Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 20 replies
  • Answers 3 answers
  • Subscribers 29 subscribers
  • Views 8719 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Duo Integration with Sophos XG for 2FA

Tobi Babatunde

Hello,

I have integrated Cisco Duo with Sophos XG (running firmware 18.01), but have issues with SSL VPN. My AD is my Primary authentication method, while Duo is my second factor authentication. When I test connection, all works well.

I have changed the SSL authentication method to use Duo first, when I try to VPN, I do receive a PUSH which I approve, but still fails (wrong username or something like that). I see it on Duo as successful, but still would not work.

Has anyone done this integration recently on firmware 18 now that we can set timeout values.

Thanks.



This thread was automatically locked due to age.
  • 0 in reply to JasP

    Thanks JasP, thanks Lucar Toni. I believe the issue I am facing from what I have read from you both is having Duo act as a radius server, and Sophos XG not been able to send attributes to it. I'd integrate Duo as an LDAP and not a Radius Server to Sophos and see if that works well. I am trying to avoid having an NPS as radius server except if there is no other way.

    I'd definitely update soon guys.

    Thanks again.

  • FormerMember
    0 FormerMember in reply to Tobi Babatunde

    Hi ,

    I would check if OTP is configured for SSL VPN on the XG firewall. If you are going to use Duo for OTP, disable OTP from XG for SSL VPN. Navigate to Authentication > One-time password > Settings > Enable OTP for facilities. 

    I have recently worked on an issue similar to yours, and it was caused by having OTP selected for the service on the firewall. 

    Thanks,

  • 0 in reply to FormerMember

    Thanks H_Patel.

    I am noting that also, and would revert back.

  • 0 in reply to LuCar Toni

    Thanks Lucar Toni, adding the user to the VPN group was all that was needed.

    Many thanks for your help.

  • 0 in reply to Tobi Babatunde

    If you have time, there is a way to contribute back to us, and write a recommend read for others! 

    Maybe we can assist to write up the DUO Integration? 

  • 0 in reply to LuCar Toni

    I'd be glad to do that. Please let me know how and when?

  • FormerMember
    0 FormerMember in reply to Tobi Babatunde

    Hi ,

    I'm following up with you via PM on this. 

    Thank you  for your suggestion!

    Thanks,

  • 0 in reply to FormerMember

    Did this write up ever happen? At the Sophos end, did you setup the DUO Proxy as an LDAP server or an AD server?

    I can get DUO proxy to work as an AD server in Sophos but not as an LDAP server. Unfortunately I want to retain my principal AD server setup and add DUO Proxy as an additional authentication server (using a different port). Sophos won't allow me to have two AD servers on the same IP so I need to run the DUO Proxy as an LDAP server in Sophos and I can't get it to work.

    I'll start a new post with the issue I'm facing but before I did I wondered if this ever got written up so I can have a look first.

  • 0

    Hi,

    I've had that problem to, its solvable.

    First Duo Authentication Proxy = Radius server and AD Client, so al your AD request could go through Duo AP. You don't need NPS or a AD server in the firewall. Groups are something more difficult, this because Duo AP does not do groups. And the groups from the AD are not respected. Basically you need to choose.

    When you choose Duo AP, then under groups, make your VPN Users group and give the group policy access to vpn. In Authentications -> Services Under Firewall Authentication you can set a default group, make this your new VPN users group.

    Now if an unknow or new user to the firewall logs on, they will be placed in that group, and vpn access is possible, it then goes through the proxy and ad to sign the user on.

    This has a disadvantage, all user trying to logon will be placed in this group. But authentication based on AD groups can be managed in the Dou Admin portal, if you have the paid option.

    Option 2: you can add this line to [ad_client] section of your Dou PA config file: security_group_dn=CN=DuoVPNUsers,OU=Groups,DC=example,DC=com of course correcting it to the vpn user group in the AD, this wil solve the lack of groups sync in the Radius/Duo setup.

    As  sad, you can not mix Radius Authentication and AD Groups, they have different paths to the same data, but will be treated ad different sources.