Cisco FTD SAML VPN with Google Workspace

Oct 26, 2026 · @Joshua Kelly

This runbook configures Remote Access VPN on an FMC-managed Cisco FTD to authenticate users through Google Workspace SAML. Field names follow FMC 7.x and may differ slightly in other versions. Examples use vpn.company.com as the VPN FQDN and Google_SAML as the connection profile name; substitute your own.

Prerequisites

• FMC and FTD on 6.7 or later (SAML for RA VPN was added in 6.7; external browser login needs 7.1 or later)
• RA VPN licensing (Secure Client Advantage or Premier) and a Secure Client package uploaded to FMC
• Public FQDN for VPN with DNS pointing to the FTD outside interface
• Trusted identity certificate for that FQDN enrolled on the FTD
• NTP configured on the FTD (SAML assertions are time-sensitive; clock skew is a common failure)
• Base URL and connection profile name decided up front (no spaces in the profile name); both go into the URLs below

Step 1: Create the SAML app in Google

1. In the Google Admin console, go to Apps → Web and mobile apps → Add app → Add custom SAML app.
2. Name the app (e.g. "Cisco VPN") and click Continue.
3. On Google Identity Provider details, copy the SSO URL and Entity ID, and download the Certificate. All three go into FMC. Click Continue.
4. Under Service provider details, enter:
   • ACS URL: https://vpn.company.com/+CSCOE+/saml/sp/acs?tgname=Google_SAML
   • Entity ID: https://vpn.company.com/saml/sp/metadata/Google_SAML
   • Start URL: leave blank
   • Signed response: optional (FTD accepts either)
   • Name ID format: EMAIL
   • Name ID: Basic Information → Primary email
5. Skip attribute mapping for basic access and click Finish.
6. Open the app, go to User access, and turn it ON for the OUs or groups that need VPN. Without this, users get Google error 403 app_not_configured_for_user.

The Entity ID and ACS URL are not supplied by the FTD; they are built from the Base URL and the connection profile name, and must match exactly, including case.

Step 2: Import the Google IdP certificate into FMC

1. Go to Objects → Object Management → PKI → Cert Enrollment → Add.
2. Name it (e.g. Google_IdP_Cert) and set Enrollment Type to Manual.
3. Check CA Only and paste the contents of the Google certificate.
4. On the Advanced tab, check Skip Check for CA flag in basic constraints of the CA Certificate. Google's cert is not a CA cert, so the import fails without this.
5. Save, then go to Devices → Certificates → Add, select the FTD and the Google_IdP_Cert enrollment, and click Add to install it.

Step 3: Create the Single Sign-On Server object

Go to Objects → Object Management → AAA Server → Single Sign-on Server → Add and fill in:

Field	Value
Name	e.g. Google_SSO
Identity Provider Entity ID	Google's Entity ID from Step 1
SSO URL	Google's SSO URL from Step 1
Logout URL	Leave blank (Google doesn't support SAML single logout)
Base URL	https://vpn.company.com
Identity Provider Certificate	Google_IdP_Cert
Service Provider Certificate	Optional; can be the FTD's VPN identity cert
Request Signature	None
Request Timeout	Default
IdP only accessible on internal network	Unchecked
Request IdP re-authentication at login	Optional; check to force a Google login on every connection

Save the object.

Step 4: Configure the Remote Access VPN policy

Go to Devices → VPN → Remote Access, then edit the existing policy or run the wizard.

1. Connection Profile: add or edit a profile named exactly Google_SAML, matching the URLs in Google, including case.
2. AAA tab:
   • Authentication Method: SAML
   • Authentication Server: Google_SSO
   • SAML Login Experience (7.1+): embedded browser or default OS browser. The OS browser is usually smoother with Google because it reuses Google sessions and handles passkeys and security keys better; it needs a recent Secure Client.
   • Authorization and Accounting: optional; leave empty for SAML-only access.
3. Client Address Assignment: assign an IP pool or DHCP.
4. Group Policy: assign the policy with split-tunnel, DNS and other settings.
5. Aliases: add a group alias (e.g. Google_SAML) so users can pick it in Secure Client. Optionally add the group URL https://vpn.company.com/Google_SAML.
6. Access Interfaces: select the outside interface and the identity certificate for vpn.company.com.
7. Secure Client image: confirm a package is assigned.
8. Save the policy.

Step 5: Deploy

Deploy the pending changes from FMC to the FTD.

Step 6: Verify

From the FTD CLI, enter system support diagnostic-cli, then run:

Command	What to check
show saml metadata Google_SAML	Entity ID and ACS URL exactly match Google
show running-config webvpn	SAML IdP is defined
show running-config tunnel-group Google_SAML	SAML IdP is bound to the profile
show vpn-sessiondb anyconnect	After a test login, the session shows the user's email

Test by connecting Secure Client to vpn.company.com, selecting the Google_SAML group, and signing in with Google.

Troubleshooting

Run debug webvpn saml 255 in the diagnostic CLI while testing, then match the symptom:

Symptom	Likely cause and fix
Google 403 app_not_configured_for_user	App not turned on for the user's OU or group, or the change hasn't propagated yet (up to 24 hours, usually less)
Entity ID or ACS mismatch	Compare show saml metadata output with Google character by character
Assertion rejected or expired	FTD clock is off; check show clock and show ntp associations
Signature or certificate error	IdP cert from Step 2 isn't the current Google cert. Google SAML certs expire after 5 years, so track the renewal date
Login page loops or won't load	Switch the SAML login experience to the default OS browser