DUO Security Proxy servers in HA configuration
Has anyone setup HA for the DUO Proxy servers? I don't believe I can use the Radius iApp due to the specific port per DUO application(s)? I can successfully create a radius server with a "direct" server connection association to a single node (DUO Auth Proxy). However, I've been unsuccessful at setting up a HA configuration to include a second DUO Auth Proxy server. I've tried the following manual configurations (both failed): 1. Updated the "direct" server connection to point to a VIP (instead of a node) whereas the VIP was associated to a pool of DUO Auth Proxy servers. Failed (no response from server) 2. Created a new radius server referencing the pool of DUO Auth Proxy servers (not direct server connection). Essentially removing the VIP. Same error as above. *** The pool I used has Priority Grouping to prioritize its local site DUO Auth Proxy server unless its unavailable, then do to the other datacenter for DUO Auth Proxy. I have not setup a persistence profile due to the priority grouping. But, I will try that today. Hoping someone has tried setting up DUO Proxy HA and can provide any helpful insight. Thank you in advance. ~Jeff
F5 APM /w ADFS login page
Hi all, I'm fairly new to working with APM (and ADFS/SAML in general) so I was wondering if someone could help me figure out what I'd need to accomplish the following: APM Policy: Start -> ADFS login page (note 1) -> MFA verification (note 2) -> Assign SSO properties -> Allow The stumbling block I'm currently at is I don't know how to configure either ADFS, or APM, to present the ADFS authentication portal for APM. Any hints or resources that can be used to accomplish this would be greatly appreciated! Notes: 1: The ADFS login page, not the APM login page. Our CIO specially wants the ADFS login page to be our only authentication portal. 2: We are using DUO for MFA; I'm guessing there's a way to pull the necessary information on to some sort of landing page in order to accomplish this, like in the example that DUO gives for working with APMBIGIP IdP, SP, Webtop?
I have read documentation but I started to get confused with what I need. I am trying to build a webportal (webtop) on my edge to allow access to protected systems. The Webtop will present the BIGIP portal to authenticate and force MFA with DUO and create the assertions for the protected systems on the back side of BIGIP that are SAML based. What would be the configuratio required to accomplish this? Do I need to make BIGIP act as IdP, or SP or both? or Federate BIGIP portal? Is there any documentation?
Sharepoint+AD+DUO
Hi all, I have created an APM policy for sharepoint which is AD + DUO. This works correctly, the problem I have is that when I enter sharepoint it has embedded applications that all respond to the same virtual IP. This causes that every time I change the application, it redoes the entire authentication process. Has it happened to someone? Do you know if there is some way of not asking for authentication if we have already authenticated once? Thank you very much, Regards Marta MarcosCitrix iapp + DUO 2 factor auth
I have a working Citrix iapp solution, APM is standard. I need to add 2 Factor authentication for Citrix and for OWA. Owa is easy enough the duo implementation steps here work just fine. These steps make it easy for OWA: https://devcentral.f5.com/articles/integrating-duo-security-with-f5-big-ip-access-policy-manager But APM with citrix is different, especially using the iapp which breaks the citrix receiver and web access into different branches. Starting with the Web branch, I replaced the iapp/APM AD Auth with the DUO-Radius authentication. I can login successfully but the citrix page will loop with the error cannot connect to server.
F5 APM and DUO Security protecting external website access with 2FA
We want to protect external website's login page with 2FA using DUO Security. We already have similar setup for OWA which works OK but this is all internally. Our F5 APM is doing AD authentication and then opens DUO iFrame page with 2nd step options i.e. DUO Push. Once authenticated with DUO Push it opens OWA page, job done. I have now built another virtual server, using same AD authentication as in above example and I need to open external website with DUO iFrame to continue with authentication and login. How do I take it to external website, do I need new webtop pointing there?Citrix iapp + DUO 2 factor auth
I have a working Citrix iapp solution, APM is standard. I need to add 2 Factor authentication for Citrix and for OWA. Owa is easy enough the duo implementation steps here work just fine. These steps make it easy for OWA: https://devcentral.f5.com/articles/integrating-duo-security-with-f5-big-ip-access-policy-manager But APM with citrix is different, especially using the iapp which breaks the citrix receiver and web access into different branches. Starting with the Web branch, I replaced the iapp/APM AD Auth with the DUO-Radius authentication. I can login successfully but the citrix page will loop with the error cannot connect to server.
