MFA for Cisco AnyConnect
Cisco AnyConnect on the ASA is the remote-access backbone for thousands of enterprises — and a favorite target, because a username and password is often all that stands between the internet and the inside network. The ASA authenticates AnyConnect users against a RADIUS AAA server but provides no native MFA. Authnull becomes that AAA server (or proxies your existing one) and enforces a second factor on every AnyConnect session. You add an aaa-server group pointing at Authnull, attach it to the tunnel-group, and a push or OTP challenge is required before the VPN connects.
Cisco AnyConnect forwards the login; Authnull adds the factor.
The ASA forwards the login to Authnull over RADIUS; Authnull validates against AD/LDAP, challenges for the factor, and returns Access-Accept. Use a generous auth timeout on the tunnel-group so the push has time to land.
Configure MFA for Cisco AnyConnect
Real steps — the exact menus, fields, and values. Follow along in your console; the whole thing takes about 20 minutes.
Define Authnull as an AAA server group
Create a RADIUS AAA server group and add the Authnull connector as a host with your shared secret.
Attach it to the tunnel-group
Point your AnyConnect tunnel-group at the new AAA server group for authentication.
Increase the AAA timeout
Give the user time to approve the factor before the ASA gives up on the RADIUS response.
Apply to the group-policy
Ensure the connection profile uses the group-policy bound to this tunnel-group, then save the configuration.
Test the connection
Log in with AnyConnect using a test account. Expect a password prompt followed by an MFA challenge; approval establishes the tunnel.
Closes the MFA gap auditors look for
Enforcing MFA on Cisco AnyConnect gives you evidence for the remote-access and privileged-access controls in SOC 2 and the access requirements under CCPA — with per-login logs you can hand straight to an assessor.
Add MFA to Cisco AnyConnect — free to start.
Spin up Authnull, point Cisco AnyConnect at it, and enforce a factor on a pilot group today. No card, no rip-and-replace.