We are using an ASA 5520, running 8.4(3). We have users running the AnyConnect Secure Mobility Client 3.1.02026. I have the AnyConnect connection profile configured to authenticate users using LDAP over SSL. I enabled the password management and am able to get password change prompts to appear in the AnyConnect client. However, new passwords are rejected and changing passwords through that prompt does not work. I'm not sure what the cause of the problem is, since LDAP over SSL is enabled and working, which is required for the password management feature
I need to activate AnyConnect SecureMobility client on an IPAD. I have an ASA with the below feature licenses:
[code]...
This platform has an ASA 5520 VPN Plus license
As I've understood that I need the ASA-AC-M-5520 license for each IPAD used but they mentioned that we need also the Essential or premium license to be activated on the ASA as well. As shown above, I have the "VPN Plus license" activated on the firewall.
We currently have an ASA 5505 Firewall with VPN services configured. The system is running ASA Version 9.0.0 and ADSDM 7.0.2. I installed the "Cisco AnyConnect Sercure Mobility Client" Version 3.1.01065 on my Windows 7 Ultimate PC. When I try to connect to my VPN service I ge the following message:
Security Warning: Untrusted VPN Server Certificate! AnyConnect cannot verify the VPN server: XXX.XXX.XX.XX
-Certifiate does not match the server name -Certificate is from an untrusted source. -Certificate is not identified for this purpose.
Without purchasing a certificate from a 3rd Party vendor, is it possible to register a "Self" generated Certificate to get rid of this message? If so are there any "Detailed" (e.g., simplified or not in Cisco-eeze language) instructions on how to setup the Firewall to "push" the certificate to the VPN client so the message doesn't come up for the user?
Will the RV042 work with theAnyConnect Secure Mobility Client app? If so, is there and app note available? If not, which routers wil work with this app?
The problem is.....When I log in, the client does its start-up bit, and then displays a "This certificate is intended for the following purpose(s):" message. If I decline the certificate, it gives me the error message shown in the image, but I can otherwise continue and establish my VPNs with no problem.
Unfortunately, the certificate it selects has nothing to do with my organization ( in fact, the certificate is for "*.whitepages.com" - see images). To make matters worse, I can not find this referenced certificate anywhere under my user context in Windows.
I have tried removing, rebooting, and re-installing - it does no good.How do I force the client to stop using this incorrect certificate, and to at least use one that belongs to my organization?
Windows clients work fine. When loaced from safari in Mac OS, it also works fine. -- If I browse to the url, like vpn.xxx.com/profilename, I can login and anyconnect will start and connect automatically. Only when run from applications > Cisco > Cisco Anyconnect Secure Mobility Client, I will get this failure. Is this a configuration issue?
IOS SSL VPN fails to connect, CSCtx38806.pdf file for more info...There is bug with router IOS. if anyone cannot connect to router webvpn service via 3.1.00495 anyconnect client and it is giving you certificate error. you would be only able to connect via SSL web page not via client. Then please upgrade your IOS to latest version. IOS SSL VPN fails to connect after microsoft security update KB2585542 Workaround: Use rc4, w which is a less secure encryption option. If this meets your security needs, then you may use it as follows:
webvpn gatew ay gatew ay name ssl encryption rc4-md5
I have anyconnect-win-2.5.6005-k9.pkg anyconnect installed on router. When I try to connect with webvpn from client on machine 2.5.6005 anyconnect or latest secure mobility client 00495. it gives me certificate error. it doesn’t connect me with IOS web VPN. I can connect via SSL web page. There is bug please upgrade your IOS to latest version.
I recently got my hands on the latest Secure Mobility VPN v3.1.01 client. We are upgrading from the old anyconnect 2.4 client so there are many changes that are catching us by surprise. The biggest issue I have right now is that the new Mobility VPN launches automatically when a user signs into a machine. We would like to disable that automatic connection/launch feature. With the old 2.4 client we simply disabled the AnyConnect Service in Services.msc by default and started it up when a user was ready to connect.
I am having a problem configuring SCEP for my secure mobility client. I have created a connection profile to allow certificate requests but when I fill in the step-forwarding-url field I get an error. The CA we are using is an internal MS CA with SCEP already enabled. This has been configured for a long time with our current Cisco VPN client using certificate authentication. The ASA is running 8.4.1.Here is the error I get when I try to enter the command into the group policy associated with my certificate enrollment connection profile: group-policy SSLGP attributes. url...
I'm running Cicso AnyConnect Secure Mobility Client v3.0.07059 for work. Attached is a sceenshot of my network connections. I'm currently hardwired on my network connection and the Cisco VPN is a virtual adapter but is shows "network cable unplugged."
Using AnyConnect Secure Mobility Client, logging into ASA5540. After I put my credentials in, I get the banner message (from group policies). After I accept that, I get another pop message stating:It looks like a pre-set message. Where can I disable and/or edit this message?
I have been successfully able to setup Cisco AnyConnect VPN on ASA 5520 with 8.4 code. I have set it to authenticate against the RADIUS Server (Microsoft Windows 2008 NPS server). I have noticed one thing, on the server under "Constraints and Authentication Method". I picked MS-CHAP-v2, but it is considered Less secure authentication methods. I can click on Add and choose other Authentication methods like Smart Card or other Certificate, PEAP, EAP-MSCHAP v2. I picked PEAP but then the VPN does not work.
So first of all does it really matter if I just leave it to MS-CHAP-v2? Because from my understanding is that AnyConnect will authenticate to ASA and then ASA in the backend talks to the RADIUS server so from a security stand point this scenario shouldn't it be sufficient as no un encrypted or less secure information is available to the outside world? Secondly is there any documentation on using PEAP with Cisco AnyConnect?
I currently have a Cisco 5520 ASA which is up and running and the users are able to connect to Anyconnect to VPN into the network. However, users plugged into the internal network inside the ASA are unable to connect to the vpn address and download the Anyconnect Client. I think this may be to do with reverse NAT missing?
I have a VPN setup thru a Cisco 5520, Windows clients connect just find and the end users configure there browser to use our internal proxy servers. Users with the MAC OS X Anyconnect client can connect, they configure their Mac to use our proxy server, but the broswers will not work, clients can reach networks and resources behind the VPN gateway and have access to the Proxy(Tried a telnet to that hostname/port). I am running ASA 8.3(2), Anyconnect(OS X) 3.1.01065.
For access by external users on our network use all Cisco VPN Client, we have a VPN3000 Concentrator and a Cisco ACS 2.6 for authentication.We wanted to upgrade to the latest release of ACS 4, x .... you can set a password expiration for VPN Client? Or make sure that the remote user can change password?
On my setup SSLVPN tunnel fails with AnyConnect 3.0.3050 or above releases to UC520 platform running IOS(151-2.T4).
3.0.4235 3.0.3054 3.0.3050
Connection succeeds with all other versions below 3.0.3050. I’m using standalone client on my PC (tried Win7 and XP).I added my server to the trusted sites list on my IE.
When I tried with anyconnect-win-3.0.3050-k9.pkg which was installed on UC520, the client gets installed successfully and connection was established.When I disconnect the session (had an option to keep the client on PC) and tried to connect back, the connection failed after I have accepted the certificate.I don't see any webvpn debugs on the UC520.
Two ASA-5510 in Failover.I already have several VPN with Cisco VPN client.Now I have the requirement to activate new AnyConnect VPN, witch "migrate" the old VPN to.The customer does not want to purchase licenses for SSL VPN, and then I have to configure the AnyConnect on IPSEC.I read that AnyConnect over IPSEC don't need SSL license - is this right?
Client version 2.5.3055.On the ASA with 8.4.2 (ASDM 6.4.7) I don't find HOW to configure the IPSEC for AnyConnect, while a friend of mine with 8.4.3 did it.Is there a way to configure using CLI, or is an item of the 8.4.2 ?When I try to connect, after authenticating Username & Password, I receive (on the client) a message "AnyConnect was not able to establish a connection to the specified secure gateway." On the "Real Time Log Viewer" I see only SSL, never IKE nor IPSEC
The organization that I worked for purchased large number of Cisco Secure Services Client Licenses for Windows XP. Now they have plans to move to Windows 7. Reading different discussions, I know that SSC ver 5.1 does not work with Windows 7. My questions are:
1) Will there be a new SSC for Windows 7? Will we be able to configure the pre-package for installation with the new SSC?
2) Can we use the existing SSC ver 5 licenses with the new SSC for Win 7?
I had an odd occurrence today on my network. One particular desktop running Vista could not access secure websites (httpsremoved the DHCP lease on my server (Windows 2008), let the desktop pick up a new address and all is good nowThis is a production network (domain) environment
VPN client 5.0.07.0410 on Windows Vista sp2 when I try to connect to my cisco 851.Secure VPN connection terminated locally by the client Reason 412 The remote peer is no longer responding.I turned on debug crypto isakmp and debug crypto ipsec no information displayed on the console.I was a lot futher before but now do not know where to turn.
Having some problems blocking users installing/using secure browsers proxy. Currently runing ASA 5520 ver. 8.3 & IPS SSM-20 7.0 (2) E4 & Websense web filtering. Able to block most proxy sites with Websense that use port 80 but recently found that some users using some products like Njutrino that use their own secure browser that use it's own proxy over SSL connection.
I connect to my corporate network using Cisco AnyConnect Secure Mobility Client. Once connected I can no longer print to my LAN attached printer and other local resources. I use the Cisco/Lyncsys E4200 router on my LAN and can re-connect to the storage on the local LAN by setting up Port Forwarding of port 21 and MS Windows FTP folder sharing. However, I can't seem to connect to a Terminal Services client by forwarding port 3389. Is there a way to connect to the local LAN after logging into the VPN connection. I can connect to regular HTTP/HTTPS sites and most other type of connectiins, just not my own local resources.
2 x ASA5520 with SSM20 . using AnyConnect 3 , users are not getting disconnected from ASA even after the vpn client is closed . Users would not be able to login from the same ip until the session is active. Manual clearing of the session enable the user to log back in .
I have a Pix 515E with a VPN setup. I recently tried to connect Cisco VPN Client and get the following error: "Secure VPN Connection terminated locally by the client. Reason 412: The remote peer is no longer responding" I have previously been able to connect to this VPN using Cisco VPN Client without issue. Below is a copy of my config and VPN Client log & debug logs from Pix. We have Newwave Communications Cable internet, which i just found out the the ISP has recently implemented DOCSIS 3.0. (i'm not sure if that matters).
******************************************************************************************************************************************* pix1(config)# sh run : Saved : PIX Version 6.3(4) interface ethernet0 auto interface ethernet1 auto nameif ethernet0 outside security0
How can we host 300+ secure (https) websites using a couple of public IP's on an ASA5520 with AIP SSM-20 and with as few certificates as possible?
Summary of set-up: We currently host a number of websites using an ASA5520 and use host headers, so have 6 servers with around 40 hosted URL's. The number of websites is due to double very soon and we will need to use more of our public IP's. We can see that we will will run out of public IP's very soon especially as there is a project in the pipeline that has a likely requirement to host an additional 200+ websites.
Each of these websites are required to use https and therefore each must have a certificate which will be very expensive. PCI DSS (payment card industry data security standard) is causing us issues because we had hoped to post the certificates on the firewall (one for each physical server) and then run the data UN-encrypted from the firewall to the relevant web servers, so that we could use one certificate for lots of websites and therefore reduce our certificate costs, however is not best practice to do this due to the data being unencrypted within the firewall and on the DMZ network and therefore potentially open to compromise. I doubt that we could install 200+ certificates on a 5520 and then re-encrypt the data to the web servers especially seeing as we also have an IPS card that is already running at around 70-80% util due to the performance overhead.
BTW - We also have an in-line Breach WAF which will be required to inspect the packets (certificates to be installed on the WAF to allow this).
I've got a short trouble running anyconnect client 2.3.254 under Mac OS X 10.5.6.If I use it to connect an ASA 8.0.4 through a proxy (squid) it doesn't work.If I use Win XP, with same proxy, it works.If I don't use any proxy, with my Mac OS X client (on another WAN access) it works too.So, is anyconnect client supported over proxy server on MAC OS X ???? or did I miss something ?
I have a query regarding MAC authentication for end systems on ASA 5520. Inspite of proving MAC address in endpoint authentication along with AAA, only AAA attribute policies are getting created. MAC authentication is not happening.
Is there any requirement like LDAP or AD is required for MAC authentication?
I have an ASA 5520 soft 8.2(3) when i try to configure the any connect I don't get the SSL and the telnet options for the connection. bare in mind that i don't have the any connect software on my asa nor do i have any certificate. is it essential to get a certificate. do i have to buy it knowing that it will only be used by our company's partners. if not how do i get it
I can't be the only one who misplaced their Router's Password - How do I manage to 'connect' my new devices (Kindle Fire and new smart phone) to my router installed less than 2 years ago.
I've just bought and installed a WAGN320N router and I have identified two problems:
1 - The router actively prevents me from using non-alphanumeric characters in both the admin password and the shared folders passwords, however such passwords are more secure and in most other places recommended. How do I switch off this restriction so that I can set a secure password?
2 - The Filename Encoding on the Storage>Administration page can't be changed. I have changed the drop down box to "Western Europe/Latin1" several times and then clicked "save settings", but setting always flips straight back to "USA" after saving.
I am using AnyConnect VPN 2.5.3054 on two different computers (Windows 7 and XP SP3) with Kaspersky Internet Security 2012. Upon successful connection, the client disconnects and goes into a continous loop of reconnection to no avail, a message at the bottom appears: "A VPN reconnect resulted in different configuration setting. The VPN network setting is being re-initialized. Applications utilizing the private network may need to be restarted."At times I also see after this loop of attempts to reconnect: "The VPN client agent SSL engine encountered an error. Please retry, or restart AnyConnect."Note: I added the VPN applications to the trusted zone of KIS 2012, unchecked the SSL and HTTPS 433 ports and added exceptions for the applications, again without use. I tried uninstalling and installing after disabling KIS but the problem persists.
