FMC and FTD with External Authentication

-

 



Configure FMC with LDAP for External Authentication


1. System > Users > External Authentication, Add External Authentication Object

    Set Defaults button will automatically fill up Attribute Mapping section. 
    Once configures host info, Fetch DNs can retrieve Base DN 




NetworkAdmins is AD group, only members in this AD group can login FMC/FTD. In this lab, maps it to FMC Administrator group, don't select any Default User Role, once you select one, you can't unselect it.






















CLI Access Filter:

when check "Same as Base Filter", cli access doesn't check user's AD group info, so all AD user will get access FMC/FTD cli.

To restrict cli access, we can add a new AD attribute, in this lab, it is called "firepowercli". Refer this article to create a Unicode String attribute, restart AD Domain Services, then in AD set the value to "shell" for user needs FMC/FTD cli access.

https://www.rebeladmin.com/2017/11/step-step-guide-create-custom-active-directory-attributes/


Then configure :




 



Test will show how many users has shell access and which user has.  



Test button also reports which FMC admin group is assigned

user is assigned to FMC Administrator group


user is not assigned to any FMC group, no access.





2. Leave Default role to None, enabled AD for Shell Authentication, Enable the LDAP object Corp-AD, Save and Apply




Note: No need to create a FMC local same user account to map the AD account.



Configure FTD with LDAP for External Authentication

External Authentication Object created in previous step will show up in FTD platform setting, just need enable it, save and deploy. then you can ssh to FTD MGMT interface using AD user account.









https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/215538-configure-firepower-management-center-an.html#toc-hId-1407814223


FTD SSH and HTPPs access 

commands to restrict access from specified IPs

configure https-access-list (local manager only)

configure ssh-access-list 

> configure ssh-access-list 192.168.2.0/24
The ssh access list was changed successfully.
>
> show ssh-access-list
ACCEPT     tcp  --  192.168.2.0/24       anywhere             state NEW tcp dpt:ssh
>

By default, FTD SSH is only enabled on MGMT interface, to enable it on data interface, need configure platform setting:







HTTPS access is specifically useful to download the packet captures from the diagnostic secure web interface directly for the analysis. 

But it gives Authorization Required message, couldn't download capture via https

We can download CLI capture via copy command, must be in LINA CLI:

copy /pcap capture:CP ftp://ftpusername@192.168.2.111/ftp/CP.pcap





Configure FMC and FTD External Authentication with ISE as a RADIUS Server

https://www.cisco.com/c/en/us/support/docs/security-vpn/remote-authentication-dial-user-service-radius/221009-configure-fmc-and-ftd-external-authentic.html


FTD CLI Access with RADIUS

https://bluenetsec.com/ftd-cli-access-with-radius/

Comments

Post a Comment

Popular posts from this blog

Firepower FMC and FTD troubleshooting

-
 1. Display real time log on FMC or FTD: pigtail for example: pigtail | grep 192.168.2.20                      pigtail | grep sftunnel 2. Restart communication channel manage_procs.pl run it from  the sensor only, run it from FMC will reset all sensors' channel. This scripts are nice to be used when the FMC and FTD have communication problems like heartbeats are not received, policy deployment is failing or events are not received > expert ************************************************************** NOTICE - Shell access will be deprecated in future releases          and will be replaced with a separate expert mode CLI. ************************************************************** admin@FTD:~$ sudo su Password: root@FTD:/home/admin# manage_procs.pl ****************  Configuration Utility  **************  1   Reconfigure Correlator  2   Reconfigure and flush Correlator  3    Restart Comm. channel  4   Update routes  5   Reset all routes  6   Validate Network  0   Exit *****
Read more

ASA IKEv1 VPN troubleshooting Steps and Tips

-
  1. Phase I proposal mismatch  Run show crypto isakmp sa  Initiator: MM_WAIT_MSG2 Responder: No info  Most likely this is phase1 proposal mismatch, verify IKEv1 policy, other symptoms:   Initiator log: Information Exchange processing failed All configured IKE versions failed to establish the tunnel Initiator debug: Received an un-encrypted NO_PROPOSAL_CHOSEN notify message, dropping Responder log: Error processing payload: Payload ID Responder debug:  All SA proposals found unacceptable 2. IKE version mismatch:  Run  show crypto isakmp sa  no info at both initiator and responder Initiator log: Removing peer from correlator table failed, no match! Reason: User Requested  All configured IKE versions failed to establish the tunnel Initiator debug: Oakley begin quick mode PHASE 1 COMPLETED IKE Initiator sending 1st QM pkt Removing peer from correlator table failed, no match! Session is being torn down. Reason: User Requested Responder log: Tunnel Rejected: Conflicting protocols specified
Read more

Firepower 2100/1100 FTD/ASA initial setup, reimage, upgrade.

-
  Chassis FXOS and FTD share same management IP (default 192.168.45.45) Chassis FXOS (192.168.45.45) and ASA ()use different management IP although on same physical interface. SSH to FXOS/FTD are on FTD CLI prompt, go to FXOS using the  connect fxos  command Console to Chassis is on FXOS CLI prompt, go to FTD using the  connect ftd  command The Firepower 1100 does not support the FXOS Firepower Chassis Manager; only a limited CLI is supported for troubleshooting purposes. The Firepower 2100 runs an underlying operating system called the Firepower eXtensible Operating System (FXOS).  If you run ASA on Firepower 2100, ASA can be in the following modes: Appliance mode (the default after ASA 9.13)—Appliance mode lets you configure all settings in the ASA. Only advanced troubleshooting commands are available from the FXOS CLI. See the  FXOS troubleshooting guide  for more information. Firepower Chassis Manager is not supported . ciscoasa# connect fxos [admin] Connecting to fxos. Connected
Read more