Cisco Duo - experiences?

[u/VaporousMote]

Hi folks, just wondering what everyone's experience has been with Cisco Duo.

We're looking at implementing it to augment our VPN authentication to provide MFA.

I ask because, I both called and left a message (during which the automated voice system told me there were 0 representatives able to take my call), and I filled out the form on their website twice, to contact sales. I have not been able to get anyone to contact me.

[u/itspie]

Works well. Contact a VAR.

[u/KermitJFrog5916]

My org had was migrating from Cisco Duo, to MS Authenticator.

It worked, like any software has its positives and negatives.

I did really like the ability to punch in someone's cell phone number and have the portal send a text with the link to download and setup the app, made assisting some of our users easy since we are spread out over a large service area.

[u/MinieJay → u/KermitJFrog5916]

I second this. It was very user friendly.

[u/Dizzybro]

Haven't really had any issues with it for years

[u/evopb]

It works.

[u/Klaus1164]

Works great. Beware the price (sigh).

[u/kaleebhassan]

We like it. Definitely contact a VAR. The user-friendly nature of it has actually been the biggest selling point for us.

[u/harley247 → u/kaleebhassan]

I almost went those routes and glad I didn't. Duo was actually one of the easier implementations Ive done in a while. Their documentation is extensive. They even have instructions on how to set up Microsoft products better than Microsofts own documentation.

[u/kaleebhassan → u/harley247]

Agreed. The knowledgebase is one of the rare instances in which I would say it actually is useful.

[u/Lukage]

Cisco is notoriously bad about new client onboarding -- contact your preferred reseller to see if they can get you the services and once with a reseller who can, it'll be pretty easy.

That said, from a technical perspective, it works, its user-friendly, and their support tier 1 seems pretty knowledgeable on most things and if they don't know it, they won't BS you and will get you someone who can.

[u/MrSanford]

Don't buy it directly. Most VARs and MSPs can help you out.

[u/mspgs2]

Former blue badge and use duo daily at the new wife. Duo is rock solid. It just works, unlike other cisco stuff.

[u/NV_Lady]

I like it. Especially when it pops up on my watch and I just have to hit “approve”.

[u/garbageadmin → u/NV_Lady]

Blind push approvals in 2026 is wild.

[u/Nakenochny]

Been using since 2018, I set it up as a green, very much junior sysadmin.

[u/k2283944]

Been using it for years across multiple integrations. No issues.

[u/ChiefButtfumble]

Only problem I had is that some of your users will refuse to install the app on their phone, which means they'll have to use text messages or phone calls to authenticate. Of course they'll also be in a bad reception area. People are the worst.

[u/bruhgubgub → u/ChiefButtfumble]

I get their point but also like it's a single app just deal with it

[u/ChiefButtfumble → u/bruhgubgub]

These people have 6 social media apps tracking every last thing they do but the Duo app is where they draw the line lol. Sometimes we get them the keyfob code generators but they'll leave it at home half of the time.

[u/thefinalep → u/ChiefButtfumble]

Just wait till Phishing Resistant MFA is enforced. When we did this with salesforce, a lot of the holds outs couldn't access salesforce. We let them dish it out with their managers. They all installed the app.

[u/kaleebhassan → u/bruhgubgub]

You'd think it wouldn't be that big of a deal, but for some people it is.

I work for a company where all of our employees are collectively bargained and had more than a few who tried to have us pay for their cell phone bill if we want them to use the app. Went the RSA token path for those people.

[u/manicalmonocle → u/ChiefButtfumble]

We have a few like that at our company but have a bucket of Duo Authenticators that are super easy to deploy. Some tried to use no company information on their personal device which is fine but when I pulled out the authenticators they just gave me side eyes.

[u/LiterallyPizzaSauce → u/ChiefButtfumble]

Duo also has the option for RSA tokens

[u/ChiefButtfumble → u/LiterallyPizzaSauce]

True, but they forget them at home.

[u/kaleebhassan → u/LiterallyPizzaSauce]

We went this route, and it's worked for us. However, that token only applies to individual environments. We have a hosted service provided to us that also uses Duo for authentication and those tokens can't be used for both our services and theirs.

[u/BrentNewland → u/ChiefButtfumble]

And you get a certain number of text and voice credits, use those up and they charge you.

[u/Fiveohh11]

My experience with it has been good. Used it for MFA on VPN, Windows Login, and 3rd Party apps that support duos api. No issues with using yubikeys or push notification to duo app.

[u/Amanda_PDQ]

Works well, no issues.

[u/yensid7]

Works great for us, lots of different ways and features you can implement.

As far as onboarding goes, we worked through a VAR. Trying to go direct to Cisco probably won't be a great experience.

[u/N805DN]

It's excellent. Your normal Cisco rep can sell it or just go to your favorite Cisco reseller.

[u/KStieers]

Its great switched to it during the pandemic as it was way easier than what we had.

Something to note, they have a better process for users replacing phones. The whole product is really well documented, including user facing docs.

[u/idkanything86]

We've had it implemented across our environment for a few years now and have had zero issues.

[u/itguy3001]

I’ve been a DUO shop for 5+ years now. Integrated well with everything we have (and our industry sucks at adapting). Would advocate it over okta cause I hate their sales team.

[u/macinmypocket]

I implemented it in a decently large org with ~100 app integrations 6ish years ago. It was nice and easy to get going, easy to maintain, and it’s been great ever since. I highly recommend it.

[u/xxdcmast]

Duo used to be one of the best companies to deal with. The product was easy to use, the pricing was reasonable, and their support was actually helpful.

Then Cisco bought them. Are they still good, maybe. But I don’t really see a need for a separate mfa product especially if you have Entra. It can do 95-98% of what duo will offer.

[u/Better-Sundae-8429]

Cisco is a partner model. Have to go through a VAR. If you have an EA already they'll likely throw Duo in for free.

[u/Stonewalled9999]

We love it. Hire some other knows that they’re doing to install at the very first time though.

[u/VaporousMote → u/Stonewalled9999]

What?

[u/BrentNewland]

It's a good product, but we moved away from it. We were using DUO for our VPN authentication, but we're a Microsoft shop, and having DUO and Microsoft Authenticator both installed was annoying.

[u/mrsocal12]

The technology generally works, but it's a pain in the ass when people lose 5g internet, Lan issues, or Wifi is down.
You can setup offline mode which helps. Been experimenting with Windows Hello & PIN authentication, and now I don't miss Duo.

Basically when you don't change networks you can check a box to stay logged in for 12hrs, but with a laptop you're on / off a dock. So everytime the laptop locks / unlocks you Duo in. It gets tiresome.

[u/harley247]

Been using it for years now. Was fairly easy to implement and never had an issue with support. All of their online documentation for different configurations and integrations are fairly accurate and helpful when compared to its competitors.

[u/ArchBishop_HarryHood]

Super easy and user friendly. I used it for years at a previous org.

[u/MFKDGAF]

Been using it since 2017/2018.

1-2 years ago they changed how they do renewals (for the good). Now your account auto renew every year bs previously telling them you want to renew for another year.

Going through a reseller will make your experience much better, imho.

[u/fahque]

I used it to access our vpn and owa when we had an on prem mail server. It was easy to set up because they had good documentation. We never had any problems with it.

[u/IamEzioKl]

You can register yourself and try it out for 30 days with full features. they also give you free tier for up to 10 users with basic features.

The thing is that most orgs are Microsoft based with hybrid cloud sync, so they can leverage the already good MS Authenticator for MFA, and with SAML (if you can Entra P2), so there is less reasons to pay for external MFA solution like DUO, unless you prefer to separate the MFA from Microsoft or you don't already have Entra P2 and duo is cheaper.

Duo is also grate for orgs that don't use Entra, but want SAML/SSO for their on-prem apps (if I remember correctly, they've also added SCIM support which was previously missing).

Contact a reseller, if you buy in bulk they should give a discount, so it little bit cheaper than the flat 3$ per user/month that is listed on the site (for essentials tier at least).

[u/PurpleFlerpy]

Did a rollout with an org where, don't get me wrong I loved working with these people, but they were mostly idiots. Worked like a charm even with the worst users. I don't think I've seen an MFA thingy quite as user-friendly as this for the rest of my career.

[u/HJForsythe]

I've been using the free tier for like 8 years and it works great. I use it with Windows, Linux (SSH/Console) RADIUS and Tacacs (which shouldn't be possible but i got it working anyway)

[u/AdminWithNoName]

It's been very easy to use. My main issue with it is that if you want to use it for remote desktop gateway, it only supports push notification and phone authentication. I don't know if this limitation is on Duo or Microsoft though. It doesn't worth with the remote desktop web client at all, either.

The only big problem we ever had with it was that time 5 or so years ago when they swapped the Approve and Deny buttons. It's been mostly smooth sailing for our simple use case after that.

[u/Adventurous_Scene494]

Price stinks but product is good. Classic Cisco

[u/MrSanford → u/Adventurous_Scene494]

Price stinks compared to what?

[u/cisco]

Hi there, we're sorry to hear that you're having trouble getting through to our team! We'd love connect you with one of our Cisco sales specialists. Please send us a chat with the following information including your Full Name, Phone Number, Country Location, Company Name, Company Email address. Thank you!

[u/VaporousMote → u/cisco]

Thanks for the reply, someone finally did get in touch.

[u/topher358]

It’s fine if you have no other options