FTD Certificate Authentication - Remote Access VPN

[Kai Rong]

Hello experts,

We recently migrated from ASA to FTD (FMC managed) running 6.4 code. The remote access SSL VPN works great with a Public signed cert, however we are no longer able to authenticate another VPN profile designed for Cisco IP Phones that uses certificate based authentication.

Looking at the phone logs, it appears that the FTD only uses the public signed cert during the exchange, is there currently a limitation on the FTD that only allows 1 CA to be used for certificate based authentication? We imported the phone's CA under FMC> Devices > Certificates and verified it on the FTD's CLI. The only difference I noticed is that on FMC, due to the fact I manually imported the CA's cert, its asking me to install identity certificate as well, which I don't have, nor it was required on the legacy ASA platform.

Could someone point me to the right direction?

Thank you,

[Kai Rong]

After playing with GUI option for hours, I tried to deploy it using flexconfig and following the ASA syntax. It worked.. 

[Marvin Rhoads]

Thanks for the update.

Are you able to share the Flexconfig that you used? It would be a useful piece of knowledge for the community.