Cisco VPN :: ASA 5510 - AnyConnect VPN Multiple Connection Profiles?
Nov 9, 2011
I use a Cisco ASA 5510 with the AnyConnect VPN for remote workers. Now we want to give access to a select group of consultants who only need access to one sever and block everything else.
I was thinking this could be done by creating a separate AnyConnect Connection Profile on the ASA. From that new connection will come a new GroupPolicy with a ACL to only allow access to the one system. That GroupPolicy will point to the Radius Server looking for an account in a specific MemberOf group.
My question is - Could you explain how the ASA knows what Connection Profile to use when a user tries to authenticate? Does it automatically hunt down each Connection Profile until there is a username match via RADIUS in the Connect Profile?
View 1 Replies
ADVERTISEMENT
Jan 18, 2012
We have 2 ASA 5510's running in a Active/Standby configuration. It appears that most of the changes we make on the active unit are replicated to the standby unit. However, there are 3 AnyConnect Client Profiles on the active unit and none of them show up on the standby, the standby has no AnyConnect Profiles. We also have 1 OnConnect script on the active unit and it does not appear on the standby unit either.
I was under the assumption that all config items on the active unit would replicate to the standby. Is this not correct? Do I need to do something extra to get everything replicated? Are there other items that do not replicate?
View 3 Replies
View Related
Feb 15, 2012
I recently upgraded to Windows 7 in my company and the OS came bundled with Anyconnect VPN client version 2.5.
In the earlier version I used to add user profile using a .pcf file by importing it into the client to access customer LAN.
But in the Anyconnect VPN client I dint find any option to import the file. The IT support has told to edit the xml file to add it. The problem is I even after i edit the anyconnect-cert.xml with changes in host name and host address tags I am not able to start a connection. I dont knw know exactly what address must be given in Host address tag. I copied the host address from .pcf file which i used earlier.
Whether I will be able to add a user profile in this way or any correction is to be done in the whole process of adding the user profile,
View 1 Replies
View Related
Mar 3, 2010
I have an ASA running 8.2.x code with AnyConnect 2.4.x.I have both Radius and LDAP (AD) AAA available.If a user connects from a company owned laptop, I want to push down AnyConnect client ProfileA (with scripts to map drives etc...) and network ACL's set A.
If a user connects from any other computer, I want to push down AnyConnect client ProfileB (no scripts etc...) and network ACL's set B.
What I would like to do is CSD to do a machine certificate check (for presence of a cert from my private CA) and to assign a EndPoint Policy attribute (Managed on successful check or Unmanaged on failure). I can then use DAP to tailor the ACL's that get set.
It seems like the only way to handle AnyConnect client profiles is with Group-Policy. Using LDAP I can assign a user to a Group-Policy, but I have no way of determining is they are coming in from a company laptop or not when assigning the Group-Policy. DAP can not assign an AnyConnect client profile.
If at all possible, I do not users to have to pick a conenction profile or use different URL's.
View 1 Replies
View Related
May 21, 2012
I have a question about ACS 5.3 and ASA VPN profile authorization. I am not sure if it is possible to allow one single user for a set of VPN profiles on ASA, let's make an example:ACS 5.3 group hierarchy:VPN users global should have access to VPN profiles A, B and Z (here we create an authorization profile with no class an no lock attributes, so the group is allowed for all VPN profiles),VPN users A should have access to VPN profile A (here we create a authorization profile with class and lock attributes for profile A),VPN users B should have access to VPN profiles B and Z (is this possible and how does the authorization profile have to look like?)
View 3 Replies
View Related
Apr 3, 2011
Is there a way that i can associate one user with two VPN profiles. Now here is the scenario.Our company has bought a win 7 64 bit pc for some of the employees , so i had to create anyconnect. But the same users are also connecting via normal cisco vpn client. they will give away these old pc but for the time being my need is that both users shall connect to anyconnect profile and ipsec profile.
I tried ti to assign same profile with both ipsec and svc so that they could use single profile but anyconnect didn't work. I am having cisco ASA 5510 as VPN gateway.And How many licenses does cisco asa have by default for anyconnect users. Here is the configuration for anyconnect
group-policy Broad_Anyconnet internalgroup-policy Broad_Anyconnet attributes dns-server value 4.2.2.2 vpn-tunnel-protocol svc webvpn split-tunnel-policy tunnelspecified split-tunnel-network-list value Nit_Broadcast_Network_Tunn_ACL address-pools value Broadcast_AnyPool webvpn svc ask none default svc
[Code]...
View 5 Replies
View Related
Dec 11, 2012
I have configured anyconnect for phone at ASA 5510. Phone can connect to Corporate network through VPN from outside without any problem.
If I connect laptop to PC port at phone, I can run anyconnect client at pc and get vpn connection through phone. Can I get VPN connection for laptop through phone without running anyconnect client at the laptop i.e. can phone share VPN connection for laptop at PC port?
View 1 Replies
View Related
May 30, 2012
Two ASA-5510 in Failover.I already have several VPN with Cisco VPN client.Now I have the requirement to activate new AnyConnect VPN, witch "migrate" the old VPN to.The customer does not want to purchase licenses for SSL VPN, and then I have to configure the AnyConnect on IPSEC.I read that AnyConnect over IPSEC don't need SSL license - is this right?
Client version 2.5.3055.On the ASA with 8.4.2 (ASDM 6.4.7) I don't find HOW to configure the IPSEC for AnyConnect, while a friend of mine with 8.4.3 did it.Is there a way to configure using CLI, or is an item of the 8.4.2 ?When I try to connect, after authenticating Username & Password, I receive (on the client) a message "AnyConnect was not able to establish a connection to the specified secure gateway." On the "Real Time Log Viewer" I see only SSL, never IKE nor IPSEC
View 1 Replies
View Related
Jan 4, 2012
I am simulating Anyconnect VPN connection in the lab.I have an issue while configuring Anyconnect VPN on ASA5510.
I can have a successfull anyconnect connection but i can't ping my firewall Interface IPs while i am in the connection.
ASA 5510
Outside IP: 192.168.1.1/24
PC connected to Outside Interface: 192.168.1.10/24
Inside IP:10.10.10.1/24
PC connected to Inside Interface: 10.10.10.100/24
Pool : 10.20.20.11 - 10.20.20.50 /24
I have a successful VPN connection & the PC connected to the outside Interface gets an IP address from the assigned pool (10.20.20.11 with default gateway of 10.20.20.1).But i can't reach (ping/telent) to the ASA while I am on the anyconnect VPN connection.
I beleive it is mostly due to NAT/Routing issue..
View 10 Replies
View Related
Sep 11, 2012
We are starting to deploy SSL VPN in our company and we recently purchased two ASA 5510 firewalls. I have already completed the initial configuration but I do have some inquiry on how to have it configured properly.
1. Employees and clients will access the URL
2. They will select the appropriate group on where they should login.
3. Enter credentials, etc.
4. Username/Password authentication is via RADIUS. The usernames were all created in Cisco ACS 5.3.
My challenge is, we have several clients and all their usernames were created in ACS5.3. Meaning if the configuration is just being differentiated by group settings, clientA can select the profile of clientB and still get authenticated. If that happens, they will be able to access the resources of each other. Also in the future, we will be deploying 2-Factor authentication for some of our clients.
View 4 Replies
View Related
Feb 7, 2013
i've two cisco asa5510 with 4 FastEthernet interfaces each.They are connected as below:
[code]...
to three different ISP each of them! The 4rth interface of each of them, is connected to internal LAN network. Both Firewalls, offers VPN Services to ISP connections on Fa0/0
How can i achieve high availability for this scneario?is this possible to implement some HighAvailability and to offer the actual services to each of them, in case that the other firewall fail?What about using subintefaces? can i connect bothe ISP and Customers links on one or each of them, in case that firewall01 fails, all the services to be online on firewall02?
View 1 Replies
View Related
Aug 13, 2012
Our current cable ISP is having issues providing us with consistant connectivity. I would like to bring in a second ISP to allow my users to choose where they will connect to. There will be two dns names and i just want to to be able to choose between them.
Is this possible on the ASA5505? supporting two ISPs at one time for VPN on both?
View 3 Replies
View Related
Apr 3, 2012
I am facing problem connecting via vpn to my asa5510 using anyconnect.My anyconnect client shows "network access: unavailable - no networks detected" before i attempt to establish my vpn.Upon establishing vpn, i was prompted username and password which went through but i was given the error "anyconnect was not able to establish a connection to the specified secure gateway. Please try connecting again".I face this problem after replacing my pc. I was able to connect without problems on my previous pc.The vpn connection uses cert which i have already import to my new pc and authentication is fine since no authentication error. No changes made on my firewall.
View 1 Replies
View Related
May 23, 2012
I have an ASA 5510 I'm trying to use as an SSL VPN provider. I have Anyconnect windows and mobile licenses from Cisco. I'm looking for a straight forward configuration guide to use. Right now I only need to iPhone and Android clients to work with the VPN, but in the future we might add windows clients.
I was going to use this guide: [URL]. Until I talked to Cisco tech support, they recommended I use the following:[URL] Which is a lot longer and a bit unclear about the whole process, and also points me to this guide:[URL]Which is longer still, and not applicable for the most part.So, what's going to be the best guide to use? Did I have it right the first time? Do I need to go to another site to find something?
View 1 Replies
View Related
May 17, 2011
we have ASA 5510 with IPS and base license. Now we need Anyconnect support for more than 2 users.
Is for Anyconnect (tunnel-mode) only the Anyconnect Essentials license enough? Do I need a license for SSL VPN peers? What about Anyconnect clientless, I see that I need a premium license? Is this one enough ASA5510-SSL50-K9? It is really expensive in comparison with Anyconnect Essentials.
Here is my sh ver output:
Licensed features for this platform:Maximum Physical Interfaces : Unlimited Maximum VLANs : 50 Inside Hosts : Unlimited Failover : DisabledVPN-DES : Enabled
[Code]....
View 7 Replies
View Related
Apr 17, 2013
I have an internal application which requires operators to have a static IP address. I'm looking for a way to do this for our VPN users. At the moment they are given a random DHCP address from a pool. Is there an easy way to get a static address assigned to VPN users on a Cisco ASA5510 any connect VPN?
View 3 Replies
View Related
Dec 2, 2011
Can anyconnect clients and cisco vpn ikev1-2 clients use the same certificate on an ASA 5510 ?
View 4 Replies
View Related
Jan 24, 2013
We have an ASA 5510 running 9.1 and the latest 3.1 AnyConnect package for Linux. The problem that i am having is that the AnyConnect VPN will drop after maybe 30 seconds or less of connection. It will connect fine. I can ping my remote servers. Then it will drop and go into a "Reconnecting State". Of which it will not reconnect. I have to close AnyConnect and then try to connect again. Then I'll get the same results. We have about 25 employees that use the AnyConnect VPN all day on Windows 7 machines without any problems. The issue appears to be isolated to my Ubuntu laptop. I have gone so far as to completely reinstall Ubuntu, both 64 and 32 bit versions but end up with the same results.
View 2 Replies
View Related
Dec 26, 2012
I have configured an Asa 5510 as SSL vpn gataway ver 8.2(4) Anyconnect Essential. The clients are authenticated via Radius and OTP password.All work well since yesterday. When I have did same configuration changes. My objective was has that the clients accept the self signed certificate issued by the Asa whitout give the warning about the private cert.
So I have try to generaste a new certificate with FQDN equal to myasa.mydomain.com and also a CN=myasa
Then I have change the profile XML file of my anyconnect in this way: [code]
View 1 Replies
View Related
Apr 23, 2012
I have a PC at home which is dedicated to one specific task, and need it to be connected to our company VPN at all times. This PC gets accessed by another remote worker (RDP), through the VPN.
This works fine with the PC at my home office connecting via the Anyconnect client... for a few days, then mysteriously disconnects and doesnt automatically reconnect, with the following Anyconnect error;
"The vpn connection to the secure gateway was disrupted and could not be automatically re-established. A new connection is necessary, which requires re-authentication".I have to manually reconnect and re-enter the password, after which it connects fine.
I have looked on the central ASA5510 (which all clients connect to) and set the idle timeout to unlimited for the appropriate AnyConnect profile and group policy, I cant seem to find any other settings to allow it to stay 'always on' from the client.
I am wondering (but am not sure if this is the problem) if it is perhaps because I am on a normal home broadband connection, which uses a dynamic IP, not static. My ISP (Sky) cannot provide a static IP for my public interface..
View 1 Replies
View Related
Jan 11, 2012
We have a SSL Gateway setup with the anyconnect client.We have picked up on some of the Windows 7 Tablets that you can install via the web page.Once installed you are connected to the network.However once you disconnect, and try with the anyconnect client u get the following error;
" Anyconnect was not able to establish a connection to the specified secure gateway. Please try connecting again"
We have not seen this on any of the Windows 7 laptops nor Windows XP.
The URL have been added to the trusted zones.We have gone as far to disable anti-virus / windows firewallDisabled the "Protected mode" with in internet explorer.
Anyconnect client version 2.5.3055..ASA 5510 Serial number JMX1504L05Y - ver asa841-k8
View 2 Replies
View Related
Apr 9, 2012
II have a management network 192.168.5.x and VPN network 192.168.25.x. I can ping a all my network elements except to firewall (ASA5510). The ASA has the IP 192.168.5.1. I think that the firewall has some restriction but I don't know. I have 8.2 software and any connect 3.0 and work fine. If I am in the management network (192.168.5.7), I can ping to firewall. The restrict is with the VPN network.
View 4 Replies
View Related
Feb 20, 2011
I have a problem with my AnyConnect clients connecting to an AD network via a 5510. Anyconnect VPN clients provide AD plus a one time passcode to authenticate to the 5510. This works fine apart from 3 things:
1. Once the VPN session has been established the user is further prompted for AD credentials when accessing an AD share for the first time. Once they provide the credentials the share can be accessed. Should the AD credentials not be passed through when the VPN connection is established? Or is this by design? What makes me think it's not be design is the fact that this could be related to problem 2.
2. Group Policy Update (windows gpupdate) fails. This again suggests to me that the full client/server relationship is not fully in tact.
3. In order to get Outlook to connect to exchange I've had to change Outlooks security settings from Negotiate (which would naturally choose Keberors), to NTLM. Not sure if this is related or not.
Note: DNS is functioning with out any problems
Maybe the first 2 issues are by design, but I thought the whole idea behind the AnyConnect VPN was that the remote machine would function as if connected to the LAN?
View 1 Replies
View Related
Apr 8, 2012
I am trying to load the anyconnect VPN client package v3 for windows and Mac on ASA 5510. The ASA has 256MB for RAM and Flash. After I uploaded pkg files and selected the 2 files and applied from ASDM, ASDM spots responding...
I tried to tftp the running config from ASA to my laptop to analyse but got "No memory available" message...
So it seems like the "unzip" process of the pkg files used up memory... what is really the requirement of the mini Memory/RAM on ASA for hosting anyconnect Clients for 2 OS platform? Requirement on Cisco web site is kind of vague.
View 4 Replies
View Related
Feb 21, 2013
I am just getting more confused the more I try to work it out. Not sure if this goes in the IP Telephony section or here. We have an ASA 5510 with the base license. We are needing to install IP Phones at remote workers homes, and I understand there are Cisco IP phones which have VPN clients built in to allow a tunnel to the central private network. IT appears that you can only use Any connect VPN for this, ans I am trying to work out what licensing upgrade we need to apply to the ASA, as the two Any connect licenses you get free on the ASA is not enough.
This is the phone we are looking to get; {URL} . What I want to know is will the Any connect Essentials license work with these IP phones? When I do a show version,
Licensed features for this platform:
Maximum Physical Interfaces : Unlimited
Maximum VLANs : 50
Inside Hosts : Unlimited
Failover : Disabled
[code].....
This platform has a Base license. It shows "Any Connect for Linksys phone : Disabled", is this the same for Cisco IP Phones? Is this the specific licensing type I should be looking to get for Any connect on IP phones or will Essentials do?
View 4 Replies
View Related
May 3, 2012
I have a 5510 using AnyConnect VPN clients. I have a DNS name for my router to accept connections ie cisco.mydomain.com..I can ping the address by hostname from the clients machine ok but when the AnyConnect client opens it has my hostname ie (cisco.mydomain.com) but says "invalid host entry" I have to type in my IP address for it to connect.I have the hostname in my AnyConnectProfiles.xml.
View 1 Replies
View Related
Aug 11, 2011
I am trying to use a ASA 5510 with AnyConnect as an in-line SSL VPN device. I have a separate firewall that NAT's 443 to the inside IP of the ASA, which is the only configured interface on the ASA. I can connect to the ASA from the WAN just fine and the AnyConnect client connects just fine, I get an IP lease across the VPN on my LAN, all looks well. The problem is that I cannot pass any traffic. The only device on my LAN that I can ping is the ASA, nothing else including the default gateway is accessibe. I have setup a static route on the ASA pointing 0.0.0.0 0.0.0.0 to the LAN gateway, but no dice.
View 1 Replies
View Related
Dec 9, 2012
I have configured my ASA 5510 to establish an SSL VPN Tunnel.I am using the AnyConnect client 3.1. The authentication is made by Radius Server with OTP.All works well, I'd like to customize the AnyConnect client to remember the domain name that cames after the username in this way: xxxxxxx@my domain.com..Where xxxxxxx is the variable username inseted by the user, and the @mydomain.com is the constant part the remain still the same.
View 2 Replies
View Related
Jun 26, 2012
We have 30 remote workers which we have recently acquired which are being set up with the AnyConnect client to connect to our head end ASA 5510. For security purposes, we have to allow them access to only 3 of our local internal servers, all on our 10.10.X.X/16 subnet. The remotes are being issued a 10.10.50.X/24 address via DHCP on the ASA when connecting. I thought this would be as simple as creating an access list but have not had any luck doing so. In addition, we need to allow them full access to servers in a datacenter connected to our same head end ASA via a site-to-site VPN while they are connected to us using AnyConnect.
View 1 Replies
View Related
Apr 30, 2013
I activated the following Cisco AnyConnect License on my Cisco ASA 5510 running the software version 8.3(2):webvpn has been configured on my ASA, but everytime I try to connect from a Window system (xp, 7 or 8), the process always stops at the menu "Download" (as seen on the image below). My goal is to connect via web-based without doing any manual installation of the Cisco AnyConnect VPN Client on my system.
View 1 Replies
View Related
Apr 2, 2012
I have an anyconnect account set up using version 3.0.5080 and connecting to an ASA 5510 base 8.2(2)17. We are using certificates for authentication. If I try and use the account on a windows machine it all works fine.
However on a mac running Lion if I try and connect via a web browser or already have the anyconnect client loaded and try to connect I always get “certificate Validation Failure”. I double checked the certificate was correct and am sure that is correct as it is the same certificate on the Windows and the mac. After searching online I have also tried editing the anyconnect profile to so it is set “certificate store override”, and put the certificates and key in the “user/.cisco/certificates” and “/opt/.cisco/certificates” folders.
After further testing, if I change the anyconnect connection profile to “authentication aaa” I can connect fine. Then if I disconnect, change it back to “authentication certificate” I can connect fine the first time, but all the following subsequent efforts I make fail. If I repeat this process this happens each time, I can connect the first time but after that it fails with the same “certificate Validation Failure” error message. When it connects this first time I checked and confirmed that it is definitely using the certificate. I have also tried using both authentication methods (“authentication aaa certificate”) and had the same problem.
This leads me to believe that my configuration is correct and it is some bug in the anyconnect client or the ASA image. I have had a look through bugs and read somewhere that there was a bug on earlier versions of 8.4, but nothing about 8.2.
View 1 Replies
View Related
Jul 7, 2011
I have a vpn ssl remote access with a fw asa 5510 version 8.02. When users use any connect vpn ssl they in the Lan can access to the servers,but they can not access using ssh or telnet to inside fw asa.
aaa authentication ssh console LOCAL
ssh 0.0.0.0 0.0.0.0 outside
ssh 0.0.0.0 0.0.0.0 inside
ssh timeout 30
View 1 Replies
View Related
Oct 31, 2011
We have an ASA 5510 that handles our vpn client traffic, and occasionally, we run into a client that, while using Cisco AnyConnect in conjunction with Phonefactor, the connection attempt will timeout before the connection actually establishes.The odd thing is - The logs show the client finished connecting, and the Phonefactor server shows completed authentication. We even added a custom timeout script to increase the default 12 second timeout to 30 seconds.This behavior has proven difficult to find a common factor for, as it has affected different versions of the client, 2.3 and 2.5, as well as Windows XP, Vista and 7 installs. This problem does not affect our Anyconnect/RSA clients, and if the same person on the same client with the issue is migrated over to the Cisco IPSec vpn, the problem disappears.
View 12 Replies
View Related
