Cisco Duo Security: Advanced protection for company data in the hybrid work era

Silviu Sîrbu

Security System Engineer
silviu.sirbu@alef.com

About Cisco DUO Security

With Cisco Duo, securing your entire organization has never been easier. Cisco Duo’s user directory, flexible authentication options, including passwordless authentication, single sign-on (SSO), granular policy engine, identity automation capabilities, and AI identity analytics deploy fast in any environment. Duo helps keep companies safer than ever before with minimal downtime and optimized productivity.

Already have an on-premise Active Directory?

If the answer is yes then you can use Active Directory Sync (sometimes called directory synchronization) to keep identities in sync:

  • Copies users, groups, and attributes from your on-prem AD into Duo.
  • Ensures that user accounts in Duo match those in AD → no need to create accounts manually in Duo.
  • Changes in AD (e.g., new hires, role changes, terminations) are automatically reflected in Duo.

With AD sync, Duo knows which accounts exist and can enforce MFA (multi factor authentication) for those users.

Why Cisco DUO Authentication proxy is so important?

Because it bridges Cisco Duo cloud with legacy systems that do not natively support SAML / OIDC (e.g. RADIUS, LDAP, Active Directory, VPNs). No worries about confidentiality as the communication between the two systems is encrypted.

Use Case:

Your company has employed two external people as contractors so they can perform software development activities alongside with the internal team by connecting through the remote access VPN service to the internal resources. The company wants to protect resources and identities from vector attacks like credential theft & phishing through Duo MFA and SSO (single sign-on).

  • The remote contractor has been created and enrolled with the most secured authentication method in Duo (paswordless WebAuth).
  • The on-site contractor (already synced from Active Directory) has been enrolled by creating a password and a secondary device (Duo Mobile App).

Summary of the following steps:  

  • Protecting the application (VPN remote access with Cisco Firepower Threat Defense).
  • Establish secure communication with the Duo Cloud as the new role of IdP (Identity Provider) through the API keys.
  • User Enrollment for both authentication methods passkeys & 2FA Duo verified push.

Protect an application – Cisco Firepower Threat Defense VPN

1. In the Duo Admin Panel, from the menu on the left, click Applications > Application Catalog . Click +Add under the Cisco Firepower Threat Defense VPN (SSO) application tile.

Protect an application – Cisco Firepower Threat Defense VPN -1

2. Locate the Service Provider section. In the Cisco Firepower Base URL field, enter vpn.dcloud.local (the URL for the existing Firewall Threat Defense VPN head-end). In the Connection Profile Name field, enter TG-RAVPN (the existing Tunnel group for VPN on Firewall Threat Defense).

Protect an application – Cisco Firepower Threat Defense VPN - 2

3. Login to Secure Firewall Management Center (FMC) using the admin account. In Firewall Management Center, click Devices > Certificates.

Protect an application – Cisco Firepower Threat Defense VPN - 3

4. Create a trust relationship between the Service Provider (Secure Firepower Management Center) and IdP Duo Cloud by Adding Certificate Enrollment as IdP CA

Protect an application – Cisco Firepower Threat Defense VPN - 4

5. From Objects -> Single Sign-on Server -> Add Single Sign-on Server.

Add the parameters offered by DUO cloud in order to successfully connect via API keys.

Protect an application – Cisco Firepower Threat Defense VPN - 5

6. From Devices -> Remote Access -> Advanced select Default-External-Browser Package.

Protect an application – Cisco Firepower Threat Defense VPN - 6

7. Edit the Connection Profile TG-RAVPN so that the new authentication method is now SAML and authentication server Duo_SSO.

Protect an application – Cisco Firepower Threat Defense VPN - 7

 

User Enrollment

In today's digital landscape, organizations are continually seeking ways to enhance security while simplifying user experiences. One key decision in this journey is determining how users enroll in authentication services—either by requiring a password or adopting a passwordless approach.

Enrolling with a password remains a traditional method, offering a familiar layer of security. However, passwordless continues to gain traction as it minimizes friction and enhances user convenience by eliminating the need for password management.

A complete passwordless experience leverages robust authentication methods to ensure secure access without the traditional password. This approach not only strengthens security by reducing an organization's attack surface, but it also streamlines the user experience by removing barriers to access.

Duo's flexible enrollment options for primary and secondary authentication allows organizations to tailor their identity management strategies, balancing security requirements with user-friendly authentication.

 

Create a Custom Enrollment Policy in Duo to require passwords for Duo SSO

1. From Policies -> User Enrollment and Account Management -> Add Policy.

Create a Custom Enrollment Policy in Duo to require passwords for Duo SSO - 1

Create a Custom Enrollment Policy in Duo to require passwords for Duo SSO - 2

2. Apply user group policy.

Create a Custom Enrollment Policy in Duo to require passwords for Duo SSO - 3

3. Custom policy applied to Contractors group.

Create a Custom Enrollment Policy in Duo to require passwords for Duo SSO - 4

 

Create and enroll the remote contractor user with complete passwordless (WebAuthn) in Duo

1. Create a user manually.

Create and enroll the remote contractor user with complete passwordless (WebAuthn) in Duo - 1

2. Follow the enrollment link and generate the code.

Create and enroll the remote contractor user with complete passwordless (WebAuthn) in Duo - 2

3. Use a security key to verify the identity. 

Create and enroll the remote contractor user with complete passwordless (WebAuthn) in Duo - 3

4. Create the passkey stored on the security key.

Create and enroll the remote contractor user with complete passwordless (WebAuthn) in Duo - 4

5. Add a PIN and you’re good to go!

Create and enroll the remote contractor user with complete passwordless (WebAuthn) in Duo - 5

6. Verify enrollment for the remote contractor user.

Create and enroll the remote contractor user with complete passwordless (WebAuthn) in Duo - 6

7. Open the Cisco Secure Client and follow the normal vpn login operation:

Create and enroll the remote contractor user with complete passwordless (WebAuthn) in Duo - 7

8. You will get the redirection to Duo Identity Provider login:

Create and enroll the remote contractor user with complete passwordless (WebAuthn) in Duo - 8

9. Authenticate user using security key

Create and enroll the remote contractor user with complete passwordless (WebAuthn) in Duo - 9 

10. User is successfully authenticated.

Create and enroll the remote contractor user with complete passwordless (WebAuthn) in Duo - 10

 

Enroll the on-site contractor by creating a password and enrolling a secondary authentication device

1. Follow the enrollment link and generate the code for AD synced user bob.

Enroll the on-site contractor by creating a password and enrolling a secondary authentication device - 1

2. Add the enrollment code for on-site contractor bob:

Enroll the on-site contractor by creating a password and enrolling a secondary authentication device - 2

3. Add the password as a first factor in the authentication process.

Enroll the on-site contractor by creating a password and enrolling a secondary authentication device - 3

4. Add the second factor with Duo Mobile verification code.

Enroll the on-site contractor by creating a password and enrolling a secondary authentication device - 4

5. Scan the QR code for Duo Mobile App enrollment.

Enroll the on-site contractor by creating a password and enrolling a secondary authentication device - 5

6.  Setup is now complete.

Enroll the on-site contractor by creating a password and enrolling a secondary authentication device - 6 Enroll the on-site contractor by creating a password and enrolling a secondary authentication device - 7

7. Verify authentication for on-site contractor user “bob” . Connect to the vpn through Cisco Secure Client . Duo IdP will prompt you with the username so the authentication process can start.

Enroll the on-site contractor by creating a password and enrolling a secondary authentication device - 8

8. First factor provided.

Enroll the on-site contractor by creating a password and enrolling a secondary authentication device - 9

9. Enter code in Duo Mobile.

Enroll the on-site contractor by creating a password and enrolling a secondary authentication device - 10

10. Login succeded!

 

Some of the key points regarding the threat landscape that Duo Security can address:

  • Credential Theft & Phishing (Stolen usernames/passwords remain the #1 attack vector (phishing, dark web dumps, credential stuffing).
  • Session Hijacking & Cookie Theft.
  • Compromised / Unmanaged Devices.
  • Insider Threats & Lateral Movement.
  • Supply Chain & Third-Party Access.
  • Ransomware & Malware Delivery.
  • Cloud Misconfiguration & Shadow IT.
  • AI-powered Attacks (Deepfake Phishing, MFA Fatigue Attacks).
For further details, fill out the form below:

Learn more about Cisco Duo Security

I agree that ALEF Group will process my personal data in accordance with GDPR policies

 

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.