AnyConnect Machine Cert Authentication

[gilbert.aispuro1]

Hello All!

I just purchased two FirePower 2110's and I just setup basic AAA Remote Access. I've actually been getting the run-around with Cisco on trying to figure out how to configure AnyConnect to authenticate with a Machine Certificate instead. 

Is anyone aware if this is possible?

If so, can anyone help out?

If not, why can't I and what can I do to do this?

[Muhammad Awais Khan]

Hi,

you can choose authentication method as client certificate only to achieve this under Remote access VPN configuration.

You currently are using PKI Server in your environment ? One of the limitation is that Firepower itself cannot be CA Server.

for limitations:

https://www.cisco.com/c/en/us/td/docs/security/firepower/630/configuration/guide/fpmc-config-guide-v63/firepower_threat_defense_certificate_based_authentication.html#id_41510

for configuration:

https://www.cisco.com/c/en/us/td/docs/security/firepower/630/configuration/guide/fpmc-config-guide-v63/firepower_threat_defense_remote_access_vpns.html

[gilbert.aispuro1]

Yes, we will be creating certs ourselves from a server we manage. 

As far as the "Client Certificate" is that client as in User or just client as an endpoint device? That would suck if it doesn't support Computer Certificates. 

If it doesn't support Computer Certs, would adding the ASA package resolve this?