Cisco firepower - remote access VPN for child domains

[carl_townshend]

Hi All

I have recently deployed a Firepower appliance using cdFMC, we have moved away from our old ASA.

Part of this was to allow remote access VPN, I set up a realm which was for a domain, our domain has child domains and as such on the ASA we use to use LDAPS on a global catalogue port 3269

In the Firepower, I believe the setting does not allow us to use this port and only allows normal LDAP on port 636.

In this case will my child domains not work? will I need to add multiple realms?

Cheers

[Sheraz.Salim]

Firepower does not track parent/child relationships between domains which means that users in child domains may not be recognized by policies configured for the parent domain Here . To address this limitation, you will likely need to create multiple realms for each child domain in addition to the parent domain. This approach allows you to explicitly define each domain structure and ensure proper authentication for remote access VPN users across your entire domain hierarchy Here 

[carl_townshend]

Hi Sherez, I have added the top domain and used global catalogue port 3269, (though apparently not supported), it appears to work just fine.