topic Re: FTD version 6.3 VPN in Network Security

FTD version 6.3 VPN

malikashraf — Mon, 06 Jun 2022 08:56:47 GMT

hey folks does anyone know we running FTD 6.3 FMC 6.3 and trying to create a certificate DN for authentication is the possible?

Thank you.

Re: FTD version 6.3 VPN

Rob Ingram — Mon, 06 Jun 2022 09:03:19 GMT

@malikashraf yes you can use certificate authentication when using FTD/FMC 6.3

https://www.cisco.com/c/en/us/td/docs/security/firepower/630/configuration/guide/fpmc-config-guide-v63/firepower_threat_defense_site_to_site_vpns.html

FYI, you should probably look to upgrade as 6.3 very old and there are considerably more features in newer versions, as well as bug fixes!

Re: FTD version 6.3 VPN

malikashraf — Mon, 06 Jun 2022 09:07:18 GMT

Hi Rob yes we know its old version and need upgrading. We are working on this with customer. however the requirement is Certificate DN for authentication is required

Re: FTD version 6.3 VPN

Mohammed al Baqari — Mon, 06 Jun 2022 09:09:19 GMT

Are you trying to generate a CSR? Didn't get the exact question.

Re: FTD version 6.3 VPN

malikashraf — Mon, 06 Jun 2022 09:11:23 GMT

@Mohammed al Baqariwe need a site-to-site VPN with Cert based but the customer requirement is it has to be on Certificate DN not on CN.

Re: FTD version 6.3 VPN

Marvin Rhoads — Mon, 06 Jun 2022 09:50:21 GMT

As Rob mentioned, you can use certificates (with associated certificate maps) for site-site VPN authentication. When using a certificate map you can use any field, including DN (Distinguished Name), to match on and authenticate.

https://www.cisco.com/c/en/us/td/docs/security/firepower/630/configuration/guide/fpmc-config-guide-v63/reusable_objects.html#id_42800

Re: FTD version 6.3 VPN

Sheraz.Salim — Mon, 06 Jun 2022 10:07:09 GMT

If i remember had a similar issue with FTD 6.3. we tried to make it work but it didnt later we opened a Tac case and the Nice guy at Tac engineer shared a snipping tool with us. 6.3 does not support DN cert authentication.