Firepower Threat Defense Certificate-Based Authentication

Requirements and Prerequisites for FTD Certificate-Based Authentication

Model Support

FTD

Supported Domains

Any

User Roles

Admin

Network Admin

Firepower Threat Defense VPN Certificate Guidelines and Limitations

  • When a PKI enrollment object is associated with and then installed on a device, the certificate enrollment process starts immediately. The process is automatic for self-signed and SCEP enrollment types; it does not require any additional administrator's action. Manual certificate enrollment requires administrator's action.

  • When the certificate enrollment is complete, a trustpoint exists on the device with the same name as the certificate enrollment object. Use this trustpoint in the configuration of your VPN Authentication Method.

  • Firepower Threat Defense devices support certificate enrollment using Microsoft Certificate Authority(CA) Service, and CA Services provided on Cisco Adaptive Security Appliances(ASA) and Cisco IOS Router.

  • Firepower Threat Defense devices cannot be configured as a certificate authority (CA).

Guidlelines for Certificate Management Across Domains and Devices

  • Certificate enrollment can be done in a child or parent domain.

  • When enrollment is done from a parent domain, the certificate enrollment object also needs to be in the same domain. If the trustpoint on a device is overridden in the child domain, the overridden value will be deployed on the device.

  • When the certificate enrollment is done on a device in a leaf domain, the enrollment will be visible to the parent domain or another child domain. Also, adding additional certificates is possible.

  • When a leaf domain is deleted, certificate enrollments on the contained devices will be automatically removed.

  • Once a device has certificates enrolled in one domain, it will be allowed to be enrolled in any other domain. The certificates can be added in the the other domain.

  • When you move a device from one domain to another, the certificates also get moved accordingly. You will receive an alert to delete the enrollments on these devices.

Managing Firepower Threat Defense Certificates

See PKI Infrastructure and Digital Certificates for an introduction to Digital Certificates.

See Certificate Enrollment Objects for a description of the objects used to enroll and obtain certificates on managed devices.

Procedure

Step 1

Select Devices > Certificates.

You can see the following columns for each device listed on this screen:

  • Name—Lists the devices that already have trustpoints associated with them. Expand the device to see the list of associated trustpoints.

  • Domain—Displays the certificates that are enrolled in a specific domain.

  • Enrollment Type—Displays the type of enrollment used for a trustpoint.

  • Status—Provides the status of the CA Certificate and Identity Certificate. You can view the certificate contents, when Available, by clicking the magnifying glass.

    If the enrollment fails, click status to view the failure message.

  • Refresh (circling arrows) a certificate on a managed device. Refreshing a certificate would synchronize the Firepower Threat Defense device certificate status to the Firepower Management Center.

  • Using re-enroll, enroll the identity certificate.

    During the course of any policy deployment, if the certificate enrollment process fails, enroll the identity certificate again using the re-enroll option.

  • Delete (trash can) a configured certificate.

Step 2

Choose (+) Add to associate and install an enrollment object on a device.

When a certificate enrollment object is associated with and then installed on a device, the process of certificate enrollment starts immediately. The process is automatic for self-signed and SCEP enrollment types, meaning it does not require any additional administrator action. Manual certificate enrollment requires extra administrator action.

Note

 

The certificate enrollment on a device does not block the user interface and the enrollment process gets executed in the background, enabling the user to perform certificate enrollment on other devices in parallel. The progress of these parallel operations can be monitored on the same user interface. The respective icons display the certificate enrollment status.

Installing a Certificate Using Self-Signed Enrollment

Procedure

Step 1

On the Devices > Certificates screen, choose Add to open the Add New Certificate dialog.

Step 2

Choose a device from the Device drop-down list.

Step 3

Associate a certificate enrollment object with this device in one of the following ways:

  • Choose a Certificate Enrollment Object of the type Self-Signed from the drop-down list.
  • Click (+), to add a new Certificate Enrollment Object, see Adding Certificate Enrollment Objects.

Step 4

Press Add to start the Self Signed, automatic, enrollment process.

For self signed enrollment type trustpoints, the CA Certificate status will always be displayed, since the managed device is acting as its own CA and does not need a CA certificate to generate its own Identity Certificate.

The Identity Certificate will go from InProgress to Available as the device creates its own self signed identity certificate.

Step 5

Click the magnifying glass to view the self-signed Identity Certificate created for this device.

What to do next

When enrollment is complete, a trustpoint exists on the device with the same name as the certificate enrollment object. Use this trustpoint in the configuration of your Site to Site and Remote Access VPN Authentication Method

Installing a Certificate Using SCEP Enrollment

Before you begin


Note

Using SCEP enrollment establishes a direct connection between the managed device and the CA server. So be sure your device is connected to the CA server before beginning the enrollment process.

Procedure

Step 1

On the Devices > Certificates screen, choose Add to open the Add New Certificate dialog.

Step 2

Choose a device from the Device drop-down list.

Step 3

Associate a certificate enrollment object with this device in one of the following ways:

Step 4

Press Add, to start the automatic enrollment process.

For SCEP enrollment type trustpoints, the CA Certificate status will transition from InProgress to Available as the CA Certificate is obtained from the CA server and installed on the device.

The Identity Certificate will go from InProgress to Available as the device obtains its identity certificate using SCEP from the specified CA. Sometimes, a manual refresh might be required to obtain the identity certificate.

Step 5

Click the magnifying glass to view the Identity Certificate created and installed on this device.

What to do next

When enrollment is complete, a trustpoint exists on the device with the same name as the certificate enrollment object. Use this trustpoint in the configuration of your Site to Site and Remote Access VPN Authentication Method

Installing a Certificate Using Manual Enrollment

Procedure

Step 1

On the Devices > Certificates screen, choose Add to open the Add New Certificate dialog.

Step 2

Choose a device from the Device drop-down list.

Step 3

Associate a certificate enrollment object with this device in one of the following ways:

Step 4

Press Add to start the enrollment process.

Step 5

Execute the appropriate activity with your PKI CA Server to obtain an identity certificate.

  1. Click Identity Certificate warning to view and copy the CSR.

  2. Execute the appropriate activity with your PKI CA Server to obtain an identity certificate using this CSR.

    This activity is completely independent of the Firepower Management Center or the managed device. When complete, you will have an Identity Certificate for the managed device. You can place it in a file.

  3. To finish the manual process, install the obtained identity certificate onto the managed device.

    Return to the Firepower Management Center dialog and select Browse Identity Certificate to choose the identity certificate file.

Step 6

Select Import to import the Identity Certificate.

The Identity Certificate status will be Available when the import complete.

Step 7

Click the magnifying glass to view the Identity Certificate for this device.

What to do next

When enrollment is complete, a trustpoint exists on the device with the same name as the certificate enrollment object. Use this trustpoint in the configuration of your Site to Site and Remote Access VPN Authentication Method

Installing a Certificate Using a PKCS12 File

Procedure

Step 1

Go to Devices > Certificates screen, choose Add to open the Add New Certificate dialog.

Step 2

Choose a pre-configured managed device from the Device drop down list.

Step 3

Associate a certificate enrollment object with this device in one of the following ways:

Step 4

Press Add.

The CA Certificate and Identity Certificate status will go from In Progress to Available as it installs the PKCS12 file on the device.

Note

 
When you upload the PKCS12 file for the first time, the file is stored in Firepower Management Center as part of the CertEnrollment object. For any failed enrollments due to a wrong passphrase or failed deployment, retry enrolling the PKCS12 certificate without uploading the file again. A PKCS12 file size should not be larger than 24K.

Step 5

Once Available, click the magnifying glass to view the Identity Certificate for this device.

What to do next

The certificate (trustpoint) on the managed device is named the same as the PKCS#12 file. Use this certificate in your VPN authentication configuration.

Troubleshooting Firepower Threat Defense Certificates

See Firepower Threat Defense VPN Certificate Guidelines and Limitations to determine if variations in your certificate enrollment environment may be causing a problem. Then consider the following:

  • Ensure there is a route to the CA Server from the device.

    If the CA Server's host name is given in the Enrollment Object, use Flex Config to configure DNS appropriately to reach the server. Alternatively, use the IP Address of the CA Server.

  • If you are using a Microsoft 2012 CA Server, the default IPsec Template is not accepted by the managed device and must be changed.

    To configure a working template, follow these steps as you use MS CA documentation as a reference.

    1. Duplicate the IPsec (Offline Request) template.

    2. In Extensions > Application policies, select IP security end system, instead of the IP security IKE intermediate.

    3. Set the permissions and the template name.

    4. Add the new template and change the registry settings to reflect the new template name.