{"id":2807,"date":"2026-01-24T22:01:36","date_gmt":"2026-01-24T22:01:36","guid":{"rendered":"https:\/\/www.balajibandi.com\/?p=2807"},"modified":"2026-01-24T22:01:36","modified_gmt":"2026-01-24T22:01:36","slug":"fmc-and-ftd-external-authentication-with-cisco-iseusing-microsoft-active-directory-as-the-backend","status":"publish","type":"post","link":"https:\/\/www.balajibandi.com\/?p=2807","title":{"rendered":"FMC and FTD External authentication with Cisco ISE(Using Microsoft Active Directory as the Backend)"},"content":{"rendered":"\n

Part of CCIE Sec Lab Learning – Additional like to add FMC external Authentication testing.<\/strong><\/mark><\/h2>\n\n\n\n

Centralized authentication is one of those things that feels \u201coptional\u201d until the day it absolutely isn\u2019t. Local FMC users scattered across environments don\u2019t scale, don\u2019t audit well, and don\u2019t survive staff turnover gracefully.<\/p>\n\n\n\n

This post walks through a clean, enterprise-grade design<\/strong> for authenticating Cisco FMC and FTD administrators via Cisco ISE<\/strong>, with Microsoft Active Directory as the identity source<\/strong>.<\/p>\n\n\n\n

\n\n\n\n

Why Use ISE for FMC \/ FTD Authentication?<\/mark><\/h2>\n\n\n\n

At first glance, FMC can authenticate directly against AD or LDAP. So why put ISE in the middle?<\/p>\n\n\n\n

Because ISE gives you:<\/p>\n\n\n\n

    \n
  • Centralized policy control<\/strong> (who gets access, and how)<\/li>\n\n\n\n
  • Consistent authentication logic<\/strong> across network, VPN, firewall, and admin access<\/li>\n\n\n\n
  • Role-based access control<\/strong> mapped cleanly to FMC roles<\/li>\n\n\n\n
  • AAA auditing<\/strong> in one place<\/li>\n\n\n\n
  • Flexibility to later add MFA<\/strong>, posture, or certificate-based auth<\/li>\n<\/ul>\n\n\n\n

    Think of ISE as the policy brain<\/em>, and AD as the identity store<\/em>.<\/p>\n\n\n\n

    Lab Topology :<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    Pre-Requisites :<\/strong><\/mark><\/p>\n\n\n\n

    Infrastructure<\/h3>\n\n\n\n
      \n
    • Cisco FMC (virtual) \/ FTD (Virtual) – using here 7.7 Latest Version<\/li>\n\n\n\n
    • Cisco ISE (3.x)<\/li>\n\n\n\n
    • Microsoft Active Directory domain (using Windows 2019)<\/li>\n\n\n\n
    • Time synchronization (NTP) across all systems (i am using IOL for NTP – get External from Public NTP)<\/li>\n<\/ul>\n\n\n\n

      Connectivity<\/h3>\n\n\n\n
        \n
      • FTD register (or Managed) with FMC<\/li>\n\n\n\n
      • FMC ↔ ISE: RADIUS (UDP 1812\/1813)<\/li>\n\n\n\n
      • ISE ↔ AD: LDAP \/ Kerberos<\/li>\n\n\n\n
      • DNS resolution working everywhere<\/li>\n<\/ul>\n\n\n\n

        Accounts<\/h3>\n\n\n\n
          \n
        • AD admin account (for ISE AD join)<\/li>\n\n\n\n
        • FMC admin access (local for setting external Authentication)<\/li>\n\n\n\n
        • ISE admin access (Local Account to Manage IS)<\/li>\n\n\n\n
        • AD Accounts for FMC GUI and CLI \/ FTD cli (Admin Account and Read Only account)<\/li>\n<\/ul>\n\n\n\n

          Integrate ISE with Active Directory<\/mark><\/h2>\n\n\n\n

          On Cisco ISE:<\/p>\n\n\n\n

            \n
          1. Navigate to
            Administration \u2192 Identity Management \u2192 External Identity Sources \u2192 Active Directory<\/strong><\/li>\n\n\n\n
          2. Join ISE to the domain<\/li>\n\n\n\n
          3. Verify:\n
              \n
            • User authentication works<\/li>\n\n\n\n
            • AD groups are visible<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n
              \"\"<\/figure>\n\n\n\n

              We need to get AD Groups for Admin and Read only Users :<\/p>\n\n\n\n

                \n
              1. Import External Groups
                Before you can write a policy, ISE needs to “know” about the specific groups in your AD.
                Navigate to Administration > Identity Management > External Identity Sources.
                Select Active Directory and choose your Join Point.
                Click the Groups tab.
                Click Add > Select Groups from Directory.
                Click Retrieve Groups.
                Check the boxes for the groups you want to use (e.g., FMCadmin and FMCuser) and click OK.
                Save the configuration.<\/li>\n<\/ol>\n\n\n\n
                \"\"<\/figure>\n\n\n\n
                  \n
                1. Configure the Authorization Policy
                  Now that the groups are imported, you can reference them in your Policy Set.
                  Navigate to Policy > Policy Sets.
                  Select the Policy Set (in this example – FMC and FTD Access) click on ><\/li>\n<\/ol>\n\n\n\n
                  \"\"<\/figure>\n\n\n\n


                  Open the Authorization Policy section.
                  Click the + icon to create a new rule.
                  In the Conditions column, click the + to open the Condition Studio.
                  Click Create New Condition.
                  Select the Attribute Selector (the icon that looks like a folder\/dictionary).
                  Choose your AD Join Point (e.g., MyAD:ExternalGroups).
                  Select the Equals operator and choose the group imported.
                  Click Use.<\/p>\n\n\n\n

                    <\/ol>\n\n\n\n
                    \"\"<\/figure>\n\n\n\n

                    Assign the appropriate Profiles (e.g., PermitAccess) and Security Groups (SGTs).
                    Save the policy.<\/p>\n\n\n\n

                    Now we configured FMC side to use ISE for External authentication.<\/p>\n\n\n\n

                    Click Settings –> USers<\/p>\n\n\n\n

                    \"\"<\/figure>\n\n\n\n
                      <\/ol>\n\n\n\n

                      Click External Authentication :<\/p>\n\n\n\n

                      \"\"<\/figure>\n\n\n\n

                      Click Add External Authentication Objects <\/p>\n\n\n\n

                      \"\"<\/figure>\n\n\n\n

                      Key parts of the configuration to work :<\/p>\n\n\n\n

                      \"\"<\/figure>\n\n\n\n

                      Part2 :<\/p>\n\n\n\n

                      \"\"<\/figure>\n\n\n\n

                      before save we can do some testing with users from AD with password<\/p>\n\n\n\n

                      \"\"<\/figure>\n\n\n\n
                      \"\"<\/figure>\n\n\n\n

                      we will test ReadUser from AD Group<\/p>\n\n\n\n

                      \"\"<\/figure>\n\n\n\n
                      \"\"<\/figure>\n\n\n\n

                      Click Save<\/p>\n\n\n\n

                      Now we enable External Authentication and test it.<\/p>\n\n\n\n

                      \"\"<\/figure>\n\n\n\n

                      Logout from Admin and test using Admin and Readuser account.<\/p>\n\n\n\n

                      \"\"<\/figure>\n\n\n\n
                      \"\"<\/figure>\n\n\n\n
                      \"\"<\/figure>\n\n\n\n

                      You only see less menu compare to admin as below :<\/p>\n\n\n\n

                      \"\"<\/figure>\n\n\n\n

                      Now we test SSH connection to FTD and FMC<\/p>\n\n\n\n

                      FMC Cli Access for ftdadmin user<\/p>\n\n\n\n

                      \"\"<\/figure>\n\n\n\n

                      FTD cli access <\/p>\n\n\n\n

                      \"\"<\/figure>\n\n\n\n

                      Verify the user (you can notice auth remote)<\/p>\n\n\n\n

                      \"\"<\/figure>\n\n\n\n

                      In the ISE Radius Live Logs you can see the success logs :<\/p>\n\n\n\n

                      \"\"<\/figure>\n\n\n\n

                      Happy Labingggggggggggggggggggggg!<\/strong><\/p>\n\n\n\n

                      <\/p>\n","protected":false},"excerpt":{"rendered":"

                      Part of CCIE Sec Lab Learning – Additional like to add FMC external Authentication testing. Centralized authentication is one of those things that feels \u201coptional\u201d until the day it absolutely isn\u2019t. Local FMC users scattered across environments don\u2019t scale, don\u2019t audit well, and don\u2019t survive staff turnover gracefully. This post walks through a clean, enterprise-grade […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,2],"tags":[],"class_list":["post-2807","post","type-post","status-publish","format-standard","hentry","category-ccie-sec","category-cisco"],"_links":{"self":[{"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/posts\/2807","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2807"}],"version-history":[{"count":1,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/posts\/2807\/revisions"}],"predecessor-version":[{"id":2830,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=\/wp\/v2\/posts\/2807\/revisions\/2830"}],"wp:attachment":[{"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2807"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2807"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.balajibandi.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2807"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}