In short: Duo Network Gateway is a Cisco Duo Premier feature that publishes internal web apps, SSH servers and RDP, SMB or custom TCP services to remote users without a VPN. Users sign in through a SAML identity provider and Duo MFA, and Duo checks the device before each connection. It runs as Docker containers on a Linux server you host.
What Duo Network Gateway is
Duo Network Gateway (DNG) is a gateway you run at the edge of your network, usually in a DMZ, that publishes chosen internal applications to the internet. Nobody reaches an application until they have signed in, passed Duo MFA and met your device policy. Users get access to the specific apps you allow, not a tunnel into the whole network.
It is included in Duo Premier only, alongside complete device trust with endpoint protection verification. It is not part of Essentials or Advantage, although a Premier trial includes it.
Three ways to connect
| Access type | What users need | Typical use |
|---|---|---|
| Internal web applications | Any modern browser; no client software | Intranets, wikis, ticketing, finance and HR systems, admin consoles |
| SSH | The DuoConnect tool on the user's computer | Administrators and developers reaching Linux servers |
| Application Relay: RDP, SMB and custom TCP | DuoConnect plus Duo Desktop, on 64-bit Windows 10 or later or macOS 11 or later | Remote desktop to servers, file shares and other line-of-business apps |
One external address can front a group of SSH servers, and once signed in, users can reach any server in that group until their gateway session expires (the session length is set per external address). Each group of application servers can have its own Duo policy, so you can apply stricter rules to sensitive systems than to everyday ones. Users still sign in to each server itself as normal.
How a connection works
- The user opens the application's external address, or connects through DuoConnect.
- The gateway sends them to your SAML identity provider for primary sign-in: Duo Single Sign-On, AD FS, Okta, OneLogin or another SAML 2.0 provider.
- Duo shows the Universal Prompt for the second factor, such as a passkey, security key or Verified Duo Push.
- Duo checks the user, device and network against the application's policy, including device trust requirements.
- The gateway proxies the session to the internal application, which never has to be exposed to the internet itself.
Deployment requirements
Duo Network Gateway runs as Docker containers on a 64-bit Linux server, physical or virtual. Duo's guide covers Ubuntu, Debian, SUSE Linux Enterprise, Fedora and CentOS Stream. Duo notes that Red Hat Enterprise Linux no longer supports Docker, so choose another distribution.
You will also need:
- Public DNS names for the gateway and for each published application, pointing at the gateway. Application Relay uses DNS delegation and adds a DNS container.
- A certificate: your own commercial certificate (including a wildcard), or one the gateway obtains and renews automatically from Let's Encrypt, which cannot be used for wildcard addresses.
- Firewall rules: HTTPS (and HTTP for redirects) inbound from the internet, DNS inbound if you use Application Relay, the admin interface restricted to trusted networks, and HTTPS outbound to Duo.
- Resilience: Duo recommends some level of high availability in every deployment. An active/passive pair with a spare server to fail over to is the usual design; active/active is supported only in Amazon Web Services.
Keep the gateway, DuoConnect and Duo Desktop up to date. For example, Duo notes that Windows 11 24H2 computers need DuoConnect 2.0.6 or later to connect to relay applications.
Who it suits
Duo Network Gateway works well when people need a few internal applications rather than the whole network:
- Contractors and third parties who need one system for a fixed period, without being given a VPN account and wider network access.
- Administrators reaching SSH and RDP with MFA and device checks on every session.
- Older internal web apps that cannot be put behind modern single sign-on themselves.
- Reducing VPN use, moving groups of users off the VPN one application at a time.
It is less suitable where users need broad network access, protocols other than web, SSH and TCP, or a cloud-delivered service with no gateway to run. In those cases a VPN with Duo MFA or a cloud ZTNA service may fit better.
Duo Network Gateway, VPN or ZTNA?
| VPN with Duo MFA | Duo Network Gateway | Cloud ZTNA (for example Cisco Secure Access) | |
|---|---|---|---|
| What users reach | The network, limited by firewall rules | Specific published apps | Specific apps, through a cloud service |
| Where it runs | Your firewall | Your Linux server or cloud instance | The vendor's cloud, with connectors on your network |
| Client software | VPN client | None for web apps; DuoConnect for SSH and relays | Usually a client, with browser access for some apps |
| Device checks | Through Duo SSO policies | Duo policies on every app | The platform's own posture checks |
| Licensing | Firewall plus any Duo edition | Duo Premier | A separate security service subscription |
Duo Network Gateway is a focused, self-hosted way to publish internal apps behind Duo. A full security service edge (SSE) platform adds internet security, cloud app controls and cloud-delivered private access. See Cisco Secure Access and our guide to ZTNA for that wider approach.
How we help
Forever Systems designs and deploys Duo Network Gateway: choosing which apps to publish, building the Linux host and DNS, setting up the identity provider and policies, rolling out DuoConnect and Duo Desktop, and planning for resilience and updates. We will also tell you honestly if a VPN with MFA or a cloud ZTNA service would suit you better.
Contact us to discuss VPN-less access or ask for a quote.
How Forever Systems supplies and supports Cisco Duo
We supply, set up and support Cisco Duo for UK organisations, from small teams and schools to multi-site businesses.
- Edition selection: Duo Free, Essentials, Advantage or Premier, matched to your users, applications and compliance needs
- Integration design: Microsoft 365 and Entra ID, Google Workspace, AWS, VPNs and firewalls, Windows and macOS logon, RDP and RD Gateway, the Authentication Proxy and Duo Single Sign-On
- Device trust: Trusted Endpoints, device health policies and Duo Desktop, alongside your MDM
- Roll-out: user enrolment, communications, hardware tokens for staff without smartphones, and help desk processes that stop MFA fatigue
- Ongoing support: policy tuning, reporting, Cyber Essentials and cyber insurance evidence, renewals and licence changes
Forever Systems Ltd is an independent IT and cyber security provider and also supplies the wider Cisco Secure portfolio.
Want a Cisco Duo quote, trial or roll-out plan?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is Duo Network Gateway included in Duo Advantage?
No. Duo Network Gateway is included only in Duo Premier, which also adds complete device trust with endpoint protection verification. A Premier trial lets you test it.
Does Duo Network Gateway replace a VPN?
For many uses, yes: internal web apps, SSH, RDP and file shares can be published without a VPN. It does not give broad network access, so some users or applications may still need a VPN protected by Duo MFA.
Do users need to install software for Duo Network Gateway?
Not for web applications, which work in any browser. SSH needs the DuoConnect tool, and RDP, SMB and custom TCP apps through Application Relay need DuoConnect plus Duo Desktop on Windows or macOS.
Can Duo Network Gateway run on Red Hat Enterprise Linux?
Duo notes that Red Hat Enterprise Linux no longer supports Docker, which the gateway needs. Use a supported distribution such as Ubuntu, Debian or SUSE Linux Enterprise instead.
Is Duo Network Gateway the same as ZTNA?
It follows the same zero trust idea of per-application access after checking the user and device, but you host it yourself. Cloud ZTNA services, such as Cisco Secure Access, deliver private access from the vendor's cloud as part of a wider security platform.