topic Re: FTD 1010 Base User Authentication Certificate in Network Security

FTD 1010 Base User Authentication Certificate

saids3 — Sat, 20 May 2023 06:53:40 GMT

I have FTD 1010 without center interface basically not connected to management Center interface just locally - I have configured the anyconnect and working perfectly in AAA authentication. I need to switch to certificate authentication without having to enter any password…. If you would help with clear instructions please.

Re: FTD 1010 Base User Authentication Certificate

Rob Ingram — Sat, 20 May 2023 07:52:40 GMT

@saids3 there doesn't appear to be a cisco guide for certificate authentication on FDM.

Under the Client Configuration, change the Authentication Type to Client Certificate Only

The user/computer will need a user/machine certificate, which is trusted by the FTD. Go to Objects > Object Types > Certificates to configure the certificates.

Re: FTD 1010 Base User Authentication Certificate

saids3 — Sat, 20 May 2023 09:52:19 GMT

Thank you Rob - I will check it and keep you informed

Re: FTD 1010 Base User Authentication Certificate

MHM Cisco World — Sat, 20 May 2023 10:25:15 GMT

https://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/217966-configure-anyconnect-certificate-based-a.pdf

Re: FTD 1010 Base User Authentication Certificate

saids3 — Sat, 20 May 2023 11:14:05 GMT

Rob - worked very well - much appreciated - just one more thing I need to disable the pop-up during the connection (Group).

Re: FTD 1010 Base User Authentication Certificate

Rob Ingram — Sat, 20 May 2023 11:38:45 GMT

@saids3 create an anyconnect profile that connects to the specified group alias/url, this must be deployed to the users' devices.

Open the Secure Client VPN Editor (separate installation file, download from the cisco site). Go to server list and add an entry. Specify your FQDN and User Group (alias/url). Then save the configuration file to C:\ProgramData\Cisco\Cisco Secure Client\VPN\Profile and restart the client.

Re: FTD 1010 Base User Authentication Certificate

MHM Cisco World — Sat, 20 May 2023 11:22:00 GMT

https://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/215532-configure-remote-access-vpn-on-ftd-manag.html#anc12

I view that you not use FMC you use FDM, please check link

Re: FTD 1010 Base User Authentication Certificate

saids3 — Sat, 20 May 2023 12:07:53 GMT

This is my normal xml but still getting the group - can you have a look?

Re: FTD 1010 Base User Authentication Certificate

Rob Ingram — Sat, 20 May 2023 12:14:31 GMT

@saids3 thats because you haven't defined the group like I said you needed to.

<ServerList>
<HostEntry>
<HostName>TEST</HostName>
<HostAddress>TEST.TEST.COM</HostAddress>
<UserGroup>HOMEVPN</UserGroup>

Re: FTD 1010 Base User Authentication Certificate

saids3 — Sun, 21 May 2023 08:18:20 GMT

Rob - just sharing for everyone - I have added the group. please see attached photo - working perfectly