FTD · VPN

FTD-style: remote access VPN from the manager

alice works from home on LAP1, behind the provider. PC1 is only reachable inside. On an ASA you would type about thirty lines. On the manager, one wizard describes the connection, and a deployment sends those lines: read them in the preview.

Cisco FTD-style track · Cisco FTD-style, FTD Manager, Cisco router · 4 objectives

Open in simulator More Cisco FTD-style labs

Objectives

The simulator ticks each one as soon as the network meets it.

On Remote Access VPN, add connection RA on FTD1: outside to inside, network object LAN, pool 10.99.0.10 to 10.99.0.50 /24, split tunnel on, user alice with password Lab123.
Add a second user, bob, with password Lab456.
Read the preview, and deploy.
On LAP1: vpn connect 203.0.113.1 user alice password Lab123 group RA, then ping 192.168.1.10. The Remote Access VPN page lists alice’s session.

Start this lab

Before you start

The AnyConnect image and client are stood in for: no software is installed. The manager never shows a password again, and the logs hide it. Clientless WebVPN is not modeled on FTD.

Concept

Remote access: AnyConnect and a clientless portal

A user logs in to the firewall from outside. With AnyConnect the firewall gives the user an address from a pool and a tunnel, and split tunnelling decides which traffic goes through it. With the clientless portal the user gets no address, only bookmarks that the firewall fetches. Each login lands in a tunnel-group, and a group policy says what that user may do.

Concept

Nothing changes until you deploy

A manager holds intent. Editing it changes nothing on any firewall, and a device shows Pending when the two differ. Deploy compiles the policy to configuration lines and replaces the firewall’s configuration as one change. If a line fails, the firewall goes back to what it had.