Does FTD support authorization-required in tunnel.group ?

[ipagliani]

Ciao,

with AnyConnect with ASA using SAML I usually configure:

• AuthC with SAML
• AuthZ with ISE

Because I want to be sure that the AuthZ process goes successfully in order to connect I use the command authorization-required:

tunnel-group MFA general-attributes

authorization-server-group ISE

accounting-server-group ISE

authorization-required

tunnel-group MFA webvpn-attributes

authentication saml

Is this command supported on FTD (FMC and/or FDM managed)?

Otherwise, I have to configure a default-group with no access profile:

• A default-group-policy with vpn-filter DENY ACL (user still connected.. No good experience)
• A default-group-policy with vpn-simultaneous-logins 0

Any suggestion ?

Thanks

[balaji.bandi]

FTD 7.0 onwards authorization supported :

https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/216268-configure-anyconnect-with-saml-authentic.html

[ipagliani · Accepted solution]

 Ciao, let me explain a little more. In a configuration where authentication and authorization process is splitter, for example authentication with SAML and authorization with RADIUS, during my testing lab I see that if the authentication works fine but authorization reply with an access reject, an Anyconnect  user is able to connect with the default group-policy configured on FTD. So  it's not mandatory for the authorize-only config to replay with ACCESS-ACCEPT. 

With ASA I configure the authorization-required command to force a good response for the authorization. But I didn't find it in FTD.

Thanks

[ipagliani · Accepted solution]

Resolved !!!