NPS over Site to Site VPN Unreachable

[MP13]

I have a Firepower 1010 which I am trying to add NPS authentication for. The NPS server sites in Azure and the Firepower 1010 in an office and we have a site to site VPN tunnel in place which connects the two already.

We've configured the NPS server and also configured it on the Firepower as a RADIUS server and if you perform the test function it hits the NPS server correctly and there are no issues there.

When we go to run it through the VPN connection though the NPS server times out and shows "RADIUS_SENT:server response timeout" in debug. We've run wireshark on the NPS server and the traffic never makes it there even though in the test it works fine. I've tried setting the source interface to different things and that hasn't helped. 

I have noticed if I try to ping from the Firepower to the NPS server it doesn't work so I'm assuming it's something to do with the traffic being from itself despite the test function being the same.

Connectivity from a device behind the Firepower works fine and can hit the NPS server too.

[MHM Cisco World]

in ASA if we need to run radius via S2S VPN we specify the INside interface as source of traffic and config this interface as management-access
I think it same for your case

[MP13]

I've tried setting to use the inside interface but that on it's own didn't help. 

When you say to configure the inside interface for management access do you mean the http and ssh commands and then allow the IP of the device which is connecting?

[MHM Cisco World]

for management-access I will check the equivalent command in FPR 
for INside interface, are the INside interface subnet represent your Local LAN of Policy based VPN?
sorry one more thing are the Server subnet config as Remote LAN for policy based VPN?

[MP13]

The inside interface we have 10.10.10.0/24 and remote LAN is 10.10.8.0/23 and these are used as traffic selectors on the VPN. The VPN itself all works ok and can be reached from clients connected to the inside interface.

[MHM Cisco World]

please check below comment 

[MHM Cisco World · Accepted solution]

https://community.cisco.com/t5/network-security/radius-requests-from-ftd-over-l2l-tunnel/td-p/4266365

solution as I mention before you need managment-access but for FPR you need to add it via flexconfig. 
thanks 
MHM

[MP13]

Thanks. I have given that a try but in flexconfig it says it's a blacklisted command.

blacklisted cli error management-access inside

[MHM Cisco World]

if it blacklisted then it add to FMC, what FMC ver. you use?

[MHM Cisco World]

https://bst.cisco.com/bugsearch/bug/CSCvg50549

this bug and it workaround is interest, where to eliminate the need for management-access for INside add other ACL with Port to policy based VPN.
for FMC there is only management-only and enable in interface, if I am right. 

Thanks 
MHM

[MP13]

Thank you. I've had a look at the bug but it seems to be saying that the change is for the ASA end and the traffic leaves the Firepower side fine however in our case it doesn't leave the Firepower side from what I can tell. I had a look at a possible implementation anyway however as FDM writes the ACL's for the traffic selectors it's not possible to modify these in FDM or via SSH/FlexConfig.

We're not currently using FMC and are just using FDM instead. I've been having a look to see if there is a way around the blacklist command as well but it appears it's not just browser validation but the commands are submitted in a post to an API on the box and that message is returned so no way to override it.

I did also find something which suggested on the management access in FDM configuring the data interfaces could be the source of the problem and our inside interface was wrong there however unfortunately that didn't change the result of our problem.

Looking at packet tracer it seems that the Firepower doesn't know how to reach the network the NPS is on so tries to send it out the outside interface instead. 

Phase: 1
Type: ROUTE-LOOKUP
Subtype: Resolve Egress Interface
Result: ALLOW
Config:
Additional Information:
found next-hop 91.X.X.X using egress ifc outside

Result:
input-interface: inside
input-status: up
input-line-status: up
output-interface: outside
output-status: up
output-line-status: up
Action: drop
Drop-reason: (sp-security-failed) Slowpath security checks failed

[MHM Cisco World]

I share the bug workaround it not necessary that you face similar symptom, 
did you try workaround? 

[MP13]

It's not possible as you can't modify the traffic selector ACL used for the VPN as it's system generated on the FDM. Even looking at it through the CLI it's not an ACL that's as straight forward as the former ACL ones are and I don't believe it can be modified in flexconfig either.

[MP13]

Looking into this further it does seem the only way to resolve is the management-access inside command however I looked into this being blacklisted and it appears it's only until version 6.5 and we're on 6.4 still. The thread below is what led me to this:

https://community.cisco.com/t5/vpn/not-able-to-ssh-asa-inside-interfacec-through-vpn-tunnel-while/td-p/4097133

I'll try upgrading it tonight and see if the command then works.

[MP13]

Just to confirm updating the version worked and I could then add the "management-access inside" command and after doing so everything worked.