Rublon

Secure Remote Access

By

Last updated on July 1, 2026

Note: If you are looking for a way to integrate Rublon with Cisco FTD Firepower Firewall, refer to MFA for Cisco AnyConnect VPN with Cisco FTD Firepower Firewall – RADIUS and MFA for Cisco AnyConnect VPN with Cisco FTD Firepower Firewall – LDAP(S).

Overview of MFA for Cisco AnyConnect VPN with ASA

Multi-Factor Authentication (MFA) for Cisco AnyConnect VPN with ASA is an added layer of security that requires users to provide at least two factors of verification in order to gain access to Cisco AnyConnect VPN with ASA. The first factor involves the user entering their Active Directory / RADIUS username and password. Upon successful completion of the first factor, the user must then undergo secondary authentication via one of the available authentication methods such as Mobile Push or Email Link. Once both factors are completed, the user gains access to the resource. Enabling Multi-Factor Authentication (MFA) or Two-Factor Authentication (2FA) for Cisco AnyConnect VPN with ASA prevents malicious actors from accessing the resource, even if they know the user’s login credentials.

Rublon MFA introduces Multi-Factor Authentication in a number of ways.

Note that both Rublon Authentication Proxy and Rublon Access Gateway can be used for both RADIUS and LDAP(S) authentication sources.

Enable Entra ID logins to Cisco AnyConnect VPN with ASA using Rublon MFA

If Cisco AnyConnect VPN with ASA authenticates users through LDAP or RADIUS, you can use Rublon Authentication Proxy to validate primary credentials against Microsoft Entra ID and then enforce Rublon MFA. This allows users to sign in to Cisco AnyConnect VPN with ASA with Microsoft Entra ID credentials, even when Cisco AnyConnect VPN with ASA does not support Microsoft Entra ID, SAML, OAuth 2.0, or OpenID Connect natively.

See how to authenticate LDAP and RADIUS with Microsoft Entra ID credentials and MFA, or explore the related use case: Microsoft Entra ID logins for LDAP and RADIUS applications with MFA.

Demo Video of MFA for Cisco AnyConnect VPN with ASA

Demo Video

YouTube player

Before you start

Ensure you have properly configured Cisco.

Ensure that you have properly set up your authentication source, that is an external Identity Provider (IdP) like FreeRADIUS, FreeIPA, OpenLDAP, or Microsoft Active Directory.

Configuration of MFA for Cisco AnyConnect VPN with ASA

Depending on your requirements, you will have to use either Rublon Authentication Proxy or Rublon Access Gateway. Both solutions have their advantages.

Both Rublon Authentication Proxy and Rublon Access Gateway support RADIUS (FreeRADIUS) and LDAP (FreeIPA, OpenLDAP, Microsoft Active Directory) authentication sources.

Rublon Authentication Proxy supports the following Authentication Methods: Email Link, Mobile Push, Passcode.

Rublon Access Gateway supports all Authentication Methods.

We recommend using your web browser to log in to your VPN to gain full support for all Rublon MFA features. Desktop clients are known to have limitations, which prevent them from being fully supported by Rublon 2FA solutions.

MFA for Cisco ASA VPN using RADIUS

Integrate your ASA VPN with Rublon MFA to introduce Multi-Factor Authentication (MFA) to your VPN logins. You have to install and configure Rublon Authentication Proxy before configuring Rublon 2FA for Cisco ASA VPN.

How to enable MFA for Cisco ASA VPN – RADIUS

MFA for Cisco ASA VPN using SAML

Integrate your ASA VPN with Rublon MFA to introduce Multi-Factor Authentication (MFA) to your VPN logins. You have to install and configure Rublon Access Gateway before configuring Rublon 2FA for ASA VPN.

How to enable MFA for Cisco ASA VPN – SAML

Troubleshooting

If you encounter any issues with your Rublon MFA integration, contact Rublon Support.

Related Posts