Configure Secure Firewall Management Center Access with Duo SSO

Introduction

This document describes how to configure the Secure Firewall Management Center (FMC) to authenticate via Single Sign-On (SSO) for management access.

Prerequisites

Requirements

Cisco recommends that you have knowledge of these topics:
• Basic understanding of Single Sign-On and SAML
• Understanding of the configuration on the Identity Provider (iDP)

Components Used

The information in this document is based on these software versions:
• Cisco Secure Firewall Management Center (FMC) version 7.2.4
• Duo as the Identity Provider

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

Configure

These iDPs are supported and are tested for authentication:
• Okta
• OneLogin
• PingID
• Azure AD
• Others (Any iDP that conforms to SAML 2.0)

Note: No new license requirement. This feature works in licensed as well as evaluation mode.

Limitations and Restrictions
These are known limitations and restrictions for SSO authentication for FMC access:
• SSO can be configured only for the Global Domain.
• FMC devices participating in HA Pair requires individual configuration.
• Only Local/AD admins can configure SSO on FMC (SSO admin users are unable to configure/update SSO settings on FMC).

Network Diagram

Configuration Steps on the Identity Provider (Duo)

From the Dashboard, navigate to Applications:

Example url: https://admin-debXXXXX.duosecurity.com/applications

Select Protect an Application.

Search for Generic SAML Service Provider.

Download Certificate and XML.

Configure Service Provider.

Enter the SAML Settings:
Single sign on URL: https://<fmc URL>/saml/acs
Audience URI (SP Entity ID): https://<fmc URL>/saml/metadata
Default RelayState: /ui/login

Configure Apply Policy to All Users.

Detailed Apply a Policy.

Choose necessary administrator group from the appropriate Custom Policy.

Configure necessary administrative settings.

Save Application.

Configuration Steps on Secure Firewall Management Center

Log in to the FMC with Admin privileges. Navigate to System > Users.

Click Single Sign-On, as shown in this image.

Enable the Single Sign-On option (Disabled by default).

Click Configure SSO to begin SSO configuration on FMC.

Select the Firewall Management Center SAML Provider. Click Next.

For the purpose of this demonstration, Other is used.

You can also choose Upload XML file and upload the XML file retrieved earlier from Duo Configuration.

Once the file is uploaded, the FMC displays the metadata. Click Next, as shown in this image.

Verify the metadata. Click Save, as shown in this image.

Configure the Role Mapping/Default User Role under Advanced Configuration.

In order to test the Configuration, click Test Configuration, as shown in this image.

Example shown of a successful test connection.

Click Apply to save the configuration.

SSO is enabled successfully.

Verify

Navigate to the FMC URL from your browser: https://<fmc URL>. Click Single Sign-On.

You are directed to the iDP (Duo) Login Page. Provide your SSO credentials. Click Sign in.

If successful, you are be able to log in and see the FMC default page.
In FMC, navigate to System > Users to see the SSO user added to the database.