Anyconnect/Firepower/ACS/Tacacs+/Radius?

[Larry Sullivan]

Hi,

I'm setting up Anyconnect on a new firepower deployment (6.4).  My understanding is Anyconnect uses Radius.  We have ACS 5.8 setup as TACACS+ server already.  I read that Radius proxy on ACS can proxy to other authentication methods externally.  So I'd like to clarify, I can't set up a Radius proxy to the TACACS+ on the ACS correct?  Is there a workaround that doesn't require an external Radius server.  Something that will allow Anyconnect to use ACS only?  Thank you.

[balaji.bandi]

If I understand your requirement correctly, you want to Anyconnect user to use ACS as an authentication mechanism

Does intern ACS need to get authentication external source like LDAP ? is this correct?

[Larry Sullivan]

Yes.  I want Anyconnect to use ACS to authenticate VPN users.  Currently ACS uses active directory for credentials.

[balaji.bandi · Accepted solution]

here is the good presentation to understand and implement the same,

https://www.ciscolive.com/c/dam/r/ciscolive/us/docs/2019/pdf/BRKSEC-2112.pdf

[Larry Sullivan]

I think I found out what I need to do.  Looks like I need to just create a RADIUS instance pointing at AD.  I will definitely be referencing that document you linked as well.  Thanks.

[balaji.bandi]

Glad it was helpful if the solution offered to work and tested, mark as resolved.