VPN MFA using ASA, NPS server extension and Azure AD

[Michael Proctor]

Has anyone got this to work with a Firepower 2110?  I have the extension installed and NPS setup but don't even get a prompt when I authenticate just and immediate denial.

[balaji.bandi]

couple of resource help you :

https://community.cisco.com/t5/security-documents/cisco-ftd-6-6-anyconnect-client-with-machine-certificate-ad/ta-p/4280528

https://community.cisco.com/t5/network-security/firepower-threat-defense-with-anyconnect-and-azure-mfa/td-p/4085606

[Michael Proctor]

Thanks,

I have been through these and they don't help my issue.  I keep getting this error, An NPS extension dynamic link library (DLL) that is installed on the NPS server rejected the connection request.  It happens instantly with no attempt at TFA.

[balaji.bandi]

Do you have any FW on Server, so disable and test it.

[Michael Proctor]

no FW on the server.

[balaji.bandi]

i would check the event viewer and post the logs and same time what is the Logs on FTD ?

[Michael Proctor]

it logs this as the reason,

Reason: An NPS extension dynamic link library (DLL) that is installed on the NPS server rejected the connection request.

[balaji.bandi]

Some tips :

https://docs.microsoft.com/en-us/answers/questions/42441/an-nps-extension-dynamic-link-library-dll-that-is.html

https://pariswells.com/blog/research/an-nps-extension-dynamic-link-library-dll-that-is-installed-on-the-nps-server-rejected-the-connection-request

https://github.com/MicrosoftDocs/azure-docs/issues/55499

https://www.petenetlive.com/kb/article/0001759

[Michael Proctor]

Thanks, still not finding the problem.  I was hoping to find someone that got this working and see if they can divulge what they did.  There are some Cisco videos and articles about using and ASA but not so much with the Firepower.

[balaji.bandi]

Cisco videos and articles about using and ASA but not so much with the Firepower.

I have not set up one, but ASA and Firepower work in the same way, nothing changed in terms of concept, except Code in ASA vs Firepower.

Sure any community member can chip in here and give suggestion of they had same issue and how they resolved here (happy to learn from their views)

[Michael Proctor]

Turns out this article helped get it working, ASA VPN User Authentication against Windows 2008 NPS Server (Active Directory) with RADIUS Configuration Example - Cisco

[balaji.bandi]

Glad all good and you able to resolved the issue, and appriciate your feedback with the solution.