How to Modify Content-Security-Policy (CSP) for FTD Remote Access VPN

srajiwate — Thu, 13 Mar 2025 07:55:57 GMT

I am working on securing the WebVPN (AnyConnect SSL VPN) portal on a Cisco FTD managed via FMC. The current Content-Security-Policy (CSP) header includes weak directives like 'unsafe-inline' and 'unsafe-eval', which expose the portal to potential XSS attacks.

I attempted to modify the CSP using FlexConfig, but I found that FTD does not support the http-headers CLI command, unlike ASA. Additionally, I explored WebVPN customization settings in FMC, but there is no direct way to modify response headers.

To mitigate exposure, I applied the following FlexConfig command:

webvpn
keepout "503: Service Unavailable"

This resulted in the WebVPN page returning a 503 Service Unavailable response. However, despite this, our cybersecurity team is still flagging the service as vulnerable due to weak CSP headers being present.

Questions:
Is there any supported method in FMC or CLI to modify HTTP response headers (specifically CSP) for FTD WebVPN?
Are there alternative configurations within FMC to restrict inline scripts (unsafe-inline) and eval (unsafe-eval) in WebVPN?
Would using a reverse proxy (e.g., NGINX) in front of FTD be the best approach to enforce a stricter CSP policy?
Since webvpn keepout "503: Service Unavailable" blocks the page entirely, is there a better way to mitigate these findings while keeping the portal functional?

Any insights from the community would be greatly appreciated. Thanks in advance!

topic How to Modify Content-Security-Policy (CSP) for FTD Remote Access VPN in Network Security

How to Modify Content-Security-Policy (CSP) for FTD Remote Access VPN