Logging In With the Cisco AnyConnect Client

Depending on how your company configured Duo authentication, you may see the Duo Prompt, a “Passcode” field, or no additional passcode field when using the Cisco AnyConnect client.

Single Sign-On

If AnyConnect desktop or mobile uses single sign-on, you'll first see the login form for your identity provider, where you enter your username and password.

AnyConnect Desktop Client with SSO

After you submit your login information, you'll see the Duo Prompt, where you can choose from your available authentication methods to complete your login.

AnyConnect Desktop Client with Duo Universal Prompt

Single Password with Automatic Push

If AnyConnect only prompts for a password, like so:

AnyConnect Desktop Client with Single Password

AnyConnect Mobile Client with Single Password

After you submit your login information, an authentication request is automatically sent to you via push to the Duo Mobile app or as a phone call.

Alternatively, you can add a comma (“,”) to the end of your password, followed by a Duo passcode or the name of a Duo factor. Here's how:

Type... To...
password,passcode Log in using a passcode, either generated with Duo Mobile, sent via SMS, generated by your hardware token, or provided by an administrator.
Examples: mypass123,123456 or mypass123,1456789
password,push Push a login request to your phone (if you have Duo Mobile installed and activated on your iOS or Android device). Just review the request and tap "Approve" to log in.
password,phone Authenticate via phone callback.
password,sms Get a new batch of SMS passcodes.
Your login attempt will fail — log in again with one of your new passcodes.

You can also add a number to the end of these factor names if you have more than one device registered. For example, push2 will send a login request to your second phone, phone3 will call your third phone, etc.


Examples

To use Duo Push if your password is "hunter2", type:

hunter2,push

To use the passcode "123456" if your password is "hunter2", type:

hunter2,123456

To send new SMS passcodes to your second phone if your password is "hunter2", type:

hunter2,sms2

The comma is Duo's default separator character between your password and the Duo factor. Your administrator may have changed this to a different character. Be sure to follow the instructions sent to you by your organization if they differ from what's shown here.

Second Password for Factor Selection

If AnyConnect shows a "Second Password" input field (note that your AnyConnect administrator may have changed the "Second Password" label to something else):

AnyConnect Desktop Client with Second Password

AnyConnect Mobile Client with Second Password

Use the "Second Password" field to tell Duo how you want to authenticate. Here's how:

Type... To...
A passcode Log in using a passcode, either generated with Duo Mobile, sent via SMS, generated by your hardware token, or provided by an administrator.
Examples: 123456 or 1456789
push Push a login request to your phone (if you have Duo Mobile installed and activated on your iOS or Android device). Just review the request and tap "Approve" to log in.
phone Authenticate via phone callback.
sms Get a new batch of SMS passcodes.
Your login attempt will fail — log in again with one of your new passcodes.

You can also add a number to the end of these factor names if you have more than one device registered. For example, push2 will send a login request to your second phone, phone3 will call your third phone, etc.


Examples

To send a Duo Push request to your primary phone, type:

push

To send a Duo Push request to your secondary phone, type:

push2

To use the passcode "123456", type:

123456

To send new SMS passcodes to your second phone, type:

sms2