topic Re: VPN Web Interface Configuration in Network Security

VPN Web Interface Configuration

m.santangelo — Fri, 21 Feb 2020 17:54:30 GMT

Hello all,

We have a Cisco Firepower 2140 and it is running VPN services for us. It is configured such that we can go to https://<hostname>/+CSCOE+/logon.html#form_title_text and login to get the client.

However, the problem is the SSL certificate for that hostname and address appears to be self-signed certificate. I'm trying to replace it with our domain wildcard certificate, however I can't seem to find the settings for it.Firewall

Any advice?

Re: VPN Web Interface Configuration

Rob Ingram — Mon, 10 Feb 2020 15:39:58 GMT

Hi,
Are you running ASA or FTD code on this appliance?

Re: VPN Web Interface Configuration

m.santangelo — Mon, 10 Feb 2020 16:12:04 GMT

It's running the FTD code, I believe.

Re: VPN Web Interface Configuration

Marvin Rhoads — Mon, 10 Feb 2020 16:47:36 GMT

If you're running Firepower Threat Defense (FTD), you set it as follows:

1. FMC-Managed: Devices > VPN > Remote Access. Select and edit the VPN Profile. Access Interfaces tab and specify the "SSL Global Identity Certificate" there. Save and deploy.

2. FDM-Managed: Device Monitoring > Remote Access VPN. Select and edit the VPN Profile. Click Nex, next and then choose "Certificate of Device Identity". Then Next > Finish and then Deploy.

If you're running ASA image then set it as described in detail here:

https://www.cisco.com/c/en/us/support/docs/security-vpn/public-key-infrastructure-pki/200339-Configure-ASA-SSL-Digital-Certificate-I.html#anc12

Re: VPN Web Interface Configuration

m.santangelo — Mon, 10 Feb 2020 17:14:46 GMT

Interesting, in the FMC that's where I have it configured, but it's still showing the old certificate, even after being deployed. I had to upload the certificate to Devices -> Certificate first, in order to get it in the Global Identity Certificate drop down though.

Re: VPN Web Interface Configuration

Marvin Rhoads — Mon, 10 Feb 2020 17:54:38 GMT

That's odd. I've deployed several remote access VPNs on FMC and they all worked as advertised vis-a-vis the certificate.

Certificates aren't generally cached so it shouldn't be necessary to clear client browser cache etc. when replacing the identity certificate.

You might want to open a TAC case so that the engineer can have a look in real time with you.

Re: VPN Web Interface Configuration

m.santangelo — Mon, 10 Feb 2020 18:05:07 GMT

Thanks for your help! We'll enter a case with TAC. Thankfully it's not a huge issue, just trying to unify the environment.