Configuring MFA for FTD VPN using RADIUS

This guide provides steps for enabling multi-factor authentication (MFA) for Cisco's Firepower Threat Defense (FTD) using ManageEngine ADSelfService Plus.

To enable RADIUS-based authentication for Cisco FTD, the MFA for VPN supports the following authentication methods in addition to the default username and password-based authentication:

• Push Notification Authentication
• Fingerprint/Face ID Authentication
• ADSelfService Plus TOTP Authentication
• Google Authenticator
• Microsoft Authenticator
• Yubico OTP (hardware key authentication)

The RADIUS-based MFA process for Cisco FTD using ADSelfService Plus

Configuration process

Prerequisites:

• Your ADSelfService Plus license must include Endpoint MFA. Purchase it from the store.
• Configure your Cisco Firepower Threat Defense (FTD) VPN to use RADIUS authentication.
• For the RADIUS server, you must use a Windows server (Windows Server 2008 R2 and above) with the Network Policy Server (NPS) role enabled.
• Enable HTTPS in ADSelfService Plus (Admin → Product Settings → Connection).
  Note: If you are using an untrusted certificate in ADSelfService Plus to enable HTTPS, you must disable the Restrict user access when there is an invalid SSL certificate option in Configuration → Administrative Tools → GINA/Mac/Linux (Ctrl+Alt+Del) → GINA/Mac/Linux Customization → Advanced.
• In Active Directory, set users’ Network Access Permission to Control access through NPS Network Policy in their Dial-in properties.
• The Access URL you have configured in Admin → Product Settings → Connection → Configure Access URL will be used by the NPS extension to communicate with the ADSelfService Plus server. Make sure you have updated the Access URL before installing the NPS extension.
• In the Windows NPS server, where the NPS extension is going to be installed, set the Authentication settings of the Connection Request Policy to Authenticate requests on this server.

Step 1. Configuring MFA in ADSelfService Plus

1. Log in to ADSelfService Plus as an admin.
2. Go to Configuration → Self-Service → Multi-Factor Authentication → Authenticators.
3. Configure the authentication methods required.

   

4. Go to MFA for Endpoints.
5. Select a policy from the Choose the Policy drop-down. This policy will determine the users for whom MFA for VPN and endpoint login will be enabled. To learn more about creating an organizational unit or a group-based policy, click here.
6. In the MFA for VPN Login section, select the checkbox next to Select the authenticators required. Choose the number of authentication factors to be enforced. Select the authentication methods to be used. The authentication methods listed can also be rearranged by dragging and dropping at the necessary position.

   

7. Click the help icon next to MFA for VPN.
8. Download the NPS extension using the Download link provided in the pop-up that appears.

   

Step 2. Install the NPS Extension

1. Copy the extension file (ADSSPNPSExtension.zip) to the Windows server, which you have configured as the RADIUS server. Extract the ZIP file’s content and save it in a location.
2. Open Windows PowerShell (x64) as administrator and navigate to the folder where the extension files content is located.
3. Execute the following command:
   PS C:\> .\setupNpsExtension.ps1 Install
   Note: If the NPS extension plug-in has to be uninstalled or updated to newer versions and configuration data, enter Uninstall and Updated respectively instead of Install.
4. After installation, you will be prompted to restart the NPS Windows service. Proceed with the restart.
5. Configure a RADIUS client in the NPS service for ADSelfService Plus. Set a shared secret during configuration for future use.

Step 3. Configure the Cisco FTD using FMC

1. Log in to the Firepower Management Center (FMC) console that manages your FTD SSL VPN devices.
2. Go to Objects → Object Management → RADIUS Server Group and click Add RADIUS Server Group.
3. Enter the following information under Add RADIUS Server Group:
   • Name: Enter any name without any spaces.
   • Description: ADSelfServicePlus RADIUS server group.
   • Group Accounting Mode: Leave as Single.
   • Retry Interval: Leave as 10.
   • Realms: There is no need to select a realm.
4. Under RADIUS Servers, click the green plus sign to add an NPS server.
5. Enter the information below under New RADIUS Server:

IP Address/Hostname: The hostname or IP address of your NPS server.

Authentication Port: 1812 (or whichever port you specified in your authproxy.cfg file).

Key: The exact shared secret set during RADIUS client configuration.

Confirm Key: Reenter the shared secret.

Server Accounting Port: Defaults to 1813 (this value does not matter because the NPS Extension does not support RADIUS Accounting).



Timeout: Set a minimum of 60 seconds.

Connect using: Depending on connectivity from the FTD to the NPS server, elect either Routed or Specific Interface.

Redirect ACL: Select or add the redirect ACL (only if using FTD with ISE).

6. Once you have added the NPS server to the group, click Save to create the new RADIUS server group.
7. Go to Devices → VPN → Remote Access.
8. Click on the VPN configuration for which MFA should be configured.
9. Under Connection Profiles, click the pencil icon on the far right to select the connection profile that you want to start using the RADIUS server group.
10. Under Edit Connection Profile, click AAA.
11. Modify the Authentication Server value to the RADIUS server group created earlier.
12. The Authorization Server or Accounting Server does not have to be selected.

    

13. Do not configure the Password Management settings.
14. Click Save under Edit Connection Profile.
15. Click Save next to You have unsaved changes.
16. Click Deploy.
17. Select the FTD device(s) to which you want to push the new Remote Access VPN configuration with MFA.
18. Click Deploy.
19. Upon deployment completion, the status Deployment to device successful will be displayed.

Features of ADSelfService Plus

• Self-service password reset and account unlock
• Multi-factor authentication
• Enterprise SSO
• Password synchronization
• Conditional access policies
• Password policy enforcer
• Password expiration notification
• Directory self-service
• Mail group subscription
• Employee search and organizational chart