Hi, everyone, and thanks for joining. My name is Carlos Moralez and I'm a technical customer success specialist. And today I'll be walking you through the integration of dual multi factor authentication with Cisco Secure Client using the dual authentication proxy.00:05This setup enhances the security of remote VPN access without requiring major changes to your existing infrastructure. Here's what we will cover in this session. 1st, I'll give you a high level overview of how the integration works and why it's valuable.00:22Then I'll break down the key components involved in this setup, and finally, I'll walk you through the end to end authentication flow so you can see how Duo fits in your VPN environment. The objective of this integration is to strengthen remote access to.00:40For resources by ledgering dual multi factor authentication into Cisco secure client VPN sessions.01:00With the help of duals authentication proxy. Here's what this integration enables. 1st, it adds two factor authentication to VPN logins, ensuring that credentials alone aren't enough. Second.01:07It provides real time verification using dual's cloud to deliver a push notification SMS or phone call. 3rd, it's a resilient integration. The authentication proxy securely breaches your existing infrastructure to the dual cloud.01:22And finally, it's a transparent feed with Cisco VPN infrastructure, meaning minimal user impact and a smooth deployment with platforms like ASA, FTD or Meraki MX. Here are the major building blocks.01:38At the center is a dual authentication proxy. This is installed on a Linux or Windows server and handles both primary authentication to your directory and secondary authentication via duo. Your firewall of VPN gateways such as Cisco ASA FTD or Meraki MX, is configured to.01:55You use the authentication proxy as its radio server. The authentication proxy passes your passes credentials to your active directory, LDAP server or radio server, and then initiates MFA through Duo's cloud. This approach gives you resilient hybrid integration.02:15Now, let's walk through the full authentication flow for a VPN login protected with Duo. 1st, the user initiates a VPN session using Cisco Secure Client. This is the primary authentication step.02:35Second, the firewall or VPN gateway, such as a Meraki MX ASA or FTD, sends that authentication request to the dual authentication proxy. The proxy performs primary authentication against an active directory or a radio server.02:514th, once the credentials are validated, the proxy connects to the dual security cloud service over a TCP port 443 5th, dual then handles the secondary authentication, sending a push SMS or phone call to the user.03:096th, the dual authentication proxy receives the result of the MFA challenge pass or fail. Seven, if successful, the proxy notify the firewall and VPN access is granted.03:28This flow maintains your existing authentication stack and adds a strong second layer of defense without significantly altering your environment. For this demonstration, I'm using the authentication proxy running on a Linux server.03:43Please note that I won't be covering the installation process of the authentication proxy itself. The firewall in this setup is the Meraki MX. In this session, we will focus especially on the configuration steps required to integrate multi factor authentication with the Cisco secure client BPP.04:01Session. And now let's go to our demo configuration. For this demo, I'll show you how to integrate Duo MFA with Cisco Meraki Secure Client VPN using the dual authentication proxy. I'll walk through the setup from the dual dashboard.04:21Through the authentication proxy into the Meraki dashboard and finally demonstrate a VPN connection using Cisco secure client on my mobile device. And the 1st step is to create the radius app in the dual dashboard. I'm starting in the duo admin panel where I'll create.04:38A new radius application and for that, I will go to applications and on the manage, click on applications. Then I will click on add application. Then I will look for the radius application.04:55Once I find the radius application, I'm just going to click on add. This application will give us three values we need to link the authentication proxy with cloud service, which are the integration key.05:13The secret key and the API host name. So and these values are located here. So now as I grab each of these values, I'm switching over to a notepad, where I've already drafted the authentication proxy configuration.05:28So I'm just going to copy these values here.05:45I'll paste these values directly into the appropriate fields in the radio server dual section. This makes it easy to see how the dual app and the proxy tied together. This configuration draft will serve as the final version I'll copy into the actual authentication proxy config file once we're ready.06:05Now, let's have a look into a few fields that we have within Duo. So the application name, let's change the application name to something that we can relate to. So Meraki secure client.06:23VPN. Now have a look. By default, all users are disabled from using this application, so we need to change that manually. You can enable only permitted groups in duo or you can enable it for all users. We are going to click enable for all users for now.06:39Now, once the configuration here is completed, we need to scroll all the way down to the bottom of the page where we can find the save button. Once we click on the save button and we get the banner saying that the application was modified successfully, we can then jump to.06:59Our next step. Now we move into the dual authentication proxy configuration. So let's go and open the file with the dual authentication proxy configuration is located.07:19So you can see that this is the pad and odd proxy.CFG is the file name of the configuration. So let's go ahead and open that file, and let's go all the way to the bottom to this file and paste the configuration that we have in our draft.07:38So copy this configuration into here. Now the configuration has two important sections we need to define. 1st is the radius client section. This is used when the authentication proxy is acting as a radius client.07:56That means it's forwarding authentication requests to an upstream primary authentication source. In our case, that's our existing radio server. So this is the section, so this section includes the IP address and shared secrets.08:16Of that radio server, the same server the firewall currently points to for VPN authentication. Next, you have the radio server dual section. This is where the authentication proxy acts as a radio server.08:31Listening for incoming out requests from the Meraki MX. Here we specify things like the shared secret that Meraki will use, the port to listen on use usually 1812, and the dual integration values we copied earlier, API host name, integration key and the secret key.08:48This is how the authentication proxy becomes the bridge. It receives radius requests from the firewall forwarding the primary authentication to your radio server, then contacts you all to perform MFA before returning a final success or failure.09:07So after we have completed the configuration on the authentication proxy, we need to save it. So we save the configuration and after that we need to restart the service. So to restart the service, we need.09:24To issue this command Pseudos system CTL restart and the name of the dual authentication proxy service. After it has restarted, we need to double check that the service has started successfully, so we now to check.09:40We can check that with the status and yes, the authentication proxy has restarted successfully. Now let's jump to step number three. Configure the Meraki MX client VPN to use duo.09:59So now let's go ahead and jump into the dual dashboard. In the dual dashboard, we need to go into the client VPN section. So we need to go to security and SD one and then go to client VPN.10:14Then we will click on Cisco Secure Client settings and go all the way down into the authentication section. So we need to change the settings so that the Meraki MX points to the authentication proxy instead of.10:34The radio server. So we need to change the IP address and replace it to the IP address of the authentication proxy. Then we need to change the shared secret. This share secret is the one that we configure in the authentication proxy radio server auto section.10:54So we need to take this, copy it, and paste it in here. Now, one important best practice here is to increase the radius time out to 60 s.11:13This gives the end user enough time to receive and respond to the dual MFA prompt, especially in the scenarios where they might be using push notification or phone call approval. Once this is saved, any VPN login attempts will be forwarded to the dual authentication proxy.11:31Which will then perform both primary authentication and the dual second factor authentication. So let's go ahead and click on save. So now that everything is in place, then we can go ahead and test it.11:48So I'm just going to go into my phone and try to connect to the Meraki MX using the Cisco secure client application. So I'm going to click on connect, and I'm going to be prompted for the password for this user.12:05And after I click connect, a push notification here. Just going to click on approve and going to go back to the VPN and the VPN has been successfully accepted.12:23Now this demo shows how Duo can be integrated with Meraki client VPN using the authentication proxy, even without an active directory. It's a clean, reliable setup that enhances your existing VPN environment with modern MFA while keeping your infrastructure largely unchanged.12:43Thanks for watching and I hope this helped clarify how the components fit together. See you next time.13:01
