Deployment Guide for Windows Server and Linux
RADIUS-based Duo Authentication Proxy deployment
with Active Directory primary authentication
VPN platform Cisco ASA / Cisco Secure Client (AnyConnect) SSL VPN
MFA platform Cisco Duo
Proxy options Windows Server or Linux
Primary authentication Active Directory / LDAP (example in this guide)
RADIUS UDP 1812; 60-second ASA timeout recommended
1. Purpose and Architecture
This guide describes how to add Duo MFA to a Cisco ASA SSL VPN by placing the Duo Authentication Proxy between the ASA and the organization’s primary identity source. The same Authentication Proxy configuration works on Windows Server and Linux; the installation, service-control, file paths, and secret-protection options differ.
Internet VPN user
|
v
Cisco ASA / Secure Client VPN
|
| RADIUS UDP/1812
v
Duo Authentication Proxy
| \
| LDAP/LDAPS \ HTTPS TCP/443
v v
Active Directory Duo Cloud
|
v
RADIUS Accept / Reject -> Cisco ASA
NOTE: Duo recommends that primary authentication already work before Duo is added. Build and test the ASA VPN first, then insert Duo into the authentication path.
2. Prerequisites
• A working Cisco ASA remote-access SSL VPN connection profile.
• A Duo tenant and administrative access to the Duo Admin Panel.
• Users enrolled in Duo and permitted to access the Duo application.
• A Windows Server 2016+ or supported 64-bit Linux host for the Authentication Proxy.
• Network reachability from the ASA to the proxy on UDP/1812.
• Outbound HTTPS TCP/443 from the proxy to Duo.
• Network reachability from the proxy to the domain controller(s).
• A dedicated read-only AD service account if using LDAP bind authentication.
• A long, random RADIUS shared secret stored securely.
3. Create the Duo Application
1. Sign in to the Duo Admin Panel.
2. Open Applications > Application Catalog.
3. Add the application named “Cisco RADIUS VPN” with the 2FA label.
4. Record the Integration Key (ikey), Secret Key (skey), and API hostname.
5. Grant the test user or appropriate Duo group access to the application.
NOTE: Treat the Duo secret key as a password. Do not place a real skey or RADIUS secret in documentation, tickets, chat transcripts, or source control.
4. Plan the Values Before Installation
Value Example / Placeholder
ASA inside IP xxx.xxx.xxx.xxx
Proxy IP xxx.xxx.xxx.xxx
AD DC 1 dc1.example.com
AD DC 2 (recommended) dc2.example.com
AD search DN DC=example,DC=com
AD service account svc_duo
Duo API host api-XXXXXXXX.duosecurity.com
Duo ikey DIXXXXXXXXXXXXXXXXXX
Duo skey
RADIUS shared secret
5. Windows Server Installation
Use this section when the Duo Authentication Proxy will run on Windows Server.
5.1 Placement
A dedicated member server is preferred. Duo specifically does not recommend installing the Authentication Proxy on the same Windows server as a domain controller or NPS when avoidable, because LDAP/RADIUS port conflicts and failure-domain concentration can result.
5.2 Install
6. Download the current Duo Authentication Proxy for Windows from Duo.
7. Run the installer as Administrator.
8. Install the Authentication Proxy Manager if you want a GUI for editing, validating, and controlling the proxy.
Default modern installation path:
C:\Program Files\Duo Security Authentication Proxy
Configuration file:
C:\Program Files\Duo Security Authentication Proxy\conf\authproxy.cfg
Log file:
C:\Program Files\Duo Security Authentication Proxy\log\authproxy.log
5.3 Windows Firewall
If Windows Firewall is enabled, allow RADIUS authentication from the ASA to UDP/1812. Example:
New-NetFirewallRule `
-DisplayName “Duo RADIUS from Cisco ASA” `
-Direction Inbound `
-Protocol UDP `
-LocalPort 1812 `
-RemoteAddress
-Action Allow
NOTE: Restrict the firewall rule to the ASA address rather than allowing UDP/1812 from the entire network.
6. Linux Installation
Use this section when the Authentication Proxy will run on Linux.
6.1 Supported host
Use a currently supported 64-bit Linux distribution. Duo’s July 2026 ASA guide lists Ubuntu 20.04 LTS+, Debian 11+, Rocky Linux 9+, RHEL 7+, CentOS Stream 9+, and Fedora 39+ among its recommended platforms.
6.2 Debian/Ubuntu prerequisites
sudo apt-get update
sudo apt-get install build-essential libffi-dev zlib1g-dev
6.3 Download, build, and install
wget –content-disposition https://dl.duosecurity.com/duoauthproxy-latest-src.tgz
tar xzf duoauthproxy-*-src.tgz
cd duoauthproxy-*-src
make
cd duoauthproxy-build
sudo ./install
Default Linux paths:
/opt/duoauthproxy/conf/authproxy.cfg
/opt/duoauthproxy/log/authproxy.log
6.4 Linux firewall
Allow UDP/1812 only from the ASA. The exact command depends on the host firewall. For UFW:
sudo ufw allow from
NOTE: On SELinux systems, follow Duo’s installer prompts for its SELinux module if the host runs or may later run SELinux in enforcing mode.
7. Configure authproxy.cfg
The core configuration is the same on Windows and Linux. The following example uses Active Directory for primary username/password authentication and Duo RADIUS Auto for MFA.
7.1 Recommended AD-backed example
[ad_client]
host=xxx.xxx.xxx.xxx
host_2=xxx.xxx.xxx.xxx
service_account_username=svc_duo
service_account_password=
search_dn=DC=example,DC=com
[radius_server_auto]
ikey=DIXXXXXXXXXXXXXXXXXX
skey=
api_host=api-XXXXXXXX.duosecurity.com
radius_ip_1=
radius_secret_1=
client=ad_client
port=1812
failmode=secure
If there is only one domain controller, omit host_2. A security_group_dn may also be used to restrict primary authentication to direct members of a designated AD VPN group.
7.2 failmode choice
Setting Duo behavior when cloud is unreachable Use case
secure Reject authentication Recommended when MFA must never be bypassed
safe Permit if primary authentication succeeds Availability-first design; weaker MFA guarantee
NOTE: Duo’s default is failmode=safe. This guide intentionally shows failmode=secure as a security-focused deployment choice; choose based on your organization’s outage policy.
7.3 Protect configuration secrets
On Windows, Duo supports protected/encrypted configuration values. On Linux, Duo does not provide the same password encryption utility; protect authproxy.cfg with strict filesystem ownership and permissions.
sudo chown
sudo chmod 600 /opt/duoauthproxy/conf/authproxy.cfg
8. Validate and Start the Proxy
Windows
authproxyctl start
authproxyctl restart
Connectivity tool:
“C:\Program Files\Duo Security Authentication Proxy\bin\authproxy_connectivity_tool.exe”
Linux
sudo /opt/duoauthproxy/bin/authproxyctl start
sudo /opt/duoauthproxy/bin/authproxyctl status
sudo /opt/duoauthproxy/bin/authproxyctl restart
sudo /opt/duoauthproxy/bin/authproxy_connectivity_tool
Review authproxy.log after startup and after every test authentication.
9. Configure the Cisco ASA
The example below uses an AAA server group named DUO. Substitute the ASA interface, proxy address, shared secret, and tunnel-group name for your environment.
9.1 Add the Duo RADIUS AAA server
configure terminal
aaa-server DUO protocol radius
aaa-server DUO (inside) host
authentication-port 1812
accounting-port 1813
timeout 60
key
end
NOTE: Duo recommends allowing at least 60 seconds for out-of-band factors such as Duo Push or phone callback. RADIUS accounting is not supported by the Authentication Proxy even though the ASA configuration may show port 1813.
9.2 Test AAA before changing the VPN
From ASA CLI, use the ASA’s AAA test syntax supported by your release, or use ASDM’s Test AAA Server function. Confirm:
• Primary AD password succeeds.
• Duo Push/callback/passcode is triggered.
• Successful approval returns an Access-Accept.
• A bad password or denied Duo request returns a reject.
9.3 Assign Duo to the remote-access tunnel group
configure terminal
tunnel-group “
authentication-server-group DUO
end
Verify:
show running-config all tunnel-group “
show aaa-server DUO
NOTE: Do not enable a LOCAL fallback merely for convenience unless you intentionally want a bypass path. A fallback authentication path should be designed, restricted, tested, and documented.
10. Test End-to-End
9. Keep a separate administrative/recovery path to the ASA while testing.
10. Connect with Cisco Secure Client to the intended connection profile.
11. Enter the user’s normal directory username and password.
12. Approve the Duo factor.
13. Confirm the VPN connects and receives the expected address and group policy.
14. On the ASA, verify the live session and RADIUS transaction.
show vpn-sessiondb anyconnect
show aaa-server DUO
15. Review authproxy.log on the Duo proxy.
16. Only after a successful test, save the ASA configuration.
write memory
11. High Availability / Two Proxy Servers
For production environments, deploy two Authentication Proxy servers when practical. Configure the same Duo application and equivalent authproxy.cfg logic on both proxies, but allow both proxy IPs through host firewalls and configure both as AAA servers in the ASA DUO server group. This removes the proxy host as a single point of failure.
NOTE: Keep the RADIUS shared-secret mapping consistent with the corresponding radius_ip entries. Test each proxy independently before relying on failover.
12. Optional Hardening: Client Certificate + Duo
For Internet-facing ASA VPNs, Duo MFA by itself does not necessarily prevent password spraying against the primary directory password: the Authentication Proxy may validate the primary password before Duo MFA occurs. A stronger design is to require a trusted client certificate at the ASA before AAA/Duo authentication.
Client certificate
↓
ASA validates certificate against private enterprise CA
↓
Directory username/password
↓
Duo MFA
↓
VPN connected
On ASA releases that support combined authentication for the connection profile, the tunnel-group webvpn configuration can require both AAA and certificate authentication. Example syntax:
configure terminal
tunnel-group “
authentication certificate aaa
end
The ASA may display the saved form as ‘authentication aaa certificate’. Use a dedicated enterprise client CA trustpoint with client validation usage, and restrict unrelated public/server trustpoints so they are not accepted for VPN client certificate validation.
NOTE: Certificate pre-authentication is an additional hardening layer, not a prerequisite for the basic Duo RADIUS deployment. Test certificate enrollment and maintain a recovery path before changing a production tunnel.
13. Troubleshooting
Symptom Check
No Duo prompt – Check ASA AAA server status, UDP/1812 reachability, radius_ip/radius_secret match, and authproxy.log.
Immediate reject – Check AD credentials, search_dn, service-account bind, Duo user/application access, and policy.
Timeout after ~10-15 seconds – Increase ASA/Secure Client authentication timeout; Duo recommends at least 60 seconds.
Proxy will not start – Run the connectivity tool and inspect authproxy.log; validate section names, ports, and duplicate listeners.
Works from one ASA but not another – Add the second ASA as radius_ip_2/radius_secret_2 or an appropriate separate server section.
AD account locks out during Internet spray – Consider ASA client-certificate pre-authentication and rate/block controls; MFA happens after primary password validation in this architecture.
14. Operational Checklist
• Back up authproxy.cfg securely after every approved change.
• Keep Duo Authentication Proxy software and the host OS supported and patched.
• Monitor authproxy.log and ASA AAA reject rates for abnormal authentication activity.
• Use NTP on the ASA, proxy, and domain controllers.
• Document RADIUS secrets in an approved password vault, not in the runbook.
• Test proxy failover periodically if two proxies are configured.
• Review Duo application access and policies when staff roles change.
• For certificate-preauthenticated VPNs, document certificate issuance, renewal, revocation, and CA recovery procedures.
15. Reference Configuration – Quick Copy
Duo Authentication Proxy
[ad_client]
host=
host_2=
service_account_username=
service_account_password=
search_dn=
[radius_server_auto]
ikey=
skey=
api_host=
radius_ip_1=
radius_secret_1=
client=ad_client
port=1812
failmode=secure
Cisco ASA
aaa-server DUO protocol radius
aaa-server DUO (inside) host
authentication-port 1812
accounting-port 1813
timeout 60
key
tunnel-group “
authentication-server-group DUO
This runbook was checked against current vendor documentation on September 3, 2026:
• Cisco Duo – RADIUS 2FA for Cisco ASA SSL VPNs
https://duo.com/docs/ciscoasa-radius
• Cisco Duo – Authentication Proxy Reference
https://duo.com/docs/authproxy-reference
• Cisco Duo – RADIUS Two-Factor Authentication with Primary Authentication
https://duo.com/docs/radius