Good morning, everyone, and welcome to this cyber capture about Cisco secure Firewall. My name is Luca Chicarollo, and I am a security customer success specialist at Cisco. Today, we will cover how.00:05How to dynamically assign group policy via SAML when configuring the remote access VPN use case. Let's start with this general overview.00:20We have a remote host trying to connect to some private internal corporate resources over the public internet. The remote users starts a VPN connection request to the secure firewall. The secure firewall, when properly configured to use authentication will then.00:29Redirect the request to a SAML identity provider for the authentication via the user browser. The SAML IDP will then request the credential from the user and once these credentials will be submitted, the SAML identity provider will respond.00:50With the SAML security assertion containing the authentication successful response. For us to use the SAML authentication, we need to remember, we need to have the premier license type, which are subscriptions based.01:08Those licenses are unique for every users and they allow us to leverage some key advanced features such as e.g. SAML authentication. When configuring remote access VPN, there are two important configuration connections profiles and group policies. The connections profiles.01:24Define how to connect and authenticate to the VPN. The group policy define the specific access and authorization to each user or group of users. In the configuration demo, I'm going to show you how.01:43We can dynamically assign this group policy to a VPN connection by using the SAML attributes before moving to the configuration demo. Step one, the users will point to the FTD domain name and will use protocols such as SSL or ipsecs to initiate the connection.01:59Step two, the user gets redirected to the SAML identity provider, which will verify the user identity and enforce MFA. Once authenticated, the identity provider will provide a SAML security including the authentication results.02:18And the authentication attributes. The FTD applies specific group policy depending on the dynamic access policy. Once the group policy is dynamically assigned, the VPN traffic is controlled either explicitly or.02:33Being automatic bypassed. Let's now start with the demo. I will go to remote access VPN and start a new setup wizard. I will name it, this dynamic group table.02:51And I will include my device. As the authentication method, I will select SAML and in the authentication server, I will now create a new object. I will give it a name dual IDP two and here is where I will have to configure some information from my identity provider.03:06Here. So here is where I have my dual administration portal, and I'm going to protect a new application. I will add a new generic SAML service provider and I'm gonna call this remote access VPN tunnel.03:26Enabled for all users, and this is where I will find the metadata which I will need to put into my identity service provider new object entity ID, I will copy and paste here SSO URL.03:43Log out URL. The base URL is going to be my FQDN via which my secret firewall will be reachable through the outside interface and for the identity provider's certificates, I will download it from here.03:59Call it dual IDP copy the content and add the new object here, manual enrollment type and going to click on save by calling it dual IDP 3rd. I will click on save.04:18And this will be my authentication server. The SAML login experience can be via the browser and I will select a default user pool which should be assigned. Now the group policy.04:33For the group policy, create two new group policy, which will reflect the active directory group membership for my users. If I take a look at my active directory, I have two users here. My user Luca, is member of this.04:49GP minus start group and for the user Lorenza, this is part of the GP minus contractor group, active directory group. So this is the name that I will enable both the protocols.05:06I will assign a specific address pool for the users. I will have the banner, welcome to the group policy. Select my DNS server for domain name resolution, and for the split tunneling policy, I will choose to only.05:22Know the traffic.05:42IPV four and for the tab group, I want only access to my ICE GUI instance and I do that via an access control list. I want to send the DNS request only for the specific domain, which is my case is this one. This is the 1st group policy.05:43I will create a second one for the contractor. I will name it the same active directory group name, the IP address group is the one for the contractors. Banner, welcome to the contractor group policy DNS server.06:03Split tunnel, this time I will only include the access to a specific object which is my app one defined by my access control list. The domain resolution, the DNS request via the split tunneling must be only.06:21For the specific domain and click on save. Click on next, select my secure client image, click on next, the interface group or security zones for the incoming VPN access outside the identity certificate for my FTD.06:38I have this object here and I will choose to bypass the access control policy for the VPN traffic. I will click on finish and I will deploy the changes. I will have to go to my FTD CLI and switch to the system support diagnostic CLI, and once here.06:56I will need to put my commands. I will copy the connections profile name because here is where I will need to put the show metadata and the name of the tunnel group, which in my case is the same as the connections profile.07:17If I click enter.07:37I will have it here, the information's about the entity ID, so this URL, which I will have to copy and paste into my dual administration portal. The same I will do for the assertion consumer URL.07:38Which I have it here. I will copy and paste it here. Duo identity provider is integrated with my active directory and one of the active Directory attributes for my users was the member of.07:57Attributes. I will now go here and select the attributes member off, and this one will need to be mapped to a specific SAML response attributes. In this case, for us to understand what is the attributes that need to be matched with my FMC.08:13I will need to go and create a new dynamic access policy. I will create a new dynamic access policy and the dynamic access policy describes the way we can link our SAML attributes to a specific group policy. So I will give it a name.08:32Policy number two, create on save, and I will create a new dynamic access policy record. I will give it a name. What is important is that here we go and select the AAA criteria. In our case.08:51We want the attribute ID, Cisco group policy to be matched to a specific group policy. This attribute ID is going to be passed here as part of the SAML response and.09:06Once I have it, I will click again on save. This is how we configure and how we instruct our dual admin portal to send the attributes, the IDP attribute member off as CISO group policy and from the firewall perspective.09:21As soon as the FTD will see this group, this attribute ID coming from the SAML response, these will be matched to two policy. Once we have it here, we move back to the remote access VPN configuration setup.09:41And we attach this dynamic address policy we have just created. I will click on save. Plus I need to be sure that in the advanced tab under group policy, here I have to add the two group policy which I have created because they will be applied.09:56To, to my connection profile. I will click on save, I will deploy, and I will also make sure that here everything is configured correctly for the application policy, I will choose to my users Windows users to have the dual desktop.10:16Have applications installed on their device. So I will click apply. Just as a recap before moving to the test phase, I have configured a remote access VPN, where I have enforced SAML as the authentication method.10:35I have configured my authentication server and by default, all the authenticated users will be assigned this specific group policy. Now, I have linked this dynamic policy where I am saying that.10:53When the SAML response, when the attribute ID coming from the SAML, from the SAML response is matching this Cisco group policy, the value of this specific attribute ID will be matched to a specific group policy. So let's it for the deployment to be completed.11:10And we can go to the test phase. This is my remote user PC. So I have two users, the user Luca, and the user Lorenza. I will try to authenticate with both and I will show you that depending on the Active directory group they belong to.11:30Luca belonged to the tag and Lorenza belong to the contractor, we will get two different, two different group policy from the access VPN. Let's go to the tests. So I have my anyconnect secure client here, the Cisco secure client, I already have my profile and I will need to connect.11:47As soon as they will do it, the connections profile that I have created, it will be triggered and that will be redirected to my identity provider Duo in my case. I will authenticate with Luca, with my email address, click on next. I will put the password.12:07And as I have two MFA enforced, I will have to con I will have to confirm the multi factor authentication with my phone. I just did it and as soon as I do it, I will get the authentication successfully.12:24Succeeded plus the welcome message. Welcome to the tag group policy, which is the banner that we have created from before. So now I am fully authenticated and authorized, and if I look back at my logs in the firewall.12:41I can see, I will see that here in the log, the firepower is evaluating the Cisco group policy which is equal to group tag and this is a valid group policy Plus, if I will type show VPN session DB, any connect, I will see that for my user Luca.12:59I have the group policy GP tag assigned dynamically. If you also remind from the tag group policy I wanted my user to have access to ICE, and this is where I get the access, but not to have access to this specific app one. So the user Luca, which is part of.13:20The tag will have access to ICE but not to this app one.my domain.eu. Let's try now to disconnect from the VPN and let's try 2nd user, which is Lorenza. So I will take I will type connect again.13:39And I will use a different user here. This user is now part of my contractor group policy, so as soon as I will authenticate, I will now be dynamically assigned to the contractor group policy and you can see it from the banner, I will click accept. The connection will be established. I can verify it from the.13:59Logs and I can type here I can see the GP group tag GP.14:19Dash contractor is a valid group policy. Plus if I type show VPN session DB anyconnect I can see that for the user Lorenza, I now have the dynamic policy contractor assigned to it. I can also verify from the client that I don't have access to ICE.14:26Anymore, I do have access to the application one and this is how we dynamically assign group policy via SAML as part of the SAML response. Thank you for that. Thank you for your attention and I hope this video has been helpful for you.14:44
