FTD VPN - AnyConnect MFA and Start Before Login

[cfitzgerald]

I have been tasked with integrating AzureAD Cloud Multi-Factor Authentication (MFA) with our AnyConnect VPN authentication process. Please note we only have FTD OS firewalls. Guidance for this scenario on FTD OS does not seem to exist.

The AzureAD MFA process requires that a browser be invoked so that the user can complete the MFA process.

• I know that the AC 4.6 embedded web browser does not work for Start Before Login (SBL)
• But can AC invoke the native OS browser during SBL?

Thank you in advance.

[DrewKling]

I am wondering the same thing, have you found an answer to this?

[Marvin Rhoads]

FTD 6.7 will introduce support for SAML-based authentication, often used with Azure AD. I have not had the opportunity to test the beta with SBL but the version should be publicly available soon and hopefully we will have some trailblazers test it out.