Contents
Right-click the Cisco AnyConnect VPN Client log, and select Save Log File as AnyConnect.evt. Note: Always save it as the.evt file format. If the user cannot connect with the AnyConnect VPN Client, the issue might be related to an established Remote Desktop Protocol (RDP) session or Fast User Switching enabled on the client PC. When autocomplete results are available use up and down arrows to review and enter to select. Cisco AnyConnect Secure Mobility Client empowers remote workers with frictionless, highly secure access to the enterprise network from any device, at any time, in any location while protecting the organisation. Watch overview (1:39) Download DUO + 10 licences for free; Contact Cisco. Anyconnect mtu 1300. Anyconnect ssl df-bit-ignore enable. How will OKTA radius server would react, if we configure remote sec VPN using OKTA for this “DTLS is Blocked Somewhere in the Path” settings? Not sure about the OKTA radius. Okta.com Cisco’s ASA and AnyConnect solutions are robust, best-in-breed solutions in the firewall space, supporting a massive customer base with network-protection and optimization software that’s deployed in more than a million security appliances deployed throughout the world. Integrating natively with the 5500+ applications in the Okta.
Note | Refer to the SAML SSO Deployment Guide for Cisco Unified Communications Applications for your release to find out if Okta has been tested with your release. |
Introduction
Single sign-on (SSO) is a session or user authentication processthat enables a user to provide credentials to access one or moreapplications. The process authenticates the user for allapplications they have been given rights to and eliminates furtherprompts when they switch applications during a particularsession.
For more information about the SAML SSO Solution, see: SAML SSO Deployment Guide for Cisco Unified Communications Applications.
This document provides steps to configure Okta as SAML SSO Identity Provider (IdP) for Cisco Unified Communications Manager (UnifiedCM), Cisco Unified Communications Manager IM and Presence Service(IM and Presence Service), Cisco Unity Connection, or Cisco PrimeCollaboration Assurance.
Configure Okta as Identity Provider
Use this procedure to configure Okta as the SAML SSO Identity Provider (IdP) for Cisco Unified Communications Manager.
Okta is a cloud-hosted IdP. SAML SSO can be enabled using Okta IdP with the cluster-wide option only. The per node option is not available for Okta.
Note | For details on how to configure SAML SSO on Cisco Unified Communications Manager, refer to the SAML SSO Deployment Guide at https://www.cisco.com/c/en/us/support/unified-communications/unified-communications-manager-callmanager/products-maintenance-guides-list.html. |
| Step 1 | Log in to the Service Provider (Cisco Unified Communications Manager) and download the metadata XML file. | ||
| Step 2 | Log in to the Okta server user interface and click Admin tab. | ||
| Step 3 | From the Okta dashboard, select Applications > Applications. | ||
| Step 4 | From the Applications window, click the Add Application button. Various options to create an application or to choose from existing applications appear. | ||
| Step 5 | Click Create New App to use wizard to create new application integration. | ||
| Step 6 | On the Create a New Application Integration window, from the Platform drop-down list, choose Web and for the Sign On method field, choose SAML 2.0. | ||
| Step 7 | Click Create. | ||
| Step 8 | Enter a name for the application and click Next. | ||
| Step 9 | On the Create SAML Integration window, enter the details for fields of the General Settings tab, and click Next. | ||
| Step 10 | Enter details for the following mandatory fields for SAML Settings. These details are available in the metadata XML file that you downloaded from the Service Provider.
| ||
| Step 11 | (Optional) Enter the attribute UID to the Cisco Unified Communications Manager cluster.
Figure 1. Sample UID Mapping | ||
| Step 12 | On the Feedback tab, select “I'm a software vendor. I'd like to integrate my app with Okta” and click Finish. | ||
| Step 13 | On the Import tab, assign the users or groups that you want to enable, and click Done. | ||
| Step 14 | On the Sign On tab, click the Identity Provider metadata link to download the Okta metadata file. | ||
| Step 15 | Open the downloaded metadata file, change the two lines of NameIDFormat to <md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</md:NameIDFormat>, and then save the file. |
Enable SAML SSO on Unified Communications Applications
When you have configured the IdP appropriately, follow these steps to enable SSO.
Procedure| Step 1 | Navigate to the following page for each application:
| ||
| Step 2 | Click Enable SAML SSO and follow the steps.
|
Note | For detailed SAML SSO configuration steps, refer to the SAML SSO Deployment Guide for Cisco Unified Communications Applications. |
Test SSO on Okta
After you have configured SAML SSO on both Okta and Cisco Unified Communications Manager, test the SSO connection.
Procedure| Step 1 | Log in to Okta to authenticate the Okta service. A confirmation message, showing that the SSO configuration is successful, appears. |
| Step 2 | Click Close and then click Finish |
| Step 3 | Close the web browser and wait for a couple of minutes for the SAML SSO configuration changes to take effect on Cisco Unified Communications Manager. |
| Step 4 | Enter the Cisco Unified Communications Manager URL in the address bar of the web browser to verify that SSO is enabled. The Recovery URL to bypass Single Sign On (SSO) link appears below the Cisco Unified Communications Manager link. The Recovery URL to bypass Single Sign On (SSO) link appears when the SSO is enabled. |
Copyright © 2017, Cisco Systems, Inc. All rights reserved.
Most networking administrators have probably spent at least some time setting up a remote-access VPN for their company or for a customer. To authenticate end-users that connect to the VPN, it is very common to utilize an external database of users and to communicate with this external database you usually have to use the LDAP or RADIUS-protocol to talk either directly to an LDAP-catalog or to a RADIUS-server (like Cisco’s Identity Services Engine, ISE, for example).
However, if your VPN-solution consists of an Cisco ASA-firewall and the AnyConnect VPN software, there is a new option/protocol available to handle authentication: SAML, which stands for Security Assertion Markup Language. SAML has grown big in the last few years to provide authentication and single sign-on (SSO) experiences for applications like email, websites, ticket services and much more. The general idea of SAML is that once you have gone through a succesful authentication, you are handed a sort of cookie or “ticket” inside your web browser that will allow you to automatically be signed into the next service you want to use that also uses the same SAML-authentication. Today, there are many different products that use SAML-authentication from well-known companies like Microsoft, Okta, Ping Identity and even Cisco (through their Duo service).
As of this writing, successful SAML-authentications taking place for VPN does not “carry over” for use with other services because of how AnyConnect works… so keep that in mind for your own implementation.
I am not going to go into detail how SAML-authentication works but the main thing about the SAML-authentication flow is that when you initiate a VPN-session in AnyConnect (by typing in the URL/IP to your ASA and clicking “Connect”) instead of getting the normal AnyConnect login-prompt you will be redirected to a so called Identity Provider (IdP) which will present you with a login website that opens up inside AnyConnect (at least if you are using AnyConnect version 4.6 or newer). It is very common for companies and organizations to design their own login-page using their brand colors and logotypes to make users feel at home. Since the VPN login will look the same as for other applications used by the users, they will be very familiar with the interface. In SAML-terms the ASA will be acting as a Service Provider (SP).
This is not going to be a complete guide on how to setup SAML-authentication for VPN on the ASA, we will only cover the SAML-configuration on the ASA and not the configuration of basc VPN-settings like Group Policies etc. We will also not cover the configuration of the IdP, mainly because 1) you, the network administrator, will probably not be the one tasked to do that configuration and 2) there are way to many different IdP-services and I’ve barely seen any of them. This article is more about putting together a collection of good things to know that I’ve picked up from implementing SAML-authentication myself and from reading about other people’s experience on the Cisco Support forum. The main reason I felt the need to make this article is that Cisco’s own documentation regarding SAML is pretty barebone and it does not cover all the steps needed in a good enough manner, in my opinion.
General Setup
Below you see a simple diagram of the connections and communication that takes place in a SAML VPN-solution. The IdP could be either on your internal network, your DMZ or on the internet if you are using a cloud service.
Technical requirements
I’m just gonna get this out right away, there are some technical requirements that need to be met to use SAML-authentication for your VPN-connections:
Your ASA must have a trusted certificate installed, preferably from a third-party.
Your IdP must also have a trusted certificate installed, preferably from a third-party.
SAML-authentication differs quite a bit from the usual RADIUS or LDAP-authentication you are used to: the ASA doesn’t actually know the name of the user until the authentication is complete (either sucessful or failed) since the authentication takes place on the IdP. The IdP will inform the ASA of the username using the SAML-attribute NameID.
The Connection Profile (Tunnel Group) for your VPN that is going to use SAML as authentication method cannot contain any spaces. This it because the Connection Profile name is going to be used in the SAML-URL that the IdP will make use of. If you need to have multiple words in your Connection Profile, use dash or underscore between them.
If your SAML-authentication page is capable of reading user certificates from your computer, you must have AnyConnect version 4.7 or newer for this to work. Earlier version will not be able to fetch and present certificates stored on your computer to the IdP login page.
Your ASA must have DNS-servers configured that are able to do lookup the URL/IP of your Identity Provider servers.
Make sure your ASA and your IdP has NTP running and synchronized.
Basic VPN-configuration
Once again, this article assumes you have at least a decent amount of experience working with remote-access VPN configuration of an ASA and therefore I will not be covering the basics of Connection Profiles, Group Policies, IP-pools and so on. You know what’s best for your environment and the only thing this article will ask of you is to follow the technical requirement above (like the Connection Profile name) and that you set the Connection Profile’s User Authentication to SAML after you have configured the SAML (SSO) server futher down.
Adding the Identity Provider (IdP) certificate to the ASA
According to the documentation on Cisco’s website, you only need to add the root-certificate of the IdP’s certificate to the ASA buuut if you dig inside the Help pages inside the ASDM software you actually need to add the IdP’s certificate to the ASA.
As a best practice, I would recommend you install the root and intermediate certificates of the IdP’s certificate into the trusted certificate store of the ASA just in case. Head over to Configuration > Certificate Management > CA Certificates and click on Add to import the root certificate first and then do it again to import the intermediate certificate. You can add the certificates either as files (.der/.cer/.crt) or paste in the Base64 (text-version) of the certificates one by one.
However, for the “SAML-trust” to be setup between your ASA (SP) and the IdP, you also need to add the certificate of the IdP itself (the certificate that is used on the login website) as a trusted CA certificate.
Now comes the tricky part: I had trouble adding the IdP certificate itself in ASDM as a CA certificate because I kept getting an error stating the certificate could not be added because it needs to be added with the “no ca-check” command.
There is no way to issue the command “no ca-check” when importing the certificate using ASDM so you will need to add this certificate as a trustpoint using the command line instead.
<paste in the IdP-certificate in Base64-format>
And you’re done!
Configuring a SAML-server
Next up we need to add the SAML-server in ASDM, you can find the configuration for SAML-servers (or SSO-server as they are named here) under Configuration > Remote Access VPN > Clientless SSL VPN Access > Advanced > Single Signon Server. Don’t let the menu fool you, these servers are not only used for Clientless VPN.
The configuration of adding a SAML-server is pretty simple because there isn’t a lot of settings for you to play around with, but you will need to get some URLs from your IdP-administrator. Ask them for IDP Entity ID, Sign-in URL and Sign-out URL.
Please note that even the IDP Entity ID is a URL, it is not a “friendly name” that you can pick yourself so to speak.
Request Signature is something you must agree with your IdP-administrator about. Setting it to None is a very bad practice.
Request Timeout is something I would not touch unless told to by the IdP-administrator.
Make sure to remove “https://” before all URLs (except for the URL you set as IDP Entity ID) and all possibly added “/” from the end of the URLs, including the Base URL which is your ASA’s URL.
There is also a slight inconvenience with configuring SAML (SSO) servers and that is that everytime you make a change, you need to turn the SAML-configuration for that Connection Profile off and on again for the changes to take effect. Cisco is however aware of this oddity (it is tracked as en Enhancement under the bug-id CSCvi23605) and when you head into the SSO-server configuration you are greeted with this message:
Okta Asa
To turn the SAML-configuration for a Connection Profile off and on again, either use the commands below or do it from ASDM on the Connection Profile > Basic > change SAML Identity Provider to “None” > click OK and Apply, then go back and reselect the SAML-server in the scroll list and click OK and Apply again.
Enter you Connection Profile/Tunnel Group:
Remove SAML-server from Connection Profile:
Re-add SAML-server to Connection Profile:
What the IdP-administrator will need from you
Your ASA certificate which is used on the “outside” interface of your ASA and for VPN-connections, they will need it to complete the trust between the ASA and the IdP.
Your SAML metadata which can be found if you (on the outside of the ASA) browse to the URL of your ASA and access the SAML-resource portion of your Connection Profile (the so-called metadata). For example, if your VPN URL is https://vpn.mydomain.com and your Connection Profile is called VPN-SAML-AUTH then your metadata-URL would be: https://vpn.mydomain.com/saml/sp/metadata/VPN-SAML-AUTH. You know the URL is correct if you get something like the image below if you browse to the URL. You can also get this information via the CLI using the command show saml metadata <Connection Profile name> which in my case would be show saml metadata VPN-SAML-AUTH.
Make sure to tell the IdP-administrator that you want the SAML-attribute NameID included in the SAML-response from the IdP when it tells the ASA if an authentication attempt was successful or not. If you do seperate authorization (via ISE for example), this will be the username that is sent to the authorization server. The NameID will also be what you, in the ASA, will see at the username for a remote-access VPN-session.
Agree upon what Request Signature to use and (optionally) a Request Timeout. A tips is to start by setting no Request Timeout on the ASA’s side and just let the IdP deal with this however it wants to to see if it just works right out of the box.
Making changes to the SAML-configuration on the ASA could change your SAML-metadata and the IdP-administrator might need to change something on their side as well, so always ask the IdP-administrator to verify that they have the latest metadata from your ASA.
Debugging SAML-authentication attempts
Your first few attempts of connecting to the SAML VPN is probably gonna go bad and then I would recommend this debug command to see if there is anything wrong with the SAML-connection from your ASA (the SP) and the IdP.
Using the debug above you get to see the actual creation of SAML-requests being sent between the ASA and the IdP. The 255 at the end is the debug level, with 255 providing you with the most output.
In my experience, I have run into trouble where the IdP has been trying to send SAML-attributes to the ASA that the ASA is not able to interpret or understand which would show up in the debugging log as:
Here the SAML-attribute AuthnContextDeclRef is sent to the ASA from the IdP after authentication is successful, but the ASA does not know what this attribute is and therefore the VPN-authentication fails. If you run into this you pretty much have to ask your IdP administrator to make the IdP not send this attribute as there is no way to fix this on the ASA’s side due to the very limited SAML-configuration parameters of the ASA OS.
Okta Cisco Anyconnect Login
Another trouble you could run into is that the clock of the ASA and the IdP is not synchronized or that the timeout for the SAML-tickets/sessions are not in agreement between the ASA and the IdP. This could happen if you define a Request Timeout in the ASA configuration for the SAML-server and the ASA tries to override the timeout values set by the IdP. This is what you could see in the debug then:
Drawbacks of using SAML
As of this writing (March 6th 2020) there is no easy way to apply different authorization rules for VPN users after they authenticate, like you would with Dynamic Access Policies (DAP) in ASA. The SAML-standard itself support many types of authorization parameters, but the ASA is unable to understand these. What you can do is let a separate authorization take place after the SAML-authentication, using either an LDAP-catalog or RADIUS-server, to get a second look at the user and then change authorization depending on group membership or account attributes, for example.
Okta Cisco Anyconnect Password
Good luck!