PDF(1.2 MB) View with Adobe Reader on a variety of devices
ePub(1.1 MB) View in various apps on iPhone, iPad, Android, Sony Reader, or Windows Phone
Mobi (Kindle)(1.1 MB) View on Kindle device or Kindle app on multiple devices
Updated:July 10, 2016
The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
This document describes the configuration of Captive portal authentication (Active Authentication) and Single-Sign-On (Passive Authentication).
Cisco recommends that you have knowledge of these topics:
Sourcefire Firepower devices
Virtual device models
Light Weight Directory Service (LDAP)
The information in this document is based on these software and hardware versions:
Firepower Management Center (FMC) version 6.0.0 and above
Firepower sensor version 6.0.0 and above
The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, make sure that you understand the potential impact of any command.
Captive Portal Authentication or Active Authentication prompts a login page and user credentials are required for a host to get the internet access.
Single-Sign-On or Passive Authentication provides seamless authentication to a user for network resources and internet access without entering user credential multiple times. The Single-Sign-on authentication can be achieved either by Firepower user agent or NTLM browser authentication.
Note: For Captive Portal Authentication, appliance must be in routed mode.
Step 1. Configure the Firepower User Agent for Single-Sign-On
This article explains how to configure Firepower User Agent in a Windows machine:
Click the Test button in order to verify if FMC is able to connect to the AD server.
Step 3.3 Modify the Realm Configuration
Navigate to Realm Configuration in order to verify integration configuration of AD server and you can modify the AD configuration.
Step 3.4 Download User database
Navigate to User Download option to fetch the user database from the AD server.
Enable the check box to download Download users and groups and define the time interval about how frequently FMC contacts AD to download user database.
Select the group and put it into the Include option for which you want to configure the authentication.
As shown in the image, enable the AD state:
Step 4. Configure the Identity Policy
An identity policy performs user authentication. If the user does not authenticate, access to network resources is refused. This enforces Role-Based Access Control (RBAC) to your organization’s network and resources.
Step 4.1 Captive portal (Active Authentication)
Active Authentication asks for username/password at the browser to identify a user identity for allowing any connection. Browser authenticates user either by presenting authentication page or authenticates silently with NTLM authentication. NTLM uses the web browser to send and receive authentication information. Active Authentication uses various types to verify the identity of the user. Different types of Authentication are:
HTTP Basic: In this method, the browser prompts for user credentials.
NTLM: NTLM uses windows workstation credentials and negotiates it with Active directory using a web browser. You need to enable the NTLM authentication in the browser. User Authentication happens transparently without prompting credentials. It provides a single sign-on experience for users.
HTTP Negotiate:In this type, the system tries to authenticate using NTLM, if it fails then the sensor will use HTTP Basic authentication type as a fallback method and will prompt a dialog box for user credentials.
HTTP Response page: This is similar to HTTP basic type, however, here user is prompted to fill the authentication in an HTML form which can be customized.
Each browser has a specific way to enable the NTLM authentication and hence they follow browser guidelines in order to enable the NTLM authentication.
To securely share the credential with the routed sensor, you need to install either self-signed server certificate or publicly-signed server certificate in the identity policy.
Navigate to Policies > Access Control > Identity. Click the Add Policy & give a name to policy and save it.
Navigate to Active Authentication tab & in the Server Certificate option, click the icon (+) and upload the certificate & private key which you generated in the previous step using openSSL.
Now click the Add rule button & give a name to the Rule & choose the action as Active Authentication. Define the source/destination zone, source/destination network for which you want to enable the user authentication.
Select the Realm, which you have configured in the previous step and authentication type that best suits your environment.
ASA configuration for Captive Portal
For ASA Firepower module, Configure these commands on the ASA in order to configure the captive portal.
ASA(config)# captive-portal global port 1055
Ensure that the server port, TCP 1055 is configured in the port option of Identity policy's Active Authentication tab.
In order to verify the active rules and their hit counts, run following command.
ASA# show asp table classify domain captive-portal
Note: Captive portal command is available in ASA version 9.5(2) and later.
Step 4.2 Single-Sign-On (Passive Authentication)
In passive authentication, when a domain user logins and is able to authenticate the AD, the Firepower User Agent polls the User-IP mapping details from the security logs of AD and shares this information with Firepower Management Center (FMC). FMC sends these details to the sensor in order to enforce the access control.
Click the Add rule button & give a name to the Rule & choose the Action as Passive Authentication. Define the source/destination zone, source/destination network for which you want to enable the user authentication.
Select the Realm which you have configured in the previous step and authentication type which best suites your environment, as shown in this image.
Here you can choose fall back method as Active authentication if passive authentication cannot identify the user identity.
Step 5. Configure the Access Control Policy
Navigate to Policies > Access Control > Create/Edit a Policy.
Click the Identity Policy (left-hand side upper corner), choose the Identify Policy that you have configured in the previous step and click the OK button, as shown in this image.
Click the Add rule button to add a new rule, navigate to Users and select the users for which access control rule will enforce, as shown in this image. Click the OK button and click Save button in order to save the changes.
Step 6. Deploy the Access Control Policy
Navigate to Deploy option, choose the Device and click the Deploy option to push the configuration change to the sensor. Monitor the Deployment of policy from the Message Center Icon (icon between Deploy and System option) option and ensure that policy must apply successfully, as shown in this image.
Step 7. Monitor user events & Connections events
Currently active user sessions are available in the Analysis > Users > Users section.
User Activity monitoring helps to figure out which user has associated with which IP address and how is user detected by the system either by active or passive authentication. Analysis > Users > User Activity
Navigate to Analysis > Connections > Events, to monitor the type of traffic being used by the user.
Verify and Troubleshoot
Navigate to Analysis > Users in orderto verify the User authentication/Authentication type/User-IP mapping/access rule associated with the traffic flow.
Verify Connectivity between FMC and User Agent (Passive Authentication)
Firepower Management Center (FMC ) uses TCP port 3306, in order to receive user activity log data from the User Agent.
In order to verify the FMC service status, use this command in the FMC.
admin@firepower:~$ netstat -tan | grep 3306
Run packet capture on the FMC in order to verify connectivity with the User Agent.
admin@firepower:~$ sudo tcpdump -i eth0 -n port 3306
Navigate to Analysis > Users > User Activity in order to verify whether the FMC is receiving user login details from the User Agent.
Verify Connectivity between FMC and Active Directory
FMC uses TCP port 389 in order to retrieve User Database from the Active directory.
Run packet capture on the FMC to verify connectivity with the Active Directory.
admin@firepower:~$ sudo tcpdump -i eth0 -n port 389
Ensure that the user credential used in FMC Realm configuration has sufficient privilege to fetch the AD's User database.
Verify the FMC realm configuration, and ensure that the users/groups are downloaded and user session timeout is configured correctly.
Navigate to Message Center > Tasks and ensure that the task users/groups download completes successfully , as shown in this image.
Verify Connectivity between Firepower Sensor and End system (Active Authentication)
For active authentication, ensure that the certificate and port are configured correctly in FMC Identity policy.By default, Firepower sensor listens on TCP port 885 for active authentication.
Verify Policy configuration & Policy Deployment
Ensure that the Realm, Authentication type, User agent and Action fields are configured correctly in Identity Policy.
Ensure that the Identity policy is correctly associated with the Access Control policy.
Navigate to Message Center > Tasks and ensure that the Policy Deployment completes successfully.
Analyse the Events logs
Connection and the User Activity events can be used to diagnose whether the user login is successful or not.These events
can also verify which Access Control rule is getting applied on the flow.
Navigate to Analysis > User to check the user events logs.
Navigate to Analysis > Connection Events to check the connection events.