Solved: Re: FTD w/FMC - AnyConnect with Umbrella

gilbert.aispuro1 · ‎08-05-2020

Hello All,

Has anyone successfully tried adding Umbrella module via FlexConfig? I'll be trying this soon but wanted to see what's been accomplished here.

FMC 6.6 btw.

FTD FP2110

gilbert.aispuro1 · ‎08-06-2020

Do you mind giving a brief overview of your install and what features are you using for NAM?

BTW, I was able to get AnyConnect and Umbrella module up and running by installing the Umbrella standalone .msi from the "pre-deployment" package and then pulling the OrgInfo.json from Umbrella and placing that file in the AC Umbrella directory of "C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client\Umbrella\". No FlexConfig necessary.

I've tested it and it's working just fine, blocking and filtering while VPN is off. I'll be deploying the setup this week to our clients so that I can have an "Always On" for Web Filtering and DNS Security.

View solution in original post

Mohammed al Baqari · ‎08-05-2020

Hi,

Not umbrella but I tried the NAM module and it worked fine (even without
FlexConfig). When the user connects, FTD will identify the agents installed
on the client and update the components accordingly from the pkg file.

**** please remember to rate useful posts

gilbert.aispuro1 · ‎08-05-2020

Oh nice!

Do you happen to have a write up on that? That's my next venture and I would LOVE to get that going!

Especially with using either of the following:

- Pre-login authentication using Windows machine credentials.

- Single sign-on user authentication using Windows logon credentials.

Mohammed al Baqari · ‎08-05-2020

Unfortunately I don't have but this was validated in my lab and rolled out
in production. I still encourage using flexconfig for new endpoints
which don't have the agent to get it.

*** please remember to rate useful posts

gilbert.aispuro1 · ‎08-06-2020

Do you mind giving a brief overview of your install and what features are you using for NAM?

BTW, I was able to get AnyConnect and Umbrella module up and running by installing the Umbrella standalone .msi from the "pre-deployment" package and then pulling the OrgInfo.json from Umbrella and placing that file in the AC Umbrella directory of "C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client\Umbrella\". No FlexConfig necessary.

I've tested it and it's working just fine, blocking and filtering while VPN is off. I'll be deploying the setup this week to our clients so that I can have an "Always On" for Web Filtering and DNS Security.

Rob Ingram · ‎08-05-2020

Hi,

Refer to this cisco guide, which covers deploying AnyConnect modules using FlexConfig.

https://www.cisco.com/c/en/us/td/docs/security/firepower/config_examples/advanced-anyconnect-ftd-fmc/advanced-anyconnect-vpn-ftd-fmc.html#Cisco_Task_in_List_GUI.dita_12b746da-3ace-4ba0-91b0-a56e78e36ac3

HTH