In short: Duo for Cisco Secure Client adds MFA to remote access VPN logins on Cisco ASA and Secure Firewall Threat Defense. Duo recommends SAML through Duo Single Sign-On, which brings the Universal Prompt, passkeys and device checks. RADIUS through the Duo Authentication Proxy is the alternative. Direct LDAPS on ASA reached end of life in February 2025.
Your options at a glance
Cisco Secure Client is the new name for AnyConnect. Duo can protect Secure Client VPN logins on both Cisco ASA and Cisco Secure Firewall Threat Defense (FTD), but some older methods have now been retired.
| Option | Where it fits | Status |
|---|---|---|
| Duo Single Sign-On (SAML) on ASA | ASA software with SAML support (9.10 or later, or specific earlier releases), with AnyConnect 4.6 or later or Secure Client | Recommended by Duo |
| Duo Single Sign-On (SAML) on FTD | Threat Defense 6.7.0 or later, managed by Secure Firewall Management Center | Recommended by Duo |
| RADIUS through the Duo Authentication Proxy | ASA or FTD where SAML is not an option, or where an existing RADIUS design must stay | Supported |
| Direct LDAPS from ASA to Duo's cloud | Older ASA set-ups | End of life on 20 February 2025: no new applications, and existing configurations may no longer authenticate |
| Duo Access Gateway (SAML) | Older on-premises SAML deployments | Last day of support was 26 October 2023 for commercial editions |
If your ASA still points at Duo over LDAPS, or you are still running Duo Access Gateway, it is time to move. Both paths have a clear replacement, covered below. This page covers Duo; for the VPN client itself, see Cisco Secure Client on our Cisco Secure site.
Duo SSO with SAML: how it works
With the SAML option, the ASA or FTD hands authentication to Duo Single Sign-On:
- The user opens Secure Client and picks the VPN connection profile (tunnel group) that uses SAML.
- Secure Client opens a browser window to Duo SSO.
- The user enters their password, which Duo checks against Active Directory (through the Authentication Proxy), a SAML identity provider such as Entra ID or Google Workspace, or Duo Directory.
- Duo shows the Universal Prompt for the second factor and checks the device and network against your policy.
- Duo sends a signed SAML assertion back to the firewall and the tunnel comes up.
Some practical points from Duo's guides:
- Passkeys and security keys need the login to open in the device's normal browser rather than the client's embedded window. Duo's guides list ASA 9.17 or later, or Threat Defense 7.1.0 or later, with the external (default operating system) browser option enabled on the connection profile, AnyConnect 4.10.04065 or later or Secure Client, and the Universal Prompt.
- Fewer prompts: a shared remembered-devices policy across your SAML applications stops users being asked again for every app; on Secure Client it needs the same external browser set-up as passkeys. Duo's ASA guide also recommends a 300-second SAML assertion timeout and leaving forced re-authentication turned off.
- Exact names: the tunnel group (ASA) or connection profile (FTD) name entered in the Duo Admin Panel is case-sensitive and must match the firewall.
- Group mapping: the dedicated Duo app does not send extra SAML attributes. If you need to pass groups to the firewall to choose group policies, Duo points you to its generic SAML application.
- Edition: Duo SSO is included from Duo Essentials.
The same approach applies to Cisco Secure Access VPN, which also has a Duo SSO guide, and to Meraki with Cisco Secure Client.
RADIUS through the Duo Authentication Proxy
The RADIUS option suits firewalls that cannot use SAML, organisations that want to keep an existing NPS or RADIUS design, and VPN profiles used by scripts or devices that cannot open a browser. The firewall sends RADIUS to the Duo Authentication Proxy on your network, which checks the password and then asks Duo for the second factor.
Duo documents three RADIUS styles for ASA (FTD needs version 6.3.0 or later managed by Management Center):
- Automatic push: after the password is accepted, Duo sends a push or phone call to the user's default device.
- Challenge: Secure Client shows a second prompt where the user chooses a factor or types a passcode.
- Duo-only: the firewall does primary authentication itself and uses Duo purely for the second factor.
The trade-offs: there is no Universal Prompt, users must be enrolled in Duo beforehand, phishing-resistant methods are not available, and Duo cannot check device health. Raise the firewall's RADIUS timeout so users have time to respond, and keep the proxy on a current version. Our VPNs and firewalls page covers RADIUS tuning in more detail.
Device trust and posture
With the SAML option, Duo applies its normal access policies to Secure Client connections, so you can decide which devices may connect as well as which users:
- Trusted Endpoints, from Duo Essentials, can confirm the device is managed or registered. Certificate-based detection needs a minimum Secure Client or AnyConnect version on each platform; other detection methods do not.
- Device health checks through Duo Desktop, from Duo Advantage, can require a firewall, disk encryption, a system password and a supported operating system.
- Endpoint protection verification, in Duo Premier, can require a security agent to be present and running.
- Operating system and browser rules, from Duo Advantage, can block out-of-date platforms that no longer receive security updates.
Duo's checks happen at login. Cisco's own posture options for Secure Client, and network access control with Cisco Identity Services Engine, are covered on our Cisco Secure site. See Cisco Duo device trust for how Duo's checks differ by edition.
Moving off LDAPS or Duo Access Gateway
If an older configuration is still in place, a typical migration looks like this:
- Check the ASA or FTD software version and the Secure Client versions in use, and upgrade where needed for SAML and the external browser.
- Decide the authentication source for Duo SSO: Active Directory through the Authentication Proxy, Entra ID, Google or Duo Directory.
- Create the Duo application in the Admin Panel and a new SAML connection profile on the firewall, leaving the old one in place.
- Pilot with IT staff, then a wider group, checking reconnects, remembered devices and any group-based access.
- Move users across, then remove the old profile and any LDAPS or Duo Access Gateway configuration.
Running both profiles side by side means nobody loses access during the switch.
How we help
Forever Systems designs and deploys Duo for Cisco firewalls: reviewing your current VPN set-up, upgrading to supported software where needed, configuring Duo SSO or RADIUS, setting device policies and writing user guidance. We also supply the wider Cisco portfolio through Cisco Secure, including Cisco Secure Firewall.
Contact us to plan your migration or ask for a quote.
How Forever Systems supplies and supports Cisco Duo
We supply, set up and support Cisco Duo for UK organisations, from small teams and schools to multi-site businesses.
- Edition selection: Duo Free, Essentials, Advantage or Premier, matched to your users, applications and compliance needs
- Integration design: Microsoft 365 and Entra ID, Google Workspace, AWS, VPNs and firewalls, Windows and macOS logon, RDP and RD Gateway, the Authentication Proxy and Duo Single Sign-On
- Device trust: Trusted Endpoints, device health policies and Duo Desktop, alongside your MDM
- Roll-out: user enrolment, communications, hardware tokens for staff without smartphones, and help desk processes that stop MFA fatigue
- Ongoing support: policy tuning, reporting, Cyber Essentials and cyber insurance evidence, renewals and licence changes
Forever Systems Ltd is an independent IT and cyber security provider and also supplies the wider Cisco Secure portfolio.
Want a Cisco Duo quote, trial or roll-out plan?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Does Duo work with AnyConnect?
Yes. AnyConnect is now called Cisco Secure Client, and Duo supports it on Cisco ASA and Secure Firewall Threat Defense through Duo Single Sign-On (SAML) or RADIUS via the Duo Authentication Proxy.
Is Duo LDAPS for Cisco ASA still supported?
No. Duo's direct LDAPS integration for Cisco ASA reached end of life on 20 February 2025: new applications cannot be created and existing configurations may no longer authenticate. Use Duo SSO with SAML, which Duo recommends, or RADIUS through the Authentication Proxy.
Does Duo SSO for Cisco ASA need the Authentication Proxy?
Only if on-premises Active Directory is your authentication source for Duo SSO. If users sign in through a SAML identity provider such as Entra ID or Google Workspace, or with Duo Directory, the SAML option needs no on-premises Duo component.
Can Duo check device health before a Secure Client VPN connects?
Yes, with the SAML option. Duo policies can require Trusted Endpoints, Duo Desktop health checks or endpoint protection, depending on your edition. The RADIUS option cannot check device health.
Can users log in to Secure Client with a passkey?
Yes, with Duo SSO, when the login opens in the device's normal browser. Duo's guides require ASA 9.17 or later or Threat Defense 7.1.0 or later with external browser support enabled, AnyConnect 4.10.04065 or later or Secure Client, and the Universal Prompt.