FTD Certificate Authentication - Remote Access VPN

Kai Rong — Fri, 21 Feb 2020 17:34:36 GMT

Hello experts,

We recently migrated from ASA to FTD (FMC managed) running 6.4 code. The remote access SSL VPN works great with a Public signed cert, however we are no longer able to authenticate another VPN profile designed for Cisco IP Phones that uses certificate based authentication.

Looking at the phone logs, it appears that the FTD only uses the public signed cert during the exchange, is there currently a limitation on the FTD that only allows 1 CA to be used for certificate based authentication? We imported the phone's CA under FMC> Devices > Certificates and verified it on the FTD's CLI. The only difference I noticed is that on FMC, due to the fact I manually imported the CA's cert, its asking me to install identity certificate as well, which I don't have, nor it was required on the legacy ASA platform.

Could someone point me to the right direction?

Thank you,

Re: FTD Certificate Authentication - Remote Access VPN

Kai Rong — Fri, 11 Oct 2019 00:50:35 GMT

After playing with GUI option for hours, I tried to deploy it using flexconfig and following the ASA syntax. It worked..

Re: FTD Certificate Authentication - Remote Access VPN

Marvin Rhoads — Fri, 11 Oct 2019 10:20:56 GMT

Thanks for the update.

Are you able to share the Flexconfig that you used? It would be a useful piece of knowledge for the community.

topic Re: FTD Certificate Authentication - Remote Access VPN in Network Security

FTD Certificate Authentication - Remote Access VPN

Re: FTD Certificate Authentication - Remote Access VPN

Re: FTD Certificate Authentication - Remote Access VPN