External Authentication

You must have administrator privileges to perform this task.

When you enable external authentication for management users, the Firewall Threat Defense verifies the user credentials with an LDAP or RADIUS server as specified in an external authentication object.

Sharing External Authentication Objects

External authentication objects can be used by the Firewall Management Center and Firewall Threat Defense devices. You can share the same object between the Firewall Management Center and devices, or create separate objects. Note that the Firewall Threat Defense supports defining users on the RADIUS server, while the Firewall Management Center requires you to predefine the user list in the external authentication object. You can choose to use the predefined list method for the Firewall Threat Defense, but if you want to define users on the RADIUS server, you must create separate objects for the Firewall Threat Defense and the Firewall Management Center.

The timeout range is different for the Firewall Threat Defense and the Firewall Management Center, so if you share an object, be sure not to exceed the Firewall Threat Defense's smaller timeout range (1-30 seconds for LDAP, and 1-300 seconds for RADIUS). If you set the timeout to a higher value, the Firewall Threat Defense external authentication configuration will not work.

Assigning External Authentication Objects to Devices

For the Firewall Management Center, enable the external authentication objects directly on System > Users > External Authentication; this setting only affects Firewall Management Center usage, and it does not need to be enabled for managed device usage. For Firewall Threat Defense devices, you must enable the external authentication object in the platform settings that you deploy to the devices, and you can only activate one external authentication object per policy. An LDAP object with CAC authentication enabled cannot also be used for CLI access. Be sure that both the Firewall Threat Defense and the Firewall Management Center can reach the LDAP server, even if you are not sharing the object. The Firewall Management Center is essential to retrieving the user list and downloading it to the device.

Firewall Threat Defense Supported Fields

Only a subset of fields in the external authentication object are used for Firewall Threat Defense SSH access. If you fill in additional fields, they are ignored. If you also use this object for the Firewall Management Center, those fields will be used. This procedure only covers the supported fields for the Firewall Threat Defense.

Usernames

Usernames must be Linux-valid usernames and be lower-case only, using alphanumeric characters plus period (.) or hyphen (-). Other special characters such as at sign (@) and slash (/) are not supported. You cannot add the admin user for external authentication. You can only add external users (as part of the External Authentication object) in the Firewall Management Center; you cannot add them at the CLI. Note that internal users can only be added at the CLI, not in the Firewall Management Center.

If you previously configured the same username for an internal user using the configure user add command, the Firewall Threat Defense first checks the password against the internal user, and if that fails, it checks the AAA server. Note that you cannot later add an internal user with the same name as an external user; only pre-existing internal users are supported. For users defined on the RADIUS server, be sure to set the privilege level to be the same as any internal users; otherwise you cannot log in using the external user password.

Privilege Level

LDAP users always have Config privileges. RADIUS users can be defined as either Config or Basic users.

Before you begin

SSH access is enabled by default on the management interface. To enable SSH access on data interfaces, see SSH Access.
Inform RADIUS users of the following behavior to set their expectations appropriately:
- The first time an external user logs in, Firewall Threat Defense creates the required structures but cannot simultaneously create the user session. The user simply needs to authenticate again to start the session. The user will see a message similar to the following: "New external username identified. Please log in again to start a session."
- If the user's Service-Type attribute is not defined or incorrectly configured in the RADIUS server, and when using the RADIUS-defined users for authentication, the user will see a message similar to the following: "Your username is not defined with a service type that is valid for this system. You are not authorized to access the system?.
  
  In some cases, the SSH clients close the CLI window on an unsuccessful SSH connection, even before displaying the failure message. Hence, ensure that the user's Service-Type attribute is correctly defined in the RADIUS server.
- Similarly, if the user’s Service-Type authorization was changed since the last login, the user will need to re-authenticate. The user will see a message similar to the following: "Your authorization privilege has changed. Please log in again to start a session."
- The server used for external authentication must be reachable by the Cloud-Delivered Firewall Management Center; otherwise, users' authentication will fail.

Procedure

Choose Devices > Platform Settings and create or edit the Firewall Threat Defense policy.

Click External Authentication.

Click the Manage External Authentication Server link.

You can also open the External Authentication screen by clicking System > Users > External Authentication.

Configure an LDAP Authentication Object.

Click Add External Authentication Object.
Set the Authentication Method to LDAP
Enter a Name and optional Description.
Choose a Server Type from the drop-down list.

For the Primary Server, enter a Host Name/IP Address.

If you are using a certificate to connect via TLS or SSL, the host name in the certificate must match the host name used in this field. In addition, IPv6 addresses are not supported for encrypted connections.

Change the Port from the default.
Enter the Backup Sever parameters.

Enter LDAP-Specific Parameters.

Base DN—Enter the base distinguished name for the LDAP directory you want to access. For example, to authenticate names in the Security organization at the Example company, enter ou=security,dc=example,dc=com. Alternatively click Fetch DNs, and choose the appropriate base distinguished name from the drop-down list.
(Optional) Base Filter—For example, if the user objects in a directory tree have a physicalDeliveryOfficeName attribute and users in the New York office have an attribute value of NewYork for that attribute, to retrieve only users in the New York office, enter (physicalDeliveryOfficeName=NewYork).
User Name—Enter a distinguished name for a user who has sufficient credentials to browse the LDAP server. For example, if you are connecting to an OpenLDAP server where user objects have a uid attribute, and the object for the administrator in the Security division at our example company has a uid value of NetworkAdmin, you might enter uid=NetworkAdmin,ou=security,dc=example,dc=com.
Password and Confirm Password—Enter and confirm the password for the user.

(Optional) Show Advanced Options—Configure the following advanced options.

Encryption—Click None, TLS, or SSL.

If you change the encryption method after specifying a port, you reset the port to the default value for that method. For None or TLS, the port resets to the default value of 389. If you choose SSL encryption, the port resets to 636.

SSL Certificate Upload Path—For SSL or TLS encryption, you must choose a certificate by clicking Choose File.
(Not Used) User Name Template—Not used by the Firewall Threat Defense.

Timeout—Enter the number of seconds before rolling over to the backup connection between 1 and 30. The default is 30.

The timeout range is different for the Firewall Threat Defense and the Firewall Management Center, so if you share an object, be sure not to exceed the Firewall Threat Defense's smaller timeout range (1-30 seconds). If you set the timeout to a higher value, the Firewall Threat Defense external authentication configuration will not work.

Set the CLI Access Attribute if you want to use a shell access attribute other than the user distinguished type. For example, on a Microsoft Active Directory Server, use the sAMAccountName shell access attribute to retrieve shell access users by typing sAMAccountName in the CLI Access Attribute field.
Set the CLI Access Filter.
Choose one of the following methods:
- To use the same filter you specified when configuring authentication settings, choose Same as Base Filter.
- To retrieve administrative user entries based on attribute value, enter the attribute name, a comparison operator, and the attribute value you want to use as a filter, enclosed in parentheses. For example, if all network administrators have a manager attribute which has an attribute value of shell, you can set a base filter of (manager=shell).
The names on the LDAP server must be Linux-valid usernames:
- Maximum 32 alphanumeric characters, plus hyphen (-) and underscore (_)
- All lowercase
- Cannot start with hyphen (-); cannot be all numbers; cannot include a period (.), at sign (@), or slash (/)
Click Save.

For LDAP, if you later add or delete users on the LDAP server, you must refresh the user list and redeploy the Platform Settings.

Choose System > Users > External Authentication.
Click Refresh () next to the LDAP server.

If the user list changed, you will see a message advising you to deploy configuration changes for your device. The Firepower Theat Defense Platform Settings will also show that it is "Out-of-Date on x targeted devices."
Deploy configuration changes; see Deploy Configuration Changes.

Configure a RADIUS Authentication Object.

Define users on the RADIUS server using the Service-Type attribute.
The following are supported values for the Service-Type attribute:
- Administrator (6)—Provides Config access authorization to the CLI. These users can use all commands in the CLI.
- NAS Prompt (7) or any level other than 6—Provides Basic access authorization to the CLI. These users can use read-only commands, such as show commands, for monitoring and troubleshooting purposes.
The names must be Linux-valid usernames:
- Maximum 32 alphanumeric characters, plus hyphen (-) and underscore (_)
- All lowercase
- Cannot start with hyphen (-); cannot be all numbers; cannot include a period (.), at sign (@), or slash (/)
Alternatively, you can predefine users in the external authentication object (see Step 6.k). To use the same RADIUS server for the Firewall Threat Defense and Firewall Management Center while using the Service-Type attribute method for the Firewall Threat Defense, create two external authentication objects that identify the same RADIUS server: one object includes the predefined CLI Access Filter users (for use with the Firewall Management Center), and the other object leaves the CLI Access Filter empty (for use with Firewall Threat Defenses).
In Firewall Management Center, click Add External Authentication Object.
Set the Authentication Method to RADIUS.
Check the RADIUS Server-Enabled Message Authenticator check box to require the Message-Authenticator attribute in all RADIUS responses, ensuring that every response from the RADIUS server is securely verified by the Firewall Threat Defense.

This feature is enabled by default for new RADIUS servers. We recommend you enable it for existing servers after the upgrade. Disabling message authenticators may expose your firewalls to potential attacks. Ensure that your RADIUS server has the Message-Authenticator configuration.
Enter a Name and optional Description.

For the Primary Server, enter a Host Name/IP Address.

Change the Port from the default.
Enter a RADIUS Secret Key.
Enter the Backup Sever parameters.
Enter RADIUS-Specific Parameters.
- Timeout (Seconds)—Enter the number of seconds before rolling over to the backup connection. The default is 30.
- Retries—Enter the number of times the primary server connection should be tried before rolling over to the backup connection. The default is 3.
(Optional) Instead of using RADIUS-defined users, under CLI Access Filter, enter a comma-separated list of usernames in the Administrator CLI Access User List field. For example, enter jchrichton, aerynsun, rygel.
You may want to use the CLI Access Filter method for Firewall Threat Defense so you can use the same external authentication object with Firewall Threat Defense and other platform types. Note that if you want to use RADIUS-defined users, you must leave the CLI Access Filter empty.

Make sure that these usernames match usernames on the RADIUS server. The names must be Linux-valid usernames:
- Maximum 32 alphanumeric characters, plus hyphen (-) and underscore (_)
- All lowercase
- Cannot start with hyphen (-); cannot be all numbers; cannot include a period (.), at sign (@), or slash (/)
If you want to only define users on the RADIUS server, you must leave this section empty.
Click Save.

Return to Devices > > Platform Settings > External Authentication.

Click Refresh ( refresh icon ) to view any newly-added objects.

For LDAP when you specify SSL or TLS encryption, you must upload a certificate for the connection; otherwise, the server will not be listed on this window.

Click Slider enabled () next to the External Authentication object you want to use. You can only enable one object.

Click Save.

Deploy configuration changes; see Deploy Configuration Changes.

Previous topic DNS Next topic Enable Virtual-Router-Aware Interface for External Authentication of Platform