Cisco AnyConnect VPN FTD integration with Azure AD SAML

[devnetwise]

Hi fellow users, 

I'm running into an issue and I hope someone can help me in right direction.

I have configured Azure AD SSO and MFA together with Cisco AnyConnect VPN on FTD and it's working fine. I got two different internet connections for fallback if the primary line is down. How do I configure this kind of redundancy while integrating Cisco AnyConnect VPN with Azure AD SSO?

In Azure AD portal you add an enterprise application (Cisco AnyConnect in this case) and the an Azure AD Identifier is created and then we should enter base vpn url.

https://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/215935-configure-asa-anyconnect-vpn-with-micros.html

I have created two enterprise applications for Cisco AnyConnect with two different vpn base urls (one each for two different internet connections). 

On Cisco FMC I created two SAML SSO servers and want to create two VPN profiles one each for two different internet connections. When I try to deploy I'm getting an error that Azure AD Identifiers are identical! 

Can anyone help me how to solve this issue and maybe there is a better way to solve this issue. 

Sincerely,

Sal 

[Mohammed al Baqari]

Hi,

But why you create two SSO Idp objects.? You should create one for Azure
and use it in both VPN profiles. The Idp details will be same for both
profiles so you don't need to duplicate. You just need to reuse.

On Azure side keep both applications for different vpn urls but on FTD you
can use single SSO Idp and share it with both VPN profiles.

**** please remember to rate useful posts

[devnetwise]

Hi Mohammad,

Thanks for your reply. I have tried to leave the base url blank but when I try to connect to one of the two Cisco Anyconnect VPN URLs (https://ftd.lab.local and https://fallbackvpn.lab.local), it's giving a certificate error and it's stops working. The screenshot is just an example. I'm using a wildcard certificate signed by 3rd Party CA.

Regards,

Sal

[Mohammed al Baqari]

Ok, now I got your question. Try to leave it blank and it should pick the
FQDN from each FTD.


***** please remember to rate useful posts

[dtfletch83]

Hi Sal, 

I'm trying to do the same thing at the moment, how'd you end up getting around this?

I'm still in the planning stage for haven't tried any config just yet, but can you have multiple Entity ID and Reply URL's in one AAD Enterprise App?

eg. 

https://FTD1.test.com/saml/sp/metadata/<TUNNEL-GROUP>
and
https://FTD2.test.com/saml/sp/metadata/<TUNNEL-GROUP>

Alternatively, I assume using the override feature when you define the Single Sign-on Server on the FMC might also be an option?