Skip to main content

 

 

Cisco Defense Orchestrator

End-to-End Remote Access VPN Configuration Process

To enable remote access VPN for your clients, you need to configure several separate items. The following procedure provides the end-to-end process.

  1. Enable two licenses. 
  2. Configure Certificates.
    Certificates are required to authenticate SSL connections between the clients and the device. You can use the pre-defined DefaultInternalCertificate for the VPN or create your own.

    If you use an encrypted connection for the directory realm used for authentication, you must upload a trusted CA certificate.
    For more information on certificates and how to upload them, see Configuring Certificates.

  3. Download the AnyConnect software packages from https://software.cisco.com/download. See Download the AnyConnect Client Software Packages.
  4. Upload the AnyConnect software to the FTD devices. See Upload AnyConnect Software Packages to Firepower Threat Defense Devices.
  5. (Optional.) Configure and Upload Client Profiles. 
  6. Configure the identity source used for authenticating remote users. 
    You can use the following sources for user accounts that are allowed to log into the remote access VPN. Alternatively, you can use client certificates for authentication, either alone or in conjunction with an identity source.
  • Active Directory identity realm: As a primary authentication source. The user accounts are defined in your Active Directory (AD) server. See Configuring AD Identity Realms. See Create and Edit a Firepower Threat Defense Active Directory Realm Object.

  • RADIUS server group: As a primary or secondary authentication source, and for authorization and accounting. See Configure RADIUS Server Groups. See Create or Edit a Firepower Threat Defense RADIUS Server Object or Group.

  • LocalIdentitySource (the local user database): As a primary or fallback source. You can define users directly on the device and not use an external server. If you use the local database as a fallback source, ensure that you define the same usernames/passwords as the ones described in the external server.
    Note: You can create user accounts directly on the FTD device only from Firepower Device Management (FDM). See Configure Local Users

  1. (Optional.) Create New RA VPN Group Policies.
    The group policy defines user-related attributes. You can configure group policies to provide differential access to resources based on group membership. Alternatively, use the default policy for all connections.
  2. Create an RA VPN Configuration
  3. Configure an RA VPN Connection Profile.
  4. Allow Traffic Through the Remote Access VPN.
  5. (Optional.) Enable the identity policy and configure a rule for passive authentication. 
    If you enable passive user authentication, users who logged in through the remote access VPN will be shown in the dashboards, and they will also be available as traffic-matching criteria in policies. If you do not enable passive authentication, RA VPN users will be available only if they match an active authentication policy. You must enable the identity policy to get any username information in the dashboards or for traffic matching.
    See Configure Identity Policies.
  • Was this article helpful?