topic Re: Configure secondary-username-from-certificate in FTD? in Network Security

Configure secondary-username-from-certificate in FTD?

Chess Norris — Tue, 26 Jul 2022 14:37:44 GMT

Hello,

I am in the process of migrating ASA code to FTD (7.0.1) but there is one command in the ASA that I cannot figure out where to configure in FMC.

On the ASA I have the following RA VPN settings configured under tunnel-group general-attributes

authorization-required
secondary-username-from-certificate CN

In FMC RA VPN configuration under the "Edit connection profile" and the AAA tab, there is a setting called "Map username from client certificate" but I can not see any option to use "secondary-username-from-certificate"

Anyone know if that's possible?

Thanks

/Chess

Re: Configure secondary-username-from-certificate in FTD?

Marius Gunnerud — Tue, 26 Jul 2022 20:11:25 GMT

If the option is not in the GUI then you need to configure it via FlexConfig. But I would suggest testing this in a lab before doing it in production.

Re: Configure secondary-username-from-certificate in FTD?

Chess Norris — Wed, 27 Jul 2022 08:43:49 GMT

@Marius Gunnerud

I tried to find this option in the as a device manager, just to see exactly what's it called there and see if I can find something similar in FMC. The RA VPN parameters use similar names in ASDM and FMC, but I cannot find this option in ASDM either. This option must be available there, since the command is visible in the CLI. Has anyone configured this in ASDM and now where this option is located?

/Chess

Re: Configure secondary-username-from-certificate in FTD?

Marius Gunnerud — Thu, 28 Jul 2022 07:44:58 GMT

The ASDM does not support all configuration options for the ASA either. So, if that command is not present it just means it must also be configured using the CLI on the ASA

Re: Configure secondary-username-from-certificate in FTD?

Chess Norris — Fri, 29 Jul 2022 12:52:18 GMT

Yes, you are right about that. I found out that this command is a default command and only visible by the "show run all" command. The reason it was visible in the ASA cli code, was because someone have made a change to the default setting.

/Chess