I am trying to setup a VPN with AnyConnect on my ASA5510 and it works fine. I have setup an AAA server group for my Active Directory with the "NT Domain" protocol". Right now, every user is able to connect with their Active Directory credentials. I would like to restrict access to the Anyconnect VPN to only a few users in AD.
View 1 RepliesI have a Cisco ASA5510 firewall that has SSL Web VPN functionality and is utilizing AD Server as Authentication server for users.However, we have a policy to change password at certain point of time. Users in the office have no problem. They just login their PC and change password. Users outside of office is a pain when their password is expired. Is it posible for them to change their AD password thru VPN using Cisco Anyconnect?
View 2 Replies View RelatedI have a Cisco ASA5510 firewall that has SSL Web VPN functionality and is utilizing AD Server as Authentication server for users. However, we have a policy to change password at certain point of time. Users in the office have no problem. They just login their PC and change password. Users outside of office is a pain when their password is expired. Is it posible for them to change their AD password thru VPN using Cisco Anyconnect? If yes, can you show me how?
View 1 Replies View RelatedAny detailed knowledge about Cisco ACS 5.1 and Windows AD interaction? I wonder why does Cisco ACS domain account must have permission to create/delete domain objects. This fact does really surprided me, because to my mind Cisco ACS only reads domain structure, and does not make any changes.
View 3 Replies View RelatedI want to share the My Documents folder from an XP machine with ONLY one user (the administrator) on a networked Win 7 machine. I have turned off simple sharing on the XP machine. I hate XP!! So complicated to do anything. Anyway, under security, I have tried share this folder, and not to share folder. I have gone into Advanced and messed around with permissions, taking out Everyone, using Admin only, using Network. At one point I ended up not being able to access My Documents on the local computer and had to jump through many hoops to change ownership and disable read only so that the user could use her own files!The problem is, under Advanced in the permissions area, I cannot see the users on the remote pc to choose which one should be allowed access. how to actually find a particular user on the Win 7 pc and give ONLY that user permission to read (not to change) the files in My Documents on the XP pc.
View 3 Replies View RelatedACE 4710 TACACS issues ,How to setup user with Admin context access permission. I have enable the TACACS and it can directly put me in Context mode not in Admin Context mode .
View 8 Replies View RelatedWe are using an ASA 5510 and remote access (SSL VPN) using the AnyConnect client.
Is it possible to display a user message when a user connects using the AnyConnect client, matching a specific dynamic access policy? Can the message be displayed when the action is "Continue" rather than "Terminate"? I can't seem to get this to work and wondered if there was a LUA function to do this.
We have a DAP which gives a restricted ACL when the user's anti-virus is out of date, and I wanted to notify the user to update their anti-virus and reconnect.
I have configured my ASA 5510 to establish an SSL VPN Tunnel.I am using the AnyConnect client 3.1. The authentication is made by Radius Server with OTP.All works well, I'd like to customize the AnyConnect client to remember the domain name that cames after the username in this way: xxxxxxx@my domain.com..Where xxxxxxx is the variable username inseted by the user, and the @mydomain.com is the constant part the remain still the same.
View 2 Replies View RelatedI have a Active Directory user that cannot log onto any computer that's on my organizational domain. The error is "You cannot log on because the logon method you are using is not allowed on this computer"
View 5 Replies View RelatedWe have a computer running Windows 2000 Pro that used to connect to a domain at work. Upon bootup, it asks for the user/password.Yesterday we tried to connect it to a little home network by changing the domain to a workgroup with a different name (network name that i used at home) as well. Now when it boots up, asks for a user/password, but now it does not recognize my user name and password.I can log in as an administrator to the Workgroup with the new name. but i cannot access the old Domain with its user and passwords. I tried to change back to the old name and to domain, but when doing that i get and error messsage which says: The following error occurred validating the name "xxxxxxx" (network name that I use at home) this condition may be caused by a DNS lookup problem. so I'm not sure if a should run the clear DNS cache. and if in doing that I'll be able to restored it back to the stage that i was before I made the changes.
View 1 Replies View RelatedWe have shared network drives on my network whose folder structure must not change. We have users who must have full access to the contents of these folders and be able to read/modify/erase and create new files inside these folders. However, the structure of the folders must not change so that other users/programs can locate files within these folders.
Some users sometimes "aggressively click" and drag and drop folders into different locations and can't remember where they dropped them. This makes them inaccessible for other users. We have a lot of folders so I implemented FileWatcher Simple program to monitor these folders and if there is a change in folder structure I get an email with an attached log. The log tells me which folders got created/deleted/renamed and I am able to restore the folder structure if need; but I cannot see who caused these changes.
1. Is there a way for me to see which user in my domain modified the folders?
2. Is there a way to disable users from drag and dropping, deleting, renaming folders yet still maintain full access to the files within these folders?
I am setting up a clientless SSL VPN and AnyConnect on a ASA5510 running 8.4. When I login to clientless SSL VPN I get a menu with AnyConnect showing as an option. When I click on that AnyConnect it try to load. Half way loading an error message pop up.Error message:The secure gateway has rejected the connection attempt. A new connection attempt to the same or another secure gateway is needed, which requires re-authentication. The following message was received from the secure gateway: No address available for SVC connection.When I load AnyConnect seperately then it works. I don't have that problem when using 8.2.
View 1 Replies View RelatedI have a small issue with the AnyConnect client. Under Windows XP, I was able to accept and install the certificate from the firewall and get a vpn connection working. But under Windows 7, I have to accept the certificate everytime I conect. Is there a reason for that?
View 3 Replies View RelatedI have a small issue with the AnyConnect client. Under Windows XP, I was able to accept and install the certificate from the firewall and get a vpn connection working. But under Windows 7, I have to accept the certificate everytime I conect. Is there a reason for that?
View 2 Replies View RelatedWe have an ASA5510 with the Anyconnect Essentials license. I'm in the process of setting up Anyconnect and immediately run into a question. We have a /29 subnet setup and AFAIK i must use the outside interface address for Anyconnect. However i already have an https service PAT forward on this address. So, can i setup Anyconnect to listen on eg. the second ip in my public subnet?
View 4 Replies View RelatedI ve setup Anyconnect on ASA 5510 and it seems to be working fine but cant get Jabber to work on smart phones. When using the packet tracer i see my packets dropped on WEBVPN-SVC. I am not using NAT anywhere and i can normally ping the CUCM from the client , i can open the web page of cucm but jabber says connection error.
View 1 Replies View RelatedWe have configured ACS 5.1 for autenticating wireless users with active directory, which is working fine now.But we would like implement that single user should be authenticated through ACS . If any user try to access WLAN from multi system will be notified with multi login access restriction.Can we implement this policy in acs, if possible what are the exact configuration changes we have to implement.
View 1 Replies View RelatedWe have cross domain trust relationship established and I have added the user group in our ACS 5.1. we are using Active directory as an external Identity store. Also I have created a rule in the 'Access polices' to allow the user group. From the cross domain, I use abc@xxx.xyz as a user id, but I get this error message 13036 Selected Shell Profile is DenyAccess.
View 3 Replies View RelatedWe have gotten our anyconnect clients to connect to the VPN with no issues and verifying credentials with RADIUS. Remote users however cannot access internal resources through the VPN. I know I need to setup an NAT Exempt statement for my VPN Pool to the Internal Network,
View 5 Replies View RelatedI currently have our ASA5510 setup for AnyConnect 3.0 VPN clients and IPSec VPN clients. I'm trying to add Clientless SSL VPN functionality for employees without company laptops. Because they won't be using company PC's I want them to connect to the webvpn portal without having to install any type of client.
I have a Clientless SSL VPN connection profile setup and have it set to use Clientless SSL VPN only. However, whenever I login to the portal it automatically tries to download and install the AnyConnect client. How do I enable the VPN web portal without the AnyConnect trying to install?
We have about 160 users setup using the Anyconnect client connecting to a ASA 5510. We are using split tunneling and also using the Websense endpoint client. Every now and again after installing the endpoint client we are unable to connect the AnyConnect. It asks for credentials waits for a while and then fails with the error "AnyConnect was not able to establish a connection to the specified secure gateway.Please try again later."
If we uninstall the endpoint client it works again and normally after reinstall it fails again ( I know). Eventually it just works and then its fine.
We have logged a call with websense and sent packet traces of working and none working . Then only thing they came back with is if we filtered the non working trace with port 80 you could see a few RST,ACK coming from the ASA to the client so they blamed the Cisco components.
I have a remote access VPN profile configured on an ASA 5540. This profile is almost identical to the same profiles configured on other ASA 5540. The profile is linked to Active Directory for authentication. For some reason, users are not being prompted for the domain name field when connecting to the firewall, on the other firewalls they get prompted for all three (user/pass/domain).
All the firewalls are running 8.0(4) 32. And the following is the configuration of the firewall that I am experiencing issues with:
ip local pool TESTVPN 10.244.124.1-10.244.127.254 mask 255.255.252.0
group-policy TESTCERT internal
group-policy TESTCERT attributes
banner value **** WARNING ****
banner value You are Now Successfully Connected (code)
how to find the current logged on user on a domain network? I tried nbtscan but it gives me ip address, machine name and mac address. In the server column it gives <server> and in the user name column it give <unknown>.
View 1 Replies View RelatedWe had a power outage that kicked off our server and our network switch (2008R2, Cisco2960), before we could get it back up, a user was able to log into his laptop.
The user used the domain login - not the local machine account - he obviously wasn't able to access any shared resources, but how did he log in with a domain account, when the server and switch were both off?
I started getting into IT (as a job) a little less than a year ago, though I've been working with computers for close to 20. So networking was never something I was into while working on computers at home. I've been handed a significant position at work and I am learning a lot as I go. I want to know how to grant permissions for a domain user to a directory without adding the user to all of the sub-directories and directories. The only way I've figure thus far is to grant permissions to said folder, then inside remove the "inherit permissions..." but then I have to manually remove the permissions to every other sub-folder.I want to add a single path to a folder by adding single permissions to each folder until the directory in question is reached.
View 2 Replies View Relateduser can't login into domain with right credentials in active directory
View 6 Replies View RelatedI have a desktop without a wireless card and i want my network to be wireless so i bought a d-link wireless card for the desktop, the system then discover the wireless network but could not connect it kept on trying to authenticate, it did not even ask me for the web security key, what do I do
View 1 Replies View RelatedI'm trying to install the anyconnect package on an ASA 5510 running version 9.0.1. I'm getting the following error:
labfwpix(config-webvpn)#anyconnect image disk0:/anyconnect-win-3.1.01065-k9.pkg
copying 'disk0:/anyconnect-win-3.1.01065-k9.pkg' to a temporary ramfs file failed
Is there something that I'm doing wrong when installing the package?Also, is there away to manually install the client on a stand alone PC without a deploying method, similar to the IPSEC client software?
I just upgraded our AnyConnect package on our ASA5510 from 3.06xxx to 3.1. When I tried to log in to the website to automatically install the client, it showed me a big error saying the Certificate is untrusted and I have to explicitly accept it. After accepting it, I had to restart the installation.Is there a way to disable this strict certificate trust setting? We don't have a valid SSLVPN certificate yet, but this big error will confuse endusers.
View 8 Replies View RelatedI have a scenario where there is an ASA5510 configured as follows:
Interface0 = Outside
Interface1 = LAN
Interface2 = DMZ
Interface3 = unused
Running ASA version 8.2[1]
All network operations are fine, as are the IPSEC tunnels to other branch offices, and the incoming SSL VPN accessed via the IP address assigned to the external adapter.
My problem is that I have a device on the DMZ that needs to access the AnyConnect service hosted on the external adapter so that it can access LAN resources. When I try accessing it, I see the following errors appearing in the debug log:
3Dec 03 201212:10:50710003[DMZ client address]51031[AnyConnect ExternalAddress]443TCP access denied by ACL from [DMZ client address]/51031 to DMZ:[AnyConnect ExternalAddress]/443 If you look closely, it suggests an ACL issue from the DMZ client to the external AnyConnect IP address BUT it suggests the Anyconnect IP address is on the DMZ interface.
How do I configure the ASA5510 to allow VPN clients to have access to the Internet while they are connected via AnyConnect?
View 6 Replies View RelatedRecently upgraded a 5510 to Anyconnect Essentials and Anyconnect Mobile, the device was Security Plus and is now Base. Is it supposed to work this way? I lost my Gigabit interfaces. Is it possible to have Security Plus + Anyconnect Essentials?
View 1 Replies View Relatedwe have ASA5510 with version 7.x and asdm 5.X, i upgraded it to 8.3 and asdm 6.2, and i got vpn peers 250 and 2 ssl.when i try to connect through client software , i can see in the logs UDP 500 port is created as shown below. [code]
and currently in right panel of Active Algorithms i have only RC4-SHA1,