Jul 25, 2016 Navigate to Configuration Remote Access VPN Certificate Management, and choose Identity Certificates. Specify a Trustpoint name. Click the Import the identity certificate from a file radio button. Enter the passphrase used to create the PKCS12 file. Browse and select the PKCS12 file. Enter the certificate passphrase.
Most networking administrators have probably spent at least some time setting up a remote-access VPN for their company or for a customer. To authenticate end-users that connect to the VPN, it is very common to utilize an external database of users and to communicate with this external database you usually have to use the LDAP or RADIUS-protocol to talk either directly to an LDAP-catalog or to a RADIUS-server (like Cisco’s Identity Services Engine, ISE, for example).
Go to Configuration Remote Access VPN Certificate Management CA Certificates in the ASA firewall. Click on the 'Add' button, the 'Install Certificate' window will open. Click the 'Browse' button next to the 'Install from a file' option. On the new ASA navigate to the same location Configuration Remote Access VPN Certificate Management Identity Certificates; Click Add; Enter a Trustpoint Name (this does not need to be the same as the old Trustpoint name) Enter the Decryption Passphrase (this passphrase is the same as the passphrase used to encrypt the file). Client - In addition to X-Auth the client will present the ASA with the identity certificate of the user. The ASA then authenticates this certificate using its locally stored root ca certificate. Note: When importing enrolling both the ASA and the VPN client a passphrase will be required. This can be obtained from the CA server (router) using. This document describes a configuration example for Adaptive Security Appliance (ASA) Cisco AnyConnect Secure Mobility Client access that uses double authentication with certificate validation. As an AnyConnect user, you must provide the correct certificate and credentials for the primary and secondary authentication in order to get VPN access.
However, if your VPN-solution consists of an Cisco ASA-firewall and the AnyConnect VPN software, there is a new option/protocol available to handle authentication: SAML, which stands for Security Assertion Markup Language. SAML has grown big in the last few years to provide authentication and single sign-on (SSO) experiences for applications like email, websites, ticket services and much more. The general idea of SAML is that once you have gone through a succesful authentication, you are handed a sort of cookie or “ticket” inside your web browser that will allow you to automatically be signed into the next service you want to use that also uses the same SAML-authentication. Today, there are many different products that use SAML-authentication from well-known companies like Microsoft, Okta, Ping Identity and even Cisco (through their Duo service).
As of this writing, successful SAML-authentications taking place for VPN does not “carry over” for use with other services because of how AnyConnect works… so keep that in mind for your own implementation.
I am not going to go into detail how SAML-authentication works but the main thing about the SAML-authentication flow is that when you initiate a VPN-session in AnyConnect (by typing in the URL/IP to your ASA and clicking “Connect”) instead of getting the normal AnyConnect login-prompt you will be redirected to a so called Identity Provider (IdP) which will present you with a login website that opens up inside AnyConnect (at least if you are using AnyConnect version 4.6 or newer). It is very common for companies and organizations to design their own login-page using their brand colors and logotypes to make users feel at home. Since the VPN login will look the same as for other applications used by the users, they will be very familiar with the interface. In SAML-terms the ASA will be acting as a Service Provider (SP).
This is not going to be a complete guide on how to setup SAML-authentication for VPN on the ASA, we will only cover the SAML-configuration on the ASA and not the configuration of basc VPN-settings like Group Policies etc. We will also not cover the configuration of the IdP, mainly because 1) you, the network administrator, will probably not be the one tasked to do that configuration and 2) there are way to many different IdP-services and I’ve barely seen any of them. This article is more about putting together a collection of good things to know that I’ve picked up from implementing SAML-authentication myself and from reading about other people’s experience on the Cisco Support forum. The main reason I felt the need to make this article is that Cisco’s own documentation regarding SAML is pretty barebone and it does not cover all the steps needed in a good enough manner, in my opinion.
Below you see a simple diagram of the connections and communication that takes place in a SAML VPN-solution. The IdP could be either on your internal network, your DMZ or on the internet if you are using a cloud service.
I’m just gonna get this out right away, there are some technical requirements that need to be met to use SAML-authentication for your VPN-connections:
Your ASA must have a trusted certificate installed, preferably from a third-party.
Your IdP must also have a trusted certificate installed, preferably from a third-party.
SAML-authentication differs quite a bit from the usual RADIUS or LDAP-authentication you are used to: the ASA doesn’t actually know the name of the user until the authentication is complete (either sucessful or failed) since the authentication takes place on the IdP. The IdP will inform the ASA of the username using the SAML-attribute NameID.
The Connection Profile (Tunnel Group) for your VPN that is going to use SAML as authentication method cannot contain any spaces. This it because the Connection Profile name is going to be used in the SAML-URL that the IdP will make use of. If you need to have multiple words in your Connection Profile, use dash or underscore between them.
If your SAML-authentication page is capable of reading user certificates from your computer, you must have AnyConnect version 4.7 or newer for this to work. Earlier version will not be able to fetch and present certificates stored on your computer to the IdP login page.
Your ASA must have DNS-servers configured that are able to do lookup the URL/IP of your Identity Provider servers.
Make sure your ASA and your IdP has NTP running and synchronized.
Once again, this article assumes you have at least a decent amount of experience working with remote-access VPN configuration of an ASA and therefore I will not be covering the basics of Connection Profiles, Group Policies, IP-pools and so on. You know what’s best for your environment and the only thing this article will ask of you is to follow the technical requirement above (like the Connection Profile name) and that you set the Connection Profile’s User Authentication to SAML after you have configured the SAML (SSO) server futher down.
Adding the Identity Provider (IdP) certificate to the ASA
According to the documentation on Cisco’s website, you only need to add the root-certificate of the IdP’s certificate to the ASA buuut if you dig inside the Help pages inside the ASDM software you actually need to add the IdP’s certificate to the ASA.
As a best practice, I would recommend you install the root and intermediate certificates of the IdP’s certificate into the trusted certificate store of the ASA just in case. Head over to Configuration > Certificate Management > CA Certificates and click on Add to import the root certificate first and then do it again to import the intermediate certificate. You can add the certificates either as files (.der/.cer/.crt) or paste in the Base64 (text-version) of the certificates one by one.
However, for the “SAML-trust” to be setup between your ASA (SP) and the IdP, you also need to add the certificate of the IdP itself (the certificate that is used on the login website) as a trusted CA certificate.
Now comes the tricky part: I had trouble adding the IdP certificate itself in ASDM as a CA certificate because I kept getting an error stating the certificate could not be added because it needs to be added with the “no ca-check” command.
There is no way to issue the command “no ca-check” when importing the certificate using ASDM so you will need to add this certificate as a trustpoint using the command line instead.
<paste in the IdP-certificate in Base64-format>
And you’re done!
Configuring a SAML-server
Next up we need to add the SAML-server in ASDM, you can find the configuration for SAML-servers (or SSO-server as they are named here) under Configuration > Remote Access VPN > Clientless SSL VPN Access > Advanced > Single Signon Server. Don’t let the menu fool you, these servers are not only used for Clientless VPN.
The configuration of adding a SAML-server is pretty simple because there isn’t a lot of settings for you to play around with, but you will need to get some URLs from your IdP-administrator. Ask them for IDP Entity ID, Sign-in URL and Sign-out URL.
Please note that even the IDP Entity ID is a URL, it is not a “friendly name” that you can pick yourself so to speak.
Request Signature is something you must agree with your IdP-administrator about. Setting it to None is a very bad practice.
Request Timeout is something I would not touch unless told to by the IdP-administrator.
Make sure to remove “https://” before all URLs (except for the URL you set as IDP Entity ID) and all possibly added “/” from the end of the URLs, including the Base URL which is your ASA’s URL.
There is also a slight inconvenience with configuring SAML (SSO) servers and that is that everytime you make a change, you need to turn the SAML-configuration for that Connection Profile off and on again for the changes to take effect. Cisco is however aware of this oddity (it is tracked as en Enhancement under the bug-id CSCvi23605) and when you head into the SSO-server configuration you are greeted with this message:
To turn the SAML-configuration for a Connection Profile off and on again, either use the commands below or do it from ASDM on the Connection Profile > Basic > change SAML Identity Provider to “None” > click OK and Apply, then go back and reselect the SAML-server in the scroll list and click OK and Apply again.
Enter you Connection Profile/Tunnel Group:
Remove SAML-server from Connection Profile:
Asa Ipsec Vpn Certificate Authentication
Re-add SAML-server to Connection Profile:
What the IdP-administrator will need from you
Your ASA certificate which is used on the “outside” interface of your ASA and for VPN-connections, they will need it to complete the trust between the ASA and the IdP.
Your SAML metadata which can be found if you (on the outside of the ASA) browse to the URL of your ASA and access the SAML-resource portion of your Connection Profile (the so-called metadata). For example, if your VPN URL is https://vpn.mydomain.com and your Connection Profile is called VPN-SAML-AUTH then your metadata-URL would be: https://vpn.mydomain.com/saml/sp/metadata/VPN-SAML-AUTH. You know the URL is correct if you get something like the image below if you browse to the URL. You can also get this information via the CLI using the command show saml metadata <Connection Profile name> which in my case would be show saml metadata VPN-SAML-AUTH.
Make sure to tell the IdP-administrator that you want the SAML-attribute NameID included in the SAML-response from the IdP when it tells the ASA if an authentication attempt was successful or not. If you do seperate authorization (via ISE for example), this will be the username that is sent to the authorization server. The NameID will also be what you, in the ASA, will see at the username for a remote-access VPN-session.
Agree upon what Request Signature to use and (optionally) a Request Timeout. A tips is to start by setting no Request Timeout on the ASA’s side and just let the IdP deal with this however it wants to to see if it just works right out of the box.
Making changes to the SAML-configuration on the ASA could change your SAML-metadata and the IdP-administrator might need to change something on their side as well, so always ask the IdP-administrator to verify that they have the latest metadata from your ASA.
Debugging SAML-authentication attempts
Your first few attempts of connecting to the SAML VPN is probably gonna go bad and then I would recommend this debug command to see if there is anything wrong with the SAML-connection from your ASA (the SP) and the IdP.
Asa Vpn Certificate Online
Using the debug above you get to see the actual creation of SAML-requests being sent between the ASA and the IdP. The 255 at the end is the debug level, with 255 providing you with the most output.
In my experience, I have run into trouble where the IdP has been trying to send SAML-attributes to the ASA that the ASA is not able to interpret or understand which would show up in the debugging log as:
Here the SAML-attribute AuthnContextDeclRef is sent to the ASA from the IdP after authentication is successful, but the ASA does not know what this attribute is and therefore the VPN-authentication fails. If you run into this you pretty much have to ask your IdP administrator to make the IdP not send this attribute as there is no way to fix this on the ASA’s side due to the very limited SAML-configuration parameters of the ASA OS.
Another trouble you could run into is that the clock of the ASA and the IdP is not synchronized or that the timeout for the SAML-tickets/sessions are not in agreement between the ASA and the IdP. This could happen if you define a Request Timeout in the ASA configuration for the SAML-server and the ASA tries to override the timeout values set by the IdP. This is what you could see in the debug then:
Drawbacks of using SAML
As of this writing (March 6th 2020) there is no easy way to apply different authorization rules for VPN users after they authenticate, like you would with Dynamic Access Policies (DAP) in ASA. The SAML-standard itself support many types of authorization parameters, but the ASA is unable to understand these. What you can do is let a separate authorization take place after the SAML-authentication, using either an LDAP-catalog or RADIUS-server, to get a second look at the user and then change authorization depending on group membership or account attributes, for example.
In order to not get the annoying “Invalid certificate” errors in Internet Explorer we need to purchase and install a third party certificate for the ASA. Then we can associate the WebVPN with the certificate so we don’t get the warnings. Of course, you can do this through the ASDM, but what fun is that? CLI all the way, here we go.
-Insert your relevant information between <>
-Console prompts are show in green
-Text in blueare variable names I made up, feel free to change them
-Note sections are in italics and embedded directly within the code below
-During the install/setup the CLI asks several questions. I note when they will appear by inserting a line beginning with ‘Question Prompt –‘ in between the lines of code. I also put the response you should enter after the line in bold.
Verify that your clock is set correctly
To do this, issue the ‘show clock’ command at the CLI. If it isn’t configured correctly, define a NTP server (Which you should have done during initial config) and ensure your time zone is set correctly. I usually use us.pool.ntp.org as an NTP server. You can resolve it to an IP to get rid of the DNS lookup.
Generate the CSR
ASA(config)# crypto key generate rsa label <Your domain name> modulus 2048
Notes: I use the domain name that I am going to use for the label name, it just makes it easier if everything is the same (FQDN, System FQDN, Label, etc….). An example would be ‘SSLVPN.test.com’. Additionally I use a 2048 bit modulus because GoDaddy (The third party CA I am using) will no longer accept the 1024 bit modulus.
ASA(config)# crypto ca trustpoint <Your domain name>
ASA(config-ca-trustpoint)# subject-name CN=<Your domain name>, OU=<Organization Unit>, O=<Organization Name>, C=<Country (US)>, St=<Your State>, L=<Your City>
ASA(config-ca-trustpoint)# keypair <Your domain name>
ASA(config-ca-trustpoint)# fqdn <Your domain name>
ASA(config-ca-trustpoint)# enrollment terminal
ASA(config)# crypto ca enroll <Your domain name>
Question Prompt – Include the device serial number in the subject name? [yes/no]:NO
Question Prompt – Display Certificate Request to terminal? [yes/no]:YES
Notes: After answering YES the CLI will output the CSR. You need to copy the CSR so you can submit it to your Certificate Authority (GoDaddy in this case)
Redisplay enrollment request? [yes/no]:NO
Submit your CSR to your Certificate Authority
Again, I used GoDaddy because it seemed to be the cheapest. The certificate was less then $30 for the year. You purchase a certificate credit and then when you are ready to submit your CSR you go into their Certificate Management Portal under your login and submit the CSR. After submitting the request it took about 5 minutes for my certificate to be generated. You download the certificate file in Zip format. In the Zip file you should have two certificates. One is the certificate for the FQDN which you purchased and the other is the certificate for the CA. This is where it gets a little tricky. First you need to authenticate the CA by importing their certificate. Then you need to import your actual certificate. I’m not going to get into the details of how certificates work but if you don’t know how, you should find out. Google ‘Public Key encryption’. Alright, so my Zip file had two certificates in it.
gd_bundle.crt – The certificate for the CA
<Domain name>.crt – The certificate for my domain
You’ll need to export both of the certificates to Base-64 encoded X.509. To do this in Windows double click the certificate. A certificate window with three tabs should appear as shown below.
Click on the second tab ‘Details’ and select the ‘Copy to File…” button
This will open the Certificate Export Wizard. Press NEXT
On the next screen select ‘Base-64 encoded X.509 (.CER)’ and press NEXT
On the following screen select a location to output the file to and press NEXT
Press FINISH on the summary screen. You should get a pop up window indicating that export was successful.
Now browse to where you chose to store the certificate, right click on it, select ‘Open With’, and choose WordPad. When you open it in WordPad you should get something similar to what is shown below.
Perform this certificate Export for your certificate as well as the CA’s certificate. During the rest of the walk through I will refer to these exports as “CA Certificate”(The CA’s certificate) and “CA Certificate Response”(The certificate for your domain).
Install the certificates on the ASA
ASA(config)# crypto ca authenticate <Your domain name>
Notes: You will now receive the prompt shown below.
”Enter the base 64 encoded CA certificate. End with the word 'quit' on a line by itself”
Copy the CA Certificate and paste it into the CLI window. Then make sure you are on a new line, type to the word quit, and press enter.
Question Prompt – Do you accept this certificate? [yes/no]:yes
Notes: After you accept the certificate you should get a message indicating that the certificate import was successful
ASA(config)# crypto ca import <Your domain name> certificate
Notes: You will now receive the prompt shown below.
”Enter the base 64 encoded CA certificate. End with the word 'quit' on a line by itself”
Copy the CA Certificate Response and paste it into the CLI window. Then make sure you are on a new line, type to the word quit, and press enter. After you press enter you should get a message indicating that the certificate import was successful
Asa Vpn Certificate Login
Tell WebVPN to use your new certificate
ASA(config)# ssl trust-point <Your domain name> outside
You can use the command ‘show crypto ca certificates’ to verify that your certificates imported successfully. Of course the other way to test would be to just connect to the outside IP on SSL and see if you still get that annoying warning.