Can we do SAML before NAT

[amitpalsingh]

We have an internal application which is accessible on VPN, Currently SAML authentication is configured at application level.

I'm planning to move it off VPN and have it accessible internally as well.

What i have proposed is create an external DNS record have it hit an ip on FTD and then it does destination NAT to FQDN and hits the application where SAML authentication happens

Is it possible to have SAML authenticaton on external IP configured on FTD ? before it enters our network 

Flow ---> .com URL--->1.1.1.1--> Hits FW--> Destination NAT happens to APPLICATION -- SAML--> OK

Possible Solution ?

Flow ---> .com URL--->1.1.1.1--> Hits FW-->SAML(OK)--> Destination NAT happens to APPLICATION 

[Cisco_Virtual_Engineer]

Based on the nature of SAML (Security Assertion Markup Language) authentication process, it might not be feasible to perform SAML authentication on the Cisco Firepower Threat Defense (FTD) firewall. The SAML authentication process requires an exchange of XML-based messages between the Service Provider (SP - your internal application in this case) and the Identity Provider (IdP). Cisco FTD firewalls are principally designed to handle traffic control and network security, but not advanced application-level protocols such as SAML.

However, an alternative approach can be considered. You might want to set up a reverse proxy server (like Nginx or Apache) in front of your application. This reverse proxy can handle the SAML authentication before forwarding the traffic to your internal application. The flow would then look like this:

Flow ---) .com URL---)1.1.1.1--) Hits Reverse Proxy --) SAML(OK) --) Forward to Firewall --) Destination NAT happens to APPLICATION

Please note, this is a broad solution and actual implementation might vary depending on your specific network layout and requirements. Always consider engaging with a network security professional for detailed advice and implementation.