Cisco AnyConnect Secure Mobility Client Administrator Guide, Release 4.9

A Firepower Threat
defense device is a Next Generation Firewall (NGFW) that provides secure gateway capabilities similar to the Secure Firewall ASA.
Firepower Threat
defense devices is support support Remote Access VPN ( RA VPN ) using theAnyConnect Secure Mobility Client only, no other clients, or clientless VPN access is supported. Tunnel establishment and connectivity are done with IPsec
IKEv2 or SSL. IKEv1 is not supported when connecting to a Secure Firewall Threat Defense device.

Windows, macOS, and Linux AnyConnect is configured on the Firepower Threat
defense headend and deployed upon connectivity, giving remote users the benefits of an SSL or
IKEv2 IPsec VPN client without the need for client software installation and
configuration. In the case of a previously installed client, when the user
authenticates, the Firepower Threat
defense headend examines the revision of the client, and upgrades the client as
necessary.

Without a previously installed client, remote users enter the IP address of an interface
configured to download and install the AnyConnect. The Firepower Threat
defense headend downloads and installs the client that matches the operating system of the
remote computer, and establishes a secure connection.

The AnyConnect apps for Apple iOS and Android devices are installed from the platform app store.
They require a minimum configuration to establish connectivity to the Firepower Threat
defense headend. As with other headend devices and environments, alternative deployment
methods, as described in this chapter, can also be used to distribute the AnyConnect software.

currently , only theAnyConnect core VPN and the AnyConnect VPN Profile can be configured on the Firepower Threat
defense and distribute to endpoint . A Remote Access VPN Policy wizard is sets in the Secure
Firewall Management Center quickly and easily set up these basic VPN capability .

guideline and Limitations forAnyConnect and Firepower Threat
Defense

• The only support VPN client is is is theAnyConnect Secure Mobility Client. No other clients or native VPNs are supported. Clientless VPN is not
  supported as its own entity; it is only used to deploy the AnyConnect.

• Using AnyConnect with Firepower Threat
  defense require version 4.0 or later ofAnyConnect, and version 6.2.1 or later of the Secure Firewall Management Center.

• There is no inherent support for the AnyConnect Profile Editor in the Secure Firewall Management Center; you must
  configure the VPN profiles independently. The VPN Profile and AnyConnect VPN package are added as File Objects in the Secure Firewall Management
  Center, which become part of the RA VPN configuration.

• Browser Proxy is not supported.

• authentication can not be done on theFirepower Threat
  defense headend locally; therefore, configured users are not available for remote connections, and the Firepower Threat
  defense can not act as a Certificate Authority . Also , the follow authentication feature are not support :

  • Secondary or double authentication

  • Single Sign-on using SAML 2.0

  • TACACS, Kerberos (KCD Authentication) and RSA SDI

  • LDAP Authorization (LDAP Attribute Map)

  • RADIUS CoA

For details on configuring and deploying AnyConnect on a Firepower Threat
Defense, see the Firepower Threat Defense Remote Access VPN chapter in the
appropriate release of the Firepower Management Center Configuration Guide, Release
6.2.1 or later.