Cisco VPN :: ASA 8.2.x / Assigning AnyConnect Client Profiles Based On The Machine?
Mar 3, 2010
I have an ASA running 8.2.x code with AnyConnect 2.4.x.I have both Radius and LDAP (AD) AAA available.If a user connects from a company owned laptop, I want to push down AnyConnect client ProfileA (with scripts to map drives etc...) and network ACL's set A.
If a user connects from any other computer, I want to push down AnyConnect client ProfileB (no scripts etc...) and network ACL's set B.
What I would like to do is CSD to do a machine certificate check (for presence of a cert from my private CA) and to assign a EndPoint Policy attribute (Managed on successful check or Unmanaged on failure). I can then use DAP to tailor the ACL's that get set.
It seems like the only way to handle AnyConnect client profiles is with Group-Policy. Using LDAP I can assign a user to a Group-Policy, but I have no way of determining is they are coming in from a company laptop or not when assigning the Group-Policy. DAP can not assign an AnyConnect client profile.
If at all possible, I do not users to have to pick a conenction profile or use different URL's.
View 1 Replies
ADVERTISEMENT
Jan 18, 2012
We have 2 ASA 5510's running in a Active/Standby configuration. It appears that most of the changes we make on the active unit are replicated to the standby unit. However, there are 3 AnyConnect Client Profiles on the active unit and none of them show up on the standby, the standby has no AnyConnect Profiles. We also have 1 OnConnect script on the active unit and it does not appear on the standby unit either.
I was under the assumption that all config items on the active unit would replicate to the standby. Is this not correct? Do I need to do something extra to get everything replicated? Are there other items that do not replicate?
View 3 Replies
View Related
Feb 15, 2012
I recently upgraded to Windows 7 in my company and the OS came bundled with Anyconnect VPN client version 2.5.
In the earlier version I used to add user profile using a .pcf file by importing it into the client to access customer LAN.
But in the Anyconnect VPN client I dint find any option to import the file. The IT support has told to edit the xml file to add it. The problem is I even after i edit the anyconnect-cert.xml with changes in host name and host address tags I am not able to start a connection. I dont knw know exactly what address must be given in Host address tag. I copied the host address from .pcf file which i used earlier.
Whether I will be able to add a user profile in this way or any correction is to be done in the whole process of adding the user profile,
View 1 Replies
View Related
Nov 9, 2011
I use a Cisco ASA 5510 with the AnyConnect VPN for remote workers. Now we want to give access to a select group of consultants who only need access to one sever and block everything else.
I was thinking this could be done by creating a separate AnyConnect Connection Profile on the ASA. From that new connection will come a new GroupPolicy with a ACL to only allow access to the one system. That GroupPolicy will point to the Radius Server looking for an account in a specific MemberOf group.
My question is - Could you explain how the ASA knows what Connection Profile to use when a user tries to authenticate? Does it automatically hunt down each Connection Profile until there is a username match via RADIUS in the Connect Profile?
View 1 Replies
View Related
Jan 31, 2011
DHCP is assigning multiple leases per machine. The server itself grabs about 10 IPs with Unique ID "RAS"
View 1 Replies
View Related
Aug 10, 2012
We are rolling out a new VPN infrastructure utilizing ASA 5520's (one active/standby cluster at each of our two sites) and making the conversion from the old IPsec client over to AnyConnect 2.5 clients. We do have AnyConnect Premium licenses at both sites, but are not utilizing ISE. What we want to do is first auth the machine that's trying to initiate the AC VPN session to determine if it a company-owned machine (with the idea that only co-owned machines can connect), and then auth the user using RADIUS, which uses attribute 25 to assign them into groups for policy application. We have the RADIUS piece working now, but is there a way to first do the machine auth, and then the user auth? We don't just want to use something like cert-based VPN because if the machine gets stolen (or a non-co user otherwise gets into the OS) then we don't want the non-legit user to be able to establish a VPN session just because they have access to a company machine. The other rub is that the machine auth solution must be cross-OS compatible (we use a mix of Windows, MacOS and Linux on the machines that should be allowed to VPN.)
View 7 Replies
View Related
Sep 19, 2010
I have been configuring anyconnect VPN. The requirement from customer is to configure MAC address based authentication for anyconnect clients. I have gone through various cisco documents. I couldnot find this option explained. Is MAC address based authentication possible in anyconnect vpn without having AAA server in place?There is an option to select end point attribute as MAC address, while creating Dynamic access policies. But at the host scan configuration of Cisco secure desktop, there are no options for performing MAC retrieval.
My ASA is running on version 8.2(1) and ASDM version 6.3(1) and a memory of 512 MB RAM. Any way for MAC based authentication in cisco anyconnect VPN.
View 3 Replies
View Related
Apr 30, 2013
I activated the following Cisco AnyConnect License on my Cisco ASA 5510 running the software version 8.3(2):webvpn has been configured on my ASA, but everytime I try to connect from a Window system (xp, 7 or 8), the process always stops at the menu "Download" (as seen on the image below). My goal is to connect via web-based without doing any manual installation of the Cisco AnyConnect VPN Client on my system.
View 1 Replies
View Related
Sep 30, 2012
I have two sets of local users who access internal networks vai the Anyconnect application on a Cisco ASA 5505.One user needs to access 1 ip address while about 7 users access abotu 4 addresses.
I have a group called xyz1 which currently has the one user in the connection profile. I guess to reaffirm my thought, If I create another connection entry called xyz2, can I assign the other 7 or 8 users to it?
If I can do this, how can I ensure that each connection entry only has access to specific IP addresses on the internal network?
View 1 Replies
View Related
Nov 19, 2012
Is there a way to configure a disclaimer that will pop up on the client machine that they will need to accept to be allowed access to the wireless network?
View 3 Replies
View Related
Nov 20, 2012
i have 3 systems. 1 server,2 client(all installed with xp). internet connected to server machine. all systems connected to a switch. Internet sharing is ok but on client machine not loading webpages like facebook or yahoo. The client machine loads [URL] in amazing speed, but not loading any other webpages. I tried disabling the avast antivirus but no use. Server machine loads everything correctly. i am using windows xp in the host file '127.0.0.1 localhost' only cleared the history tested with 3 browsers (IE, chrome, mozilla) Nothing works.. MaxConnectionsPer1_0Server : 8 MaxConnectionsPerServer : 4 In the server machine, i have installed Comodo firewall "ping facebook.com" shows no problem!!(in both server and client)
View 1 Replies
View Related
Feb 28, 2011
Is it possible to log when a user connects/disconnects their VPN session? They are connecting to an asa 5510.
View 5 Replies
View Related
Mar 15, 2009
I've got a short trouble running anyconnect client 2.3.254 under Mac OS X 10.5.6.If I use it to connect an ASA 8.0.4 through a proxy (squid) it doesn't work.If I use Win XP, with same proxy, it works.If I don't use any proxy, with my Mac OS X client (on another WAN access) it works too.So, is anyconnect client supported over proxy server on MAC OS X ???? or did I miss something ?
View 9 Replies
View Related
Jun 16, 2011
I have a customer I've built a webvpn tunnel for.Users on this tunnel need to have http access to a server at 10.1.1.12 and nothing else.That's fine, but in order for name resolution to work properly they need to be able to send DNS requests to 10.1.1.9.I'm working with two different access lists, my non access list (nat 0) and my split tunnel access list. I can't specify ports in the nat 0 access list, but I did try writing my split tunnel access list as follows:
-access-list split permit ip host 10.1.1.12 172.16.4.0 255.255.255.0
-access-list split permit udp host 10.1.1.9 eq 53 172.16.4.0 255.255.255.0
When I do that users can access the 10.1.1.9 dns server, but they can hit it on anything (ping, 3389, etc.).I'm trying to figure out how I can limit them so they will only be able to pull dns but nothing else.They have the Any connect Essentials license, so unfortunately a clientless VPN is not an option. Is there some other access list I can interpose that will limit things the way I want?
View 2 Replies
View Related
Oct 26, 2011
I am using AnyConnect VPN 2.5.3054 on two different computers (Windows 7 and XP SP3) with Kaspersky Internet Security 2012. Upon successful connection, the client disconnects and goes into a continous loop of reconnection to no avail, a message at the bottom appears: "A VPN reconnect resulted in different configuration setting. The VPN network setting is being re-initialized. Applications utilizing the private network may need to be restarted."At times I also see after this loop of attempts to reconnect: "The VPN client agent SSL engine encountered an error. Please retry, or restart AnyConnect."Note: I added the VPN applications to the trusted zone of KIS 2012, unchecked the SSL and HTTPS 433 ports and added exceptions for the applications, again without use. I tried uninstalling and installing after disabling KIS but the problem persists.
View 1 Replies
View Related
Sep 27, 2012
Does VPN concentrator "VPN3005" work with AnyConnect SSL VPN client?
View 3 Replies
View Related
May 9, 2013
Some of my VPN users are getting the following error on Windows 7 64 bit computer. I have uploaded the client to a website. The VPN users are supposed to download and install the client from the web-site. Then they enter the URL to connect to our VPN. This worked fine during the test and only some users are having issues. This seems like Windows issue.
Error “There is a problem with this Windows Installer package. A program run as part of the setup did not finish as expected. Contact your support personal or package vendor”
Client- anyconnect-win-3.1.02026-web-deploy-k9.exe
View 1 Replies
View Related
Feb 19, 2011
We have a RA Vpn split_tunnel setup in one of our locations which is working fine in all areas except for traffic destinged for one specific website using https. This vendor only allows the HTTPS connections to them to come from certain outside IP addresses. ssentially it should work like this:RAVPN_client (10.4.4.0/27) --> https request to vendor_ip (208.x.x.x) ---> ASA55XX --> NAT_to_outside_ip --> https request to vendor_ip (208.x.x.x) need to understand how you would go about NATing ONLY this specific https traffic from the RA VPN while not having to alter the setup otherwise. Internal hosts (aka behind the ASA physically) do not have any issue getting to this site, as its nat'd to the outside ip address as we expect.Here is what we are using for the NAT Exemption list he 10.2.2.x, 192.168.100.x and 172.23.2.x are other remote sites that we have. RA VPN users are using the 10.4.4.0/27 do not have any issues connecting to them, no matter the protocol.
View 3 Replies
View Related
Oct 4, 2011
when it comes to IOS based SSL VPN setup, so have run into an issue which I can't seem to find an answer for.
What i'm after is a way to restrict access to an AnyConnect authenticated and connected client, on a specific profile, to a list of specific websites (all on the Intranet). Everything else must be blocked.
On the IOS device, I had it fudged to pretty much retstrict access to a certain IP and port, and used a mod rewrite in Apache to re-write a URL from that IP to the host the site actually resided on. It's cludged together and working, but it's not ideal (and it's not going to allow for scaling up to what I need).
I can find plenty of references here and on the net to using regex to create block lists based on a global policy to disallow specific URLS, but I need the inverse of that, and, only applied to a specific policy group.
Is this possible on an ASA5505? Is it possible on *any* ASA?
View 11 Replies
View Related
Dec 24, 2011
I am having an issue I need to have the outside interface terminate a ssl AnyConnect Client. I have several groups the will login and I need multiple inside interfaces to satisfy my security needs.
I have one group call ombudsman-mhdd and they need to go out interface g0/1.231 and another group called oet-router go out g0/1.232.This works on my 8.2 box but I am having trouble routing traffic out these interfaces.
interface GigabitEthernet0/0
description trunk mplsfe-hub g1/10 - - null
nameif outside
security-level 0
ip address 207.171.92.25 255.255.255.252
!
[code]....
View 3 Replies
View Related
Apr 16, 2013
I have noticed that the error "unable to process response from x.x.x.x" when using anyconnect is very common and that the actions to handle it are different. Right know I have the same issue. Let's name it "the message" =)
We are running:
ASA 8.2(2) . AnyConnect 2.5.1025
In my scenario, we used to be able to connect to the ASA using AnyConnect but suddenly it stops to work showing "the message" =) We did this procedure, but it did not worked for us
[URL]...
My first question would be:
How can I obtain more information so I can get a better idea to handle "the message"?
The next step I am about to do is upgrade the AnyConnect Cliente to 2.5.2019. According to the release notes, this versión is supported with ASA 8.2(22)
I also notice that the AnyConnect client can be install with a component named Cisco Diagnostic and Reporting Tool (DART). Does this tool could be usefull to troubleshoot "the message"? What kind of information does DART can give us? Were can I find the files it captures?
View 6 Replies
View Related
Jul 24, 2011
I'm trying to test Anyconnect VPN but after configuring the required configuraiton I'm not getting Anyconnect client downloading and it just log into the clientless webvpn. Below are my basic required configuration. I have tried with few other ASA the same configuration but it worked fine. I'm using the default SSL VPN base license (02) with the ASA5580 code running 8.2.2
webvpn
port 8080
enable nms-s90
[Code].....
View 1 Replies
View Related
Jun 28, 2011
I've been trying to set up a SSL VPN connection for remote conenctivitiy with AnyConnect Client. I've configured virtually everything necessary, I can connect to the VPN page, download the Client, establish connectivity, Get an internal-IP address. But I can't ping any internal (and of course external IP addresses)
View 12 Replies
View Related
Jan 22, 2012
I want to connect with AnyConnect Secure Mobility Client 3.0.2052 to ASA 5540 Version 8.4 and SSL Premium License.The clients using Maschine Certificate to authenticate to ASA. This works fine.Now I want to setup a DAP to verifiy the client against the Microsoft AD using LDAP. I configured LDAP server in ASA see:aaa-server LDAP protocol ldap aaa-server LDAP (inside) host ldap.com ldap-base-dn DC=x,DC=x,DC=x,DC=com ldap-scope subtree ldap-login-password ***** ldap-login-dn ***** server-type microsoft ,I can see that it works if I test the server via the testbotton in ASDM and I see it in CLI "debug ldap 255" also. But if I configure in DAP: AAA Attribute ID:memberOf = DomainMember I can not see any request to the LDAP server during I try to connect with the Client und the DAP doesn't match.
View 2 Replies
View Related
Apr 15, 2013
I already have traditional IPsec VPN access working just fine through this device. Users connect and authenticate using a windows AD server for RADIUS and everything works great. However, the customer wants to use AnyConnect instead of the traditional VPN client. So I added a SSL connection profile (the anyconnect essentials feature is enabled on the device) and told it to use the same IP pool and RADIUS server group as the IPsec clients. I used the ASDM wizard to configure it and had no issues completing the wizard. when trying to make a connection to the webvpn portal I get a 404 error instead of the client portal. Also when trying to connect with the Anyconnect client, I get the usual "Untrusted VPN certificate" warning, but the connection attempt fails when I click through it.The strange part is when I look at the issued certificate in the browser or the client, it's showing me the certificate from the RADIUS server. Why is it looking there for certificate and more importantly, why does it care at all about a certificate when I've specified in the connection profile to use AAA to authenticate?
View 1 Replies
View Related
Sep 25, 2011
I currently have a Cisco 5520 ASA which is up and running and the users are able to connect to Anyconnect to VPN into the network. However, users plugged into the internal network inside the ASA are unable to connect to the vpn address and download the Anyconnect Client. I think this may be to do with reverse NAT missing?
View 4 Replies
View Related
Nov 11, 2012
We currently have an ASA 5505 Firewall with VPN services configured. The system is running ASA Version 9.0.0 and ADSDM 7.0.2. I installed the "Cisco AnyConnect Sercure Mobility Client" Version 3.1.01065 on my Windows 7 Ultimate PC. When I try to connect to my VPN service I ge the following message:
Security Warning: Untrusted VPN Server Certificate! AnyConnect cannot verify the VPN server: XXX.XXX.XX.XX
-Certifiate does not match the server name
-Certificate is from an untrusted source.
-Certificate is not identified for this purpose.
Without purchasing a certificate from a 3rd Party vendor, is it possible to register a "Self" generated Certificate to get rid of this message? If so are there any "Detailed" (e.g., simplified or not in Cisco-eeze language) instructions on how to setup the Firewall to "push" the certificate to the VPN client so the message doesn't come up for the user?
View 5 Replies
View Related
Aug 5, 2012
I'm on a Mac connecting to a Cisco ASA 5510 with AnyConnect VPN client.
The connection is established and it works for 15-30 seconds, then the connection drops. AnyConnect will reconnect, and then it works fine.
I noticed in the logs that it reconnects with a smaller packet size.
View 1 Replies
View Related
Mar 31, 2011
we have ASA5510 with version 7.x and asdm 5.X, i upgraded it to 8.3 and asdm 6.2, and i got vpn peers 250 and 2 ssl.when i try to connect through client software , i can see in the logs UDP 500 port is created as shown below. [code]
and currently in right panel of Active Algorithms i have only RC4-SHA1,
View 7 Replies
View Related
Feb 14, 2013
I'm using Cisco AnyConnect VPN Client v2.4.1012 running on Windows 7/64 to connect to a client's network environment. Is there any method to the way that the client forces my Firefox and IE browser windows to close?
View 3 Replies
View Related
Jul 13, 2011
want to connect with AnyConnect Secure Mobility Client 3.0.2052 to ASA 5540 Version 8.4 and SSL Premium License.The clients using Maschine Certificate to authenticate to ASA. This works fine.
Now I want to setup a DAP to verifiy the client against the Microsoft AD using LDAP. I configured LDAP server in ASA see: [code]I can see that it works if I test the server via the testbotton in ASDM and I see it in CLI "debug ldap 255" also. But if I configure in DAP: AAA Attribute ID:memberOf = Domain Member I can not see any request to the LDAP server during I try to connect with the Client und the DAP doesn't match.
View 3 Replies
View Related
Apr 28, 2013
I am using Cisco AnyConnect VPN Client v2.3.0254 and ever since i upgraded my laptop from the Lenovo T420 to the Lenovo T430 the time it takes to connect via VPN has increased drastically. Connecting via VPN on my Lenovo T420 would take as little as 5 seconds to authenticate and connect while connecting with my T430 is now taking at minimum of 5 minutes, sometimes upwards of 15 minutes only to report back an error!
The screen the AnyConnect VPN Client seems to hang on is "Establishing VPN - Initiating Connection..."
The server is enforcing that McAffee is installed and up to date, however i have already made sure that my McAffee install is valid and up to date.
I have already taken these steps to try to correct the issue: Re installed Cisco AnyConnect VPN ClientRe installed & updated virus definitions for McAffeeRan CheckDisk on my primary OS partitionRan RAM validation utility to verify no bad sectors I have attached a screenshot of the error log from AnyConnect as well as the log html file.
View 2 Replies
View Related
Jun 10, 2013
Any connect vpn client no internet access.
Below is configuration.
ASA Version 8.2(1)
hostname ciscoasa5505
Interface Vlan1
nameif inside
security-level 100
ip address 172.16.0.1 255.255.0.0
[code]...
View 1 Replies
View Related
