About cfitzgerald

cfitzgerald · 01-06-2021

I have been messing around with some VPN AuthN and AuthZ using Cisco ISE and Microsoft NPS as RADIUS Token vs RADIUS External server. I've noticed that since I switched to this Token or External sequence, I no longer see any events in the RADIUS live...

cfitzgerald · 11-27-2020

We just purchased an additional 200 AnyConnect Plus licenses to go with the previous 25 we had before. I went into our Smart Account and converted the PAK to a SmartLicense, and the refreshed the Smart License in the FMC. However, I just can't figure...

cfitzgerald · 09-21-2020

I have a need to import large lists of IP address ranges for services from Microsoft, Zoom, WebEx, etc, so I can build rules around them. Is there any way to do this in FMC? I've read a little about the FirePower Migration Tool, but I don't have an A...

cfitzgerald · 08-28-2020

Hello all. I have a few AnyConnect VPN clients that are complaining about slow performance in certain apps. I'm pretty sure the issue is cause by the user's ISP service latency (70 ms) to my FTD, combined with some older, noisy apps (Lotus Notes). Ho...

cfitzgerald · 06-24-2020

I have been tasked with integrating AzureAD Cloud Multi-Factor Authentication (MFA) with our AnyConnect VPN authentication process. Please note we only have FTD OS firewalls. Guidance for this scenario on FTD OS does not seem to exist.The AzureAD MFA...

cfitzgerald · 01-11-2021

Yes, I am performing AuthZ on ISE as well. I had to reboot the appliance, and now the live logs are working again. Strange and worrisome.

cfitzgerald · 01-06-2021

One thing I will add here is that NPS has a limitation where it does not return any RADIUS attributes to the VPN client under certain MFA scenarios. We need to assign different AnyConnect Group Policies to different users, and this requires returning...

cfitzgerald · 01-06-2021

Yes, I was hopeful that FTD 6.7 would simplify our infrastructure with direct SAML support for VPN Auth. However, I have heard that AnyConnect does not support SAML for "Start Before Login". SBL is important for us, so we are going to have to keep NP...

cfitzgerald · 12-07-2020

@sysnet_striver Cisco ISE is not free. It is a licensed product and runs on its own separate server(s).You don't need ISE to integrate with Azure MFA. ISE is a RADIUS server, just like Microsoft's NPS server role. You will need an on-prem NPS server ...

cfitzgerald · 11-30-2020

Ah thank you. This is good to know.

Member Since	‎04-04-2018 02:53 PM
Date Last Visited	‎03-17-2021 06:35 AM
Posts	38
Total Helpful Votes Received	15

User Statistics

User Activity

ISE: No RADIUS Live Logs with External or Token RADIUS config

View the number of AnyConnect smart licenses in FMC

Firepower FMC FTD - Bulk import IP address ranges

FTD: AnyConnect VPN and Prefilter and/or Bypass Access Control Policy

FTD VPN - AnyConnect MFA and Start Before Login

Re: ISE: No RADIUS Live Logs with External or Token RADIUS config

Re: Firepower Threat Defense with Anyconnect and Azure MFA

Re: Firepower Threat Defense with Anyconnect and Azure MFA

Re: Firepower Threat Defense with Anyconnect and Azure MFA

Re: View the number of AnyConnect smart licenses in FMC