topic Configuring CRL FTD FDM in Network Security

Configuring CRL FTD FDM

Jonathan Haldane — Fri, 02 Jun 2023 13:50:55 GMT

Using version v7.0.5 FDM (or any 7x) , is it possible to reference a certificate revocation List(CRL)?

For use with RA VPN (anyconnect / Secure Client). I know this is possible using FMC, however is this possible using FDM.

Re: Configuring CRL FTD FDM

Aref Alsouqi — Fri, 02 Jun 2023 15:05:19 GMT

I don't believe that is supported:

https://bst.cisco.com/quickview/bug/CSCvs19613

Even if you try to use the Flexconfig that wouldn't work as I remember the crypto command is a blacklisted command.

Re: Configuring CRL FTD FDM

MHM Cisco World — Fri, 02 Jun 2023 15:25:31 GMT

https://www.cisco.com/c/en/us/support/docs/security-vpn/public-key-infrastructure-pki/215850-certificate-installation-and-renewal-on.html

This certificate for FTD via FDM.

Can you more elaborate about CRL?

Thanks

MHM

Re: Configuring CRL FTD FDM

Jonathan Haldane — Fri, 02 Jun 2023 15:46:16 GMT

Using a 2100 series firepower with only GUI FDM for Remote Access VPN with anyconnect/secure client authenticated using Client Certificates only.

If we needed to revoke a client certificate (lost laptop etc). Visibility of the CRL would enable the Firepower to know that this client certificate had been revoked. If there is no mechanism for CRL that would remove client certificate only as an option.

The next best option would be AAA (SAML, LDAP, RADIUS etc) & client certificate

Re: Configuring CRL FTD FDM

Aref Alsouqi — Fri, 02 Jun 2023 16:08:14 GMT

If you should enable SAML on the FDM, please be aware that the FDM will error out when you try to push the changes if the SAML certificate has the "ca-check" enabled. Unlike the FMC, the FDM does not have any option to turn that feature off, and the Flexconfig won't allow you to do it due to the crypto command being blacklisted. So in that case you would need to use a third party tool such as OpenSSL or XCA to generate a new cert and its private key, disable the ca-check, import the cert and the private key into Azure, and finally import the cert into FDM.

Re: Configuring CRL FTD FDM

Jonathan Haldane — Fri, 02 Jun 2023 16:17:35 GMT

Thanks Aref, I have already come across that issue. XCA worked a treat.

Regards,
Jonathan