Configure Cisco Firepower Management Center to interoperate with Okta via RADIUS
Okta provides the ability for organizations to manage authorization and access to on-premises applications and resources using the RADIUS protocol and the Okta RADIUS agent. With the Okta RADIUS Server Agent organizations can delegate authentication to Okta.
This page describes how to configure Cisco Firepower Management Center and Cisco Firepower Threat Defense Next General Firewall to use Okta RADIUS Server Agent for MFA.
Typical architecture
Typically a client uses the Cisco anyconnect Secure Mobility client connecting to a Cisco Firepower firewall. Users are authenticated using the Okta RADIUS agent backed by Microsoft Active directory. During authentication MFA is used, often using a mobile device. See Supported factors for a complete list of supported factors.
Topics
- Before you begin
- Configure Cisco Firepower Management Center to interoperate with Okta via RADIUS
- Supported factors
- Typical workflow
Before you begin
Before installing the Okta RADIUS Agent ensure that you have met these minimum requirements for network connectivity:
Source | Destination | Port/Protocol | Description |
---|---|---|---|
Okta RADIUS Agent | Okta Identity Cloud | TCP/443 HTTP |
Configuration and authentication traffic |
Client Gateway | Okta RADIUS Agent | UDP/1812 RADIUS (Default, may be changed in RADIUS app install and configuration) | RADIUS traffic between the gateway (client) and the RADIUS Agent (server) |
Supported factors
The following MFA Factors are supported:

When integrating with Okta RADIUS, the maximum supported number of enrolled factors is dependent on the size of resulting challenge message. Okta recommends that no more than eight ( 8 ) factor be enrolled at one time.
MFA Factor | Password Authentication Protocol PAP |
---|---|
Custom TOTP Authentication | Supported |
Duo(Push, SMS and Passcode only) | Supported |
Supported |
|
Google Authenticator | Supported |
Supported | |
Supported |
|
Supported | |
SMS authentication | Supported |
Symantec VIP | Supported |
Supported | |
Supported |

Note
The U2F Security and Windows Hello MFA factors are not compatible with RADIUS-enabled implementations.
For additional information about the RADIUS apps refer to Configuring RADIUS applications in Okta.
Supported versions, clients and features
Versions
Software version | Role |
Windows Server 2016 Standard | Windows domain controller |
Windows Server 2016 Standard |
Windows application server |
Cisco Firepower Thread Defense 6.4.0.9 | NGFW Firewall |
Cisco Firepower Virtual Management Center |
NGFW Management |
Clients
Software version | Role |
Windows 10 |
Desktop client |
Cisco Anyconnect Secure Mobility Client 4.6.01103 |
Windows remote VPN agent |
Typical workflow
Task |
Description |
---|---|
Download and install. the RADIUS agent |
For throughput, availability and other considerations, see Okta RADIUS Server Agent Deployment Best Practices. |
Optional
Download and Install the Okta AD agent |
Optional
|
Configure application |
|
Configure the Cisco Firewall Management Center |
|
Test |
|