In short: The Duo Authentication Proxy is an on-premises service from Cisco Duo that sits between your VPNs, firewalls or LDAP applications and your directory. It checks the user's password against Active Directory, LDAP or RADIUS, then asks Duo for a second factor. It also handles Active Directory sync and Active Directory authentication for Duo SSO.
What the Authentication Proxy does
Many systems cannot talk to Duo's cloud directly. Firewalls, VPN concentrators, network devices and older applications usually authenticate users with RADIUS or LDAP against a server on the local network. The Duo Authentication Proxy is that server: it speaks RADIUS or LDAP to your devices and HTTPS to Duo.
It has three jobs:
- MFA for RADIUS and LDAP: adding Duo to VPNs and firewalls, Cisco Secure Client, network device logins and LDAP-based applications.
- Directory sync: importing users and groups into Duo from on-premises Active Directory or OpenLDAP, so you do not manage users twice.
- Active Directory authentication for Duo SSO: letting Duo Single Sign-On check passwords against your on-premises domain.
The proxy connects out to Duo over HTTPS on port 443, so it needs no inbound access from the internet. It can also send that traffic through an HTTP proxy if your network requires one.
How a RADIUS or LDAP login works
A typical VPN login through the proxy runs like this:
- The user enters their username and password into the VPN client.
- The firewall sends a RADIUS (or LDAP) request to the Authentication Proxy.
- The proxy checks the password against Active Directory, another LDAP directory or an existing RADIUS server such as Microsoft NPS.
- If the password is correct, the proxy asks Duo's cloud for a second factor. Duo sends a push or phone call, or checks the passcode the user typed.
- Duo returns allow or deny, and the proxy passes the answer back to the firewall.
Each part is configured as a section in the proxy's configuration file. Client sections define where passwords are checked; server sections define what the proxy listens for.
| Section | What it does |
|---|---|
| ad_client | Checks passwords against Active Directory or another LDAP directory, with fallback to further domain controllers |
| radius_client | Passes the password check to an existing RADIUS server, such as NPS |
| duo_only_client | Skips the password check, for devices that do primary authentication themselves |
| radius_server_auto | Listens for RADIUS and selects the Duo factor automatically; the usual choice for VPNs |
| radius_server_challenge and radius_server_concat | Alternative RADIUS modes: a second prompt for the factor, or the passcode appended to the password |
| radius_server_duo_only | Listens for RADIUS and performs only the Duo check, paired with duo_only_client |
| ldap_server_auto | Listens for LDAP binds, including LDAPS or STARTTLS, and adds Duo |
| cloud | Runs Active Directory or OpenLDAP directory sync into Duo |
| sso | Acts as the Active Directory authentication source for Duo SSO |
Requirements and where to install it
The proxy runs on Windows Server 2016 or later, or on supported Linux, including Red Hat Enterprise Linux, Rocky Linux, Ubuntu LTS, Debian, CentOS Stream and Fedora; Duo recommends Linux for the highest throughput. Check Duo's current list for exact versions. Microsoft's support for Windows Server 2016 ends in January 2027, and Duo does not support integrations on operating systems past their vendor's end of support, so plan new builds on a later release.
Duo's resource guidance is modest: its documented minimum is a single CPU and 4 GB of memory, and it notes that less memory is usually enough. Duo advises against installing the proxy on a domain controller or on a server running the Network Policy Server (NPS) role, partly because of port conflicts, so give it its own server.
On Windows, the Proxy Manager utility makes editing and testing the configuration easier, and secrets can be stored in encrypted form rather than plain text; on Linux, restrict permissions on the configuration file instead. The proxy also supports a FIPS mode, and recent releases add IPv6 support and RadSec (RADIUS over TLS, using certificates instead of shared secrets) as a beta feature.
High availability and scaling
If the proxy is down, nobody gets through the VPN. Build it with resilience from day one:
- Run at least two proxies, on separate hosts, with the same configuration. The proxy does not load balance itself, so configure the firewall with primary and secondary RADIUS servers, or put a load balancer in front.
- Point each proxy at more than one domain controller or RADIUS server, using the fallback host settings in the client sections.
- Scale out, not up: the proxy is largely single-threaded, so adding CPU cores does little. Duo recommends adding more proxies behind a load balancer if you need more capacity.
- Choose the fail mode: in 'safe' mode (the default) users get in on password alone if Duo cannot be reached; in 'secure' mode they are blocked. Set it on each RADIUS server section, based on the risk of each system.
Keep it on a current version
The proxy is software you run, so it needs patching like any other server component. Duo releases new versions regularly, and some changes matter for keeping it working: a 2025 release added support for new Duo certificate authorities, some older options such as the embedded-prompt RADIUS mode have reached end of support, and newer features such as RadSec and FIPS 140-3 need recent versions. Proxies also need a recent version to appear in the Authentication Proxy dashboard in the Duo Admin Panel.
Good practice is to keep every proxy on a current version, follow Duo's release notes, upgrade one proxy at a time so the other keeps serving users, and keep the operating system itself within its vendor's support. The proxy's connectivity tool also warns when the installed version is out of date.
Do you still need it?
Not every Duo deployment needs a proxy. If users sign in with Entra ID, Google or Duo Directory, and your VPN supports SAML through Duo SSO, the cloud can do the work without anything on-premises. Many organisations keep a proxy only for directory sync, older network devices or LDAP applications, and move VPNs to SAML over time.
For remote access to internal apps without a VPN, see Duo Network Gateway.
How we help
Forever Systems builds Duo Authentication Proxy deployments that do not become a single point of failure: sizing, resilient pairs, firewall and directory configuration, fail mode decisions, monitoring and planned upgrades. We can take over an existing proxy, bring it up to date and document it.
Contact us to review your set-up or ask for a quote.
How Forever Systems supplies and supports Cisco Duo
We supply, set up and support Cisco Duo for UK organisations, from small teams and schools to multi-site businesses.
- Edition selection: Duo Free, Essentials, Advantage or Premier, matched to your users, applications and compliance needs
- Integration design: Microsoft 365 and Entra ID, Google Workspace, AWS, VPNs and firewalls, Windows and macOS logon, RDP and RD Gateway, the Authentication Proxy and Duo Single Sign-On
- Device trust: Trusted Endpoints, device health policies and Duo Desktop, alongside your MDM
- Roll-out: user enrolment, communications, hardware tokens for staff without smartphones, and help desk processes that stop MFA fatigue
- Ongoing support: policy tuning, reporting, Cyber Essentials and cyber insurance evidence, renewals and licence changes
Forever Systems Ltd is an independent IT and cyber security provider and also supplies the wider Cisco Secure portfolio.
Want a Cisco Duo quote, trial or roll-out plan?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is the Duo Authentication Proxy used for?
It adds Duo MFA to systems that authenticate with RADIUS or LDAP, such as VPNs, firewalls and network devices. It is also used to sync users from on-premises Active Directory or OpenLDAP into Duo, and as the Active Directory authentication source for Duo Single Sign-On.
Can I install the Duo Authentication Proxy on a domain controller?
Duo advises against it, and against installing it on an NPS server. Use a dedicated Windows Server or Linux machine, ideally two for resilience.
Does the Duo Authentication Proxy need inbound internet access?
No. It connects out to Duo's cloud over HTTPS on port 443. Your firewalls and applications reach it on the local network using RADIUS or LDAP.
What happens if the Authentication Proxy cannot reach Duo?
For RADIUS logins it depends on the fail mode. In 'safe' mode, the default, users who pass the password check are let in without a second factor. In 'secure' mode they are refused. Set it deliberately for each system.
Do I need the Authentication Proxy for Duo SSO?
Only if Duo SSO checks passwords against on-premises Active Directory. With Duo Directory or a SAML identity provider such as Entra ID or Google Workspace as the authentication source, no proxy is needed.