ASA VPN RA, iPad, PC

Similar Questions

• ASA VPN with Fortgate

  Hello people!

  I still have the problem with VPN... Laughing out loud

  I have to create a new VPN site to site between ASA 5510 (8.42 IOS) and Fortgate, but something is very strange, Don t VPN came and I see in the debug crypto 10 ikev1 the newspaper to follow:

  [IKEv1] phase 1 default: incompatibility of types of attributes of class Gr OUP Description: RRs would be: Cfg 1 group would be: Group 2

  But if I ask the other peer to change in Group 2, the msg in the SAA is:

  [IKEv1] phase 1 default: incompatibility of types of attributes of class Gr OUP Description: RRs would be: Group 2 GCF: Group 1

  Fortgate is possible to activate the two specific groups of VPN 1 and 2, and I would ask the other peer left this way and the ASA show:

  [IKEv1] phase 1 default: incompatibility of types of attributes of class Gr OUP Description: RRs would be: Group 2 GCF: Group 1
  [IKEv1] phase 1 default: incompatibility of types of attributes of class Gr OUP Description: RRs would be: Cfg 1 group would be: Group 2

  The show isakmp his:

  9 counterpart IKE: 179.124.32.181
  Type: user role: answering machine
  Generate a new key: no State: MM_WAIT_MSG3

  I have delete and creat VPN 3 x and the same error occurs.

  Everyone has seen this kind of problem?

  Is it using Fortigate version 5 by chance?

  I saw Cisco ASA VPN problems repeatedly with this code Fortigate, but above all it has been a problem of Phase 2 and defining KB life maximally on the side of the ASA has solved it... However this seems not to be your problem here.

  The first thing in your config I see you have PFS enabled - have you insured it is located on the side of Fortinet or tried to turn it off on the side of Cisco to see if it happens?

  Be stuck at MM_WAIT_MSG3 means that you sent your return policy, but then you have not received the third package in the ISAKMP riding so either the Fortigate is unhappy with something or there's a routing problem (however unlikely given that you have already had communication)

  Try on the side of the ASA:

  debug crypto isakmp 7

  You can also confrm your external interface is 'outside1 '? You can see this "see intellectual property."

• ASA VPN - allow user based on LDAP Group

  Hello friends

  I have create a configuration to allow connection based on LDAP Group.

  I m not specialize in the firewall and I tried to follow the links above, but both seem old, commanded several is not available.

  http://www.tunnelsup.com/Cisco-ASA-VPN-authorize-user-based-on-LDAP-group

  http://www.Cisco.com/c/en/us/support/docs/security/ASA-5500-x-series-NEX...

  Anyone know how I can do?

  Thank you

  Marcio

  I like to use the Protocol DAP (dynamic access policies) to control this.  Follow this guide:

  https://supportforums.Cisco.com/document/7691/ASA-8X-dynamic-access-policies-DAP-deployment-guide

• Assign the static IP address by ISE, ASA VPN clients

  We will integrate the remote access ASA VPN service with a new 1.2 ISE.

  Authentication is performed in Active directory. After authentication, can address assigned to a specific user of VPN by ISE IP?

  This means that the same VPN user will always get the same IP address. Thank you.

  Daniel,

  You can override the IETF-RADIUS-Framed-IP-Address in the authorization policy.

  However if I may make a suggestion:

  Unless you have only a handful of users to do so, it may be appropriate to assign the address of ISE pool or perform the mapping of LDAP attributes on ASA itself.

  In the latter case, the IP addresses are kept on the server as LDAP attributes and ASA will map the IP address. You don't want to keep address IP DB in several places.

  M.

• Device behind a Firewall other, ASA VPN

  I have a client who wants to put their VPN / behind the ASA ASA main connected to the Internet.  Both devices have an inside leg for the internal network, but the ASA VPN connects directly to the Internet ASA.

  Topology:

  Outisde FW: Internet transfer Procedure > ASA/FW > leg DMZ to ASA/VPN

  ASA VPN: Outside the L3 Interface interface DMZ of ASA/FW link

  On the outside NAT FW I would be the external address of the VPN / ASA outside the public IP address is available and I have a rule that allows all IP from outside to outside the private IP VPN.  Inside = 192.168.254.1 outside = public IP address.

  Configured on the VPN / ASA, ASA standard SSL Remote Access.

  When I hit the NAT public IP address, nothing happens.  I've run packet - trace on the FW outside, and everything seems good.

  Someone at - it a sampling plan / config for a similar topology?     Internet > ASA/FW > dmz-leg > ASA/VPN

  Thanks in advance,
  Bob

  Can share you your NAT and routing configuration? Of these two ASAs

• ASDM conc (ASA) VPN access

  I have the script like this:

  an ASA, which is the FW, TR making static NAT from the public to the private IP and private IP address add is add conc (another ASA) VPN. I am accessing these devices via the VPN client and I get the address IP of VPN pool set on VPN conc. VPN conc. is in a DMZ VLAN, but it also has connection to the local network segment. Purposes of mgmt, I connect to this VPN through SSH conc via a switch in the local network segment. To use the http access, I have to be on one of the servers that are in the local network segment. Since then, when I set up the VPN connection, I'm sure VPN conc., what can do to access http directly from my PC?

  This sets up on the conc VPN:

  management-access inside
  
  After that you should be able to use ASDM over the VPN tunnel, by connecting to its inside ip address.
  hth
  
      Herbert
  
      (note, I assume the name of the interface connected to the LAN is named "inside", if not adapt at will )

• ASA VPN positive = SSL VPN?

  Hello

  I have a pair of FO, I need to exchange an ASA5520 who owns a license of VPN over 750

  Can I use an ASA5520 with ASA5500-SSL-750 instead

  Regards Tony

  Yes, it is always available on order. Part number: ASA5520-VPN-PL =

  In addition, this more ASA VPN would be much much cheaper than the SSL VPN license.

  Thank you

  Kiran

• New ASA/VPN configuration

  So, I am looking to add one of my spare 5510 firewall to my secondary network as a vpn connection.

  All I want this new ASA to do is handle my site anyconnect VPN connections.  I'm pretty new to ASAs if any help would be great.  I know how to create a new access VPN on my ASA and I added a NAT for my inside and outside traffic to my new Pool of IP VPN.

  My question is, since it's only for the VPN and I want all my current internal traffic to continue to the asa 5510 existing routing, do I have to enter the ACL to my new single AAS of VPN?  ACLs are used for VPN traffic and do I need them to traffic the route via VPN?

  I'll put up inside interface of connection to one of my main Cisco switches and the outside interface connects to my DMZ switch on the new ASA only VPN.

  Thank you

  I don't know if I am how you connect to the external interface of single ASA VPN. Normally, in this type of installation, we would see the ASA VPN "in parallel" with the perimeter firewall.

  You mention the DMZ switch that threw me a little. If you are in France through your main firewall and go to single ASA VPN via the DMZ then Yes you will need to allow several open ports (protocol 50, udp/500, tcp/443 among others) and may have to do some other techniques (NAT - T, etc.) depending on the type of remote you are implementing. That's why we rarely see this configuration used - it adds a good dose of complexity without significant benefit.

  When the old facility is used, you need to switch internal to know to route traffic to the pool VPN through the only ASA VPN inside the interface. A static route is more often used, although you can use OSPF or EIGRP if you wanted to.

  Should generally not be any access list that VPN traffic around the Bank access lists incoming interface. Back to remote clients traffic is coming from inside and out through (and is usually part of anestablished connection) so no access list is necessary inside.

• ASA VPN on physical IP address only?

  Hello

  Is it possible to set up a virtual IP address dedicated to endpoint on ASA VPN version 8.3 and later?

  I don't want to use the physical IP address on my external interface.

  Thank you

  No problem. Mark pls kindly responded to this post like so that others may learn from your post. Thank you.

• ASA Vpn load balancing and failover

  Hi all.

  We have two asa5520 configured as main unit and emergency in failover configuration, and everything works fine.

  Is it possible with this configuration (switch), configure the vpn load balancing/grouping?

  Thank you

  Daniele

  Hi Daniele,

  You cannot run two of them on two firewalls ASA, VPN feature load balancing or failover functionality.

  Where you need to use the two feature, you must use more than three ASA firewall, two first ASAs will work as the failover and the ASA third will work as cluster VPN for them, the following example uses four firewalls:

  ASA1 (active FO) - ASA2 (TF Standby)

  (VPN virtual master)

  |

  |

  |

  |

  (Backup VPN device)

  ASA3 (active FO) - ASA4 (TF Standby)

  Kind regards

  Wajih

• can we use vpn on ipad

  HI, I just want to know can I use vpn using ipad. ? If can what are the steps to do...

  Thank you

  Tino

  Tino,

  Here is the configuration guide of the anyconnect for apple ios devices, there must be requirements (hardware and licenses) so that it works.

  http://www.Cisco.com/en/us/docs/security/vpn_client/AnyConnect/anyconnect24/iOS4.2-user/guide/iPad-ugac-iOS4.2.html

  Let me know if you need anything else, be it

  Tarik Admani
  * Please note the useful messages *.

• Anconnect Cisco ASA VPN deployment

  Hello

  I have a request for information about the deployment for the ASA who must support more than 10000 clients. I understand that several ASA would be necessary for her however I was wondering what can be typical design for this? The ASA multiple is configured as vpn cluster/load balancing, etc... ?

  I would if there is any design document for it. The current configuration is that a pair of ASA active / standby, I was wondering how to combine the total connection, if I need 15000 connections vpn; pairs of example 2 active / standby with vpn clustering/load balancing, etc... ?

  Thank you.

  You are right, that the vpn load-balancing is the technology, you need to deploy for this. With this, you can combine multiple devices to a cluster of load sharing. These devices may be different, for example two 5555 with two 5545 that would give you a total of 15000 VPN connections.
  Of course, you plan for failure of the device. So you can deploy 4 * 5555 and also if an ASA is lost you yet 15000 connections (well, at least based on the datasheet; I would not push the number of connections to the limit).
  You can also deploy these devices also as FO-systems for redundancy. 3 * 2 * 5555 would also give you redundancy.

  This is under the assumption that users connect to office even where the ASAs have one L2-connection to another which is necessary for the VPN load-balancing. If users connect through different places, then these ASAs cannot use VPN-load balancing, unless you have a L2 connection between the loacations.

  If you have multiple sites, you should also think about the shared license server that could save a lot of money if your users do not always use the same gateway.

  And last point: as much as possible for your AAA with a central RADIUS server set up to reduce the probability of a misconfiguration on ASAs multiples.

  Sent by Cisco Support technique iPad App

• AnyConnect ASA laptop and iPad AnyConnect

  Hello

  I was wondering if there is a way to have the iPad AnyConnect SSl VPN Client and standard AnyConnect Client to connect to the same IP address on the external interface of the ASA and have the ASA determine if the system is and iPad or a normal laptop.  So, for example if I had SSL VPN configured on the SAA with an IP address of https://5.5.5.5 both users of the iPad and laptop users would connect ASA outside interface using this unique ip address.  Once authenticated, the ASA would be able to determine that the user is using an iPad and limit them or live in an area of the network and if the user is on your laptop by using the normal AnyConnect client pass through sales we have on our network and normal NAC security controls.

  So basically I want to use the iPad and using a laptop an IP only, ASA, but according to the device direct them to various areas of the network that we are unable to install anti-virus software and what not on the iPad and want to direct them to an area where they can't do as much damage if they have been compromised.

  Thank you

  Hi you can use DAP in this case to scan on the client that you are coming from and apply different policies depending on the client that connects.

  For example. You can apply a policy to all s BONES (mostly laptops) and if they enter the notebook computer category you can give them a different policy.

  Also the presence of anti-virus software can also be detected strategies with ssl vpn.

  http://www.Cisco.com/en/us/products/ps6120/products_white_paper09186a00809fcf38.shtml#T2

  Let me know if it helps.

• Vs ASA VPN SSL IPSEC

  Hello all -

  I'm working on an ASA 5510, running version 8.4. I'm looking for something that I imagine would be simple, but having a few problems.

  I am configuring the connection profile for the client and clientless VPN on the SAA. I would like the profiles of customer (who will serve with anyconnect by our internal staff) to have the possibility to select the profile to login on the login page. I have create a subnet by using policies and business unit to restrict access to various servers. This option button is displayed on the page of remote vpn in the ASDM, I select it and problem solved, they see a drop-down menu when using the anyconnect client, select one and the appropriate IP pool is assigned.

  Now, when I am configuring profiles without client (to be used by our external business clients), I don't want that they have the ability to choose a profile. At least not the ability to see all of the internal profiles, I created for our internal employees. It is displayed by selecting this option in the "client access", it also allows her to "client access". What Miss me in how I can prevent our external collaborators via SSL, see the profiles that I created for our internal employees via the drop-down list? As I hinted above, I use the ASDM.

  Any help would be appreciated-

  Brian

  Hello

  Unfortunately this is not possible because when you enable the option for users to select the connection profile, it will be available for all connections. If this is not enabled the default policy will be selected so it is a must to have chosen option.
  What you can do is to create a group URL and maps it to a specific connection profile, so when users type in the full URL for example https://my domain.com / external it will take the user directly on the specific connection profile.

  The size to the bottom of this configuration is that if someone types in the URL without the group URL it is taken to the default profile and can see the drop-down list with all connection profiles.

  Sent by Cisco Support technique iPad App

• Certificate on ASA VPN

  Hello

  I want to apply AnyConnect VPN of RA IPSec on SAA with the users that can connect using cards to chip. So I need to install digital certificates on SAA.

  Follows 4 things of my contacts (who is on holiday and so I have to find via this portal what exactly what I need to do with them)

  1 root-ORG - CA.cer - Root CA from our own CA .cer format

  2 Proc-ORG - CA.cer - he says that it is of "issued by: root-ORG-CA. Do not know what exactly is this certificate. Again the extension is .cer.

  3 ASA - CERT.cer - here, he argues that it is "issued by: Proc-ORG-CA. The name I guess that's the identity certificate should I install on ASA. Once the extension is .cer

  4 ASA - Priv.key - it is the private key in the .key file, I can read in Notepad.

  Now according to my knowledge goes, I think: I have to install the root-ORG - CA.cer on SAA. Then, I need some kind installation private key + certificate of individual or combined identity. But I am confused how to proceed

  (a) what could be the Proc-ORG - CA.cer ?

  (b) what is the exact order in which I should install things?

  (c) is the most convenient for these things or paste content in CLI ASDM?

  (d) for each file what extensions do I need? I need to convert certificates in other formats?

  Thanks in advance!

  Hello

  Here are answers to your questions:

  a. Proc-ORG - CA.cer seems to be the server intermediate CA that signs the certificate and it has been authorized by your certification authority root to do it.

  b. you must first import the root CA, then intermediate authority and finally the ASA CA

  c. you can do both using ASDM and CLI. However, I personally prefer CLI

  d. REB is good for the intermediate and root. For SAA, if you RECs and a private key, you must convert the pkcs12 format.

  Hope this is clear.

  Thank you

  PS: Please do not forget to rate and score as correct answer if this answered your question