I guide you through protecting your application with Duo's two factor authentication.00:05Today we'll cover three key areas. 1st, we'll talk about and define your application and its requirements. Then we work through the configuration in both Duo and your app and finally, we'll touch on some important consideration to keep in mind. Before wrapping up with a live demo.00:23Let's start with our 1st point and define your application. This is all about preparation. You wanna test user enrolling Duo and it's crucial to review both. Duo's documentation for any infrastructure needs like the authentication proxy and your vendors guide for their.00:42Specific requirements. Now, we move to the core of the setup. Do an application configuration. We'll break this into two parts. 1st, let's handle the dual configuration. Inside the dual admin panel, you'll add your application.01:02This is where Duo provides the essential details for the integration. A key tip here is start with a simple policy for your 1st test. Once you confirm the connection works, you can then layer on more specific policies.01:20With two already, we'll tackle the app configuration. In your application settings, you'll use the integration key secret key, and API host name you got from Duo. After that set, it's time to test the login.01:38Using a private or incognito browser window is a great way to ensure a clean test. Next, let's talk about some additional considerations. It's always smart to plan for reliability.01:54Think about how your app will behave during an outage. Our continuity guide is a fantastic resort for this. We also strongly recommend a high availability setup to keep your service running as smoothly. And that covers the setup.02:10Now that we walked through the steps, let's see how it all comes together in a live demo. Welcome. In this demo, we're going to protect the administrative interface of a firewall, the FMC.02:28Using Cisco Duo to factor authentication. We'll configure this in Duo and on the firewall using the dual authentication proxy on the jump server as the link between them with radius and LDAP. Let's start in the duo admin panel.02:44And let's go to the application catalog and in here in the search bar, let's type radius and we gonna choose this one radius to FA.02:59Before configuring it, let's click on the documentation and on the documentation, let's choose the network diagram. In here, this diagram shows authentication flow. The access appliance here.03:15Our firewall GUI sends a radius request to the dual authentication proxy on the jump server and the proxy uses LDAP to check the credential against Active directory. And if sends a push notification to the registered device for 2nd factor approval.03:32So in here, back in dual, let's click on add and we gonna have some fields to fill in. So we have the application name, here the user access list enabled for all user and we have the metadata, the integration key, the secret key and the API host name.03:52For this, let's take a look of some configuration that I already pre done and I have here some notes. We have here the jump server IP, the ID IP, and the firewall IP with that video secret that I had chosen for this communication with.04:13Videos. So let's take a look with this name and we're gonna copy and paste in our.04:32Duo admin panel and let's name this application in such a manner and let's copy the integration key, the integration key and let's paste it in here in our configuration and also let's gonna update secret key.04:39And the API host that have been displayed in our admin from Duo now.04:58That we paid this, the radius IP is going to be the IP from the firewall, and here is the secret that we're gonna use, and we also gonna need this section that is add the director client.05:15That he here is going to be the IP from the Active directory and the user that's gonna take a look of our domain to search for the user. And we're gonna select here the object after client. And with that we're pretty much with the configuration, so let's copy and paste these sections in our configuration.05:35Files from our proxy that is in our server.05:55So let's paste it and let's click, click here invalidate and now that our validation had passed, now let's restart the service, here, click and restart the service and we're gonna wait until this.05:58Service is going to be starting once more. Now our authentication proxy service are restarted. Now we can procedure to the configuration on our firewall. Okay, so for configuring our firewall, let's go to the interface, let's connect.06:16With our admin credentials?06:36And let's log in. Once it's open here in the icon, in the Jira icon, we're gonna select users and once it is open, we go to external authentication.06:39And we're gonna add external authentication object. In here in our authentication method, we're gonna select radius and we're gonna name this connection e.g. dual out.06:57And in here, as our primary server, we're gonna place the IP address of our authentication proxy that is our jump server and the secret key that we decided to place.07:14And with that, we're gonna select the default user role for these connections and we're gonna save this configuration. Now you can see here our object, so we gonna enable.07:38And we're gonna save and apply the configuration, apply the changes. So what we're gonna need to do now is go to the users and we're gonna create a new user. The one that has already enrolling Duo from this case is.07:58Myself and we gonna select here the use the authentication method, external one, and our role that is administrators and also click on save. So with that we have.08:18Almost everything to check that is our user is working, if one can authenticate through the firewall. But before doing so, let me check something here in the panel, so let's.08:35Click on here, in save the configuration of our application and let's take a look of our user that is being enrolled. So we gonna click on here in user any users, we can see here one.08:50That's the user that we're using for the testing, and you can see that it was like Active Directory sync and our user is already enrolled. So with that we have quaranteed that our user is from Active Directory connection and also have been enrolled to send this.09:10Push notification for 2nd factor. So with that, I think it's time to test. So let's go to an incognitive top page or private window in Mozilla.09:28And we're gonna do this connection to the firewall. So we're gonna select the application and in here we're gonna put our user.09:46And our active Directory credential for this user, we gonna select login. So you have an idea where I couldn't connect?10:02That is correct because we forgot a really important part before restarting the service was to save the configuration. It's not only needed to validate with being saved, the configuration now we are ready to restart the service. So let's wait for the service to be restarted.10:19And with that, that is all ready to go, we are ready to test. So we go in here for our user and we're gonna select them put in the name and also the password.10:38We're gonna log in. Now, you can see that I received the push and I'm gonna do approve. And with that, we can check that our configuration was ready and is working, and as a.10:55As one. So that completes the demo. We secure firewall admin access with a strong authentication using Cisco Duo and the authentication proxy.11:14
