SSO Client AnyConnect & clean access

Similar Questions

• Client AnyConnect and connections without client hang for two users

  ASA 5525, v.19 9.1 (5)

  AnyConnect client 3.1.02026

  I have two users who are unable to connect through the AC client or no client via the web portal. The use of the client, it will get stuck in a loop of "check updates". On the portal, the connection will proceed to point "Cisco Secure Desktop validated successfully... Success... Reloading... Please wait. "Then it crashes here.

  This problem occurs for the user, no matter which company laptop it connects to. A help desk technician can use his laptop computer and connect properly, but she could not connect on his own laptop computer or on another laptop. (Same for the other user.) So the question does not appear to be linked to his laptop or the installation of the CA. (Helpdesk reimage her machine early in the process of solving problems before they realized that the question seems to follow the user.)

  I've updated the hostscan - no change in the results file.  Client and clientless connections seem to work for all users. We are puzzled.  Suggestions, anyone?  Thank you!

  The LDAP protocol must be people - Active Directory server.  Chances are the one who manages the SAA should have access at least to look at Active Directory to look that up.  If they are not they need.

  Of course, I don't know a lot about what you use the devices, but if you use ISE, there should be a type of device MNT (monitoring and troubleshooting) - collecting newspapers and, hopefully, they are sent to a certain type of overall collection of syslog (splunk?) tool.

  Otherwise, there should be a device called a CAM (Clean Access Manager) who collects newspapers - which can also be spread to a global tool for syslog - but with cam, you can pull reports from the output in a file delimited by commas (.csv) and pass through them that way.

  -The thing that annoys me, is he gets to two users any computer, they try to connect to any network to which they connect, and other users can authenticate and access network on these same devices.

  -That is why it is rather confused.  Pretty much saying, there must be something with:

  -the pool of intellectual property that they get an IP of

  -their powers AD

  -user name

  -something in this sense, if the information provided is accurate.

• Check the software on the client before granting access

  Hello

  I was wondering if it is possible to do an audit of the programs installed on the client before allowing access. Customers would be Win7 / Win10 machines with client anyconnect, that connects to an ASA 5512. I want to achieve the following objectives:

  (1) client starts connection

  (2) ASA verifies if a program is running on the machine (for example, an antivirus program)-if so, to allow the connection, if not, to refuse the connection

  I thought that this could be achieved by a group policy? If not, is there another way to do this?

  Hello

  Of course, using AnyConnect gesticulations, you can either check if antivirus software is running, updated, etc. or check if the user has a specific file/software installed.

  Consult the following link: http://www.cisco.com/c/en/us/td/docs/security/vpn_client/anyconnect/anyc...

• VPN Client AnyConnect 5 migration

  Dear community

  We are migrating the old Cisco VPN Client 5-Cisco AnyConnect.

  I have a couple of ASA-5510 9.1 (1) running the code with a license Base and in the current configuration, all remote users is in the VPN using standard methods of IKE/IPSec with their laptops (no split tunneling, nothing fancy). The VPN Client currently has a profile that is imported into each user's computer and has a pre-shared key that is stored, the solution works very well.

  Management has decided to go for the more AnyConnect version, rather than Apex which I believe meets all our requirements (preview here: http://www.cisco.com/c/en/us/td/docs/security/vpn_client/anyconnect/anyconnect40/feature/guide/anyconnect40features.html).

  I have three questions about the migration of Client AnyConnect VPN:

  (1) currently my ASA shows that AnyConnect is disabled (see attached screenshot to see the version). Can I upgrade the license on my ASA? If what comes with AnyConnect or do I need to order it separately?

  (2) is it possible to use the AnyConnect VPN Client VPN profile or should I create a new one?

  (3) can someone direct me to a guide for remote access VPN configuration using the rather than the old VPN Client AnyConnect client? Are there any caveats / pitfalls, I should be aware of?

  Thank you very much!

  Best regards
  Martin

  1 order the AnyConnect license you will get a PAK that you can redeem on the auto-serivce portal to get an activation key for your ASA. (You will need the serial number ASA as well.) This will allow you to "Essentials" AnyConnect (former name for more have together (which now includes Mobile), more or less) and allow you to run the command "anyconnect essentials".

  2. the old style IPsec profiles channel not again SSL VPN ones.

  3. There are many many of them out there. If you are new to it, you can find Pete Long message on the blog useful How - to's:

  http://www.petenetlive.com/kb/article/0000069.htm

• using the group name and password group in client anyconnect

  Hello. Is it possible to use the group name/password of the legacy in customer cisco anyconnect vpn client? I checked the AnyConnect Administrator's Guide ' VPN XML Reference"and found nothing on this subject.

  It's true.

  AnyConnect Secure Mobility Client (VPN Module) can be used to connect to both types of VPN remote access:

  1. full SSL VPN tunnel

  2 IKEv2 VPN IPsec.

  The legacy VPN client is used only with the old IKEv1 IPsec VPN and you cannot use this type of VPN client AnyConnect.

• Profile of the client Anyconnect ASDM - cannot change preferences

  Hello

  I operation set up vpn, my problem is that I am putting in place beginning anyconnect before logon. I navigate to the section of the profile client anyconnect in the vpn for remote access and create a profile xml file by clicking on the Add button. I can add a new profile, but as soon as I save the file I can no longer change it. Change is dimmed and if I double click on the file the asdm will return the error: "entry is not a well-formed XML file, schema compliant."

  I am running the following versions of the software:

  ASDM: 7.1 (5) 100

  AnyConnect: 3.1.05152

  ASA: 8.2 (3)<----asa hardware="" doesn't="" support="" running="" a="" newer="">

  I was not able to find any info on this particular problem, but maybe someone here can help?

  Hello Ryan,

  You have the same problem if you download AnyConnect 2.5 and perform the same task?

  Also, have you tried this operation from another machine and the old version of JAVA as 1.6?

  HTH.

• AnyConnect Client AnyConnect communication

  Hello

  We have users that are connected via AnyConnect that cannot communicate with each other using their software phones during extension call. They can communicate with each other when using 7 digits well. They use Split tunnel and we have unchecked network list under the internal policy of the Group and added the AnyConnect subnets. They can call for any other network but network AnyConnect. Is there a defect that does not allow AnyConnect AnyConnect communication?

  Also, I got their firewalls, turn to users and they still couldn't call or ping or tracert.

  Is it possible for a client AnyConnect ping on another AnyConnect client that is on the same subnet?

  Any suggestions?

  Thank you, Pat.

  You can remove the following because it is not necessary ("clear xlate):

  NAT (outside, outside) static source AP-SSLDHCP destination interface static any_vpn any_vpn

  It's OK that the OSPF is advertising and redistribute, so not know internal OSPF routers to send the 10.3.8.0 subnet to the ASA.

  And when I say roads that overlap, I mean when you have for example 10.3.8.0/21 pointing inward, you need to configure more specific routes (10.3.8.0/22) pointing outward. Otherwise, it's going to be routing inwards and the loop since the supposed to exist outside vpn pool. Routing should be good, because you can access internal networks, so I wouldn't change anything regarding the roads.
  

• Client AnyConnect and Sprint 4G

  I have a couple of ASA5520, used to access remote vpn. We use the customer client Anyconnect AnyConnect 3.0.2052. Many users use Sprint and is beginneng for cellular modems capable of 4G.  Users cannot connect through 4G.  They get an error message indicating that the AnyConnect client could not verify changes to the transfer table.  However, using the same material and the same Sprint cellular modem (Novatel) software, they can connect using 3 G. I've seen this with Windows using Windows XP clients.

  If anyone else has experienced this?

  Doug,

  There was a recent bug filed against this problem and should be already set in 3.0.4xxx

  http://Tools.Cisco.com/support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCtq95503

  But then again, not sure if problem would or would not continue for your pair of dongle/operator.

  M,

• Client AnyConnect on Macbook Air

  Hello

  For the client Anyconnect on the Macbook Air, IPSEC) 1 can be used?, 2) split tunneling is disabled?

  Hello

  For Mac:

  AnyConnect

  Activation of the IPsec IKEv2 connections

  OPERATING SYSTEM	AnyConnect 3.1 Predeploy the Package name
  Mac OS X	AnyConnect-macosx-i386 - k9.dmg

  Mac OS X

  Table 8 Mac OS X support modules and the new features in 3.1 AnyConnect

  AnyConnect Module 3.1	Feature	Mac OS X 10.6, 10.7, 10.8 x 86 (32-bit) or x 64 (64-bit)
  	Comments from customers	Yes
  VPN	Kernel	Yes
  	IPv6	Yes
  	Suite-B (IPsec only)	Yes
  Network Access Manager	Kernel	NO.
  	IPv6	NO.
  	Suite-B	NO.
  Posture & Hostscan	Kernel	Yes
  	IPv6	Yes
  	Keystroke logger	Yes x 86 (32-bit) only
  Web Security		Yes
  DART		Yes

  Cisco IPsec client

  The Cisco IPsec client only is not currently supported with MAC OSX 10.6, but the built-in MAC VPN client can be used. The current configuration of head IPsec used for current users of Cisco's VPN IPsec Client should work with this client.

  Split tunneling can be turned off (just choose tunnelall)

  ASA 8.x: allow the tunneling split for AnyConnect VPN Client on the example of Configuration of ASA

  Please check the following information:

  Deployment Client AnyConnect secure mobility

  Release notes for Cisco AnyConnect Secure Mobility, version 3.1 Client

  Thanx.

  Portu

  Please note any workstation that you be useful.

  
  

• Remote clients are denied access to the portal...

  We're having sporadic problems with remote clients are denied access to our portal, they do not even have a login prompt.  We use a SRA 4600 with SonicOS SSL - VPN 8.0.0.3 - 23sv but have see on 8.0.0.1 as well.

  Journal entry:

  Threat of prevented WAF: Injection SQL 1 attack
  More details

  Entry matching: _ga = ga1.2.676072112.1440205737; _dc_gtm_ua-21325736-1 = 1
  Threat: SQL Injection attack 1
  Threat ID: 9005
  Description: SQL Injection is a technique of attack used to exploit websites that construct SQL statements from user-supplied input
  URI: remote.ncmic.com:443/
  Agent: Mozilla/5.0 (Windows NT 10.0;) WOW64; Trident/7.0; RV:11.0) as the Gecko

  The field 'entry matched' is not indicative of the entry that is triggering the signature. There would be something else, we need to study. Can you please make a ticket and we provide access to the portal so we can try to reproduce it?

• ACS - the clean access server

  Hi guys,.

  I have a doubt about the own ACS and access server.

  The clean access server can do the job of the ACS?

  for example, act as a VMPS server, AAA server, or radius server.

  Thank you

  ACS is entirely different to serve own access. See the below url for more details

  http://www.Cisco.com/en/us/products/ps6128/products_qanda_item0900aecd803be813.shtml

• Problem installing Client AnyConnect Secure Mobility Client 3.0.3054

  Hi all

  This is my first post and I hope that someone can help me with my problem.
  I'm trying to install the Client AnyConnect Secure Mobility Client 3.0.3054 on my PC (Windows 7 Professional 32 - bit operating system) and
  I get the following errors.

  Cannot install the Client AnyConnect Secure Mobility Client 3.0.3054 with the Installer error: fatal error during installation. Cannot establish a VPN connection.
  The acsock service failed to start due to the following error: a device attached to the system does not work.
  Please notify.
  Thank you.

  Anna,

  I had the same problem. Have you found the solution in some way?

• Cisco Clean Access Update website and Firewall Port required

  Hello

  I was wondering if anyone might know the site that would be to use the clean Access Manager to put as well as the required firewall port. This is due to a firewall in place. From reading, do not know if it uses another website besides as the next http://www.perfigo.com/clean_machine_1/version-se.txt on port 80.

  Thank you.

  Hello

  For CAM checks and update the rules, this is the only site required.

  HTH,

  Faisal

  --

  If you find this article useful, please note so that others can easily find the answer

• difference between cisco NAC agent and cisco Clean Access Agent

  Hi all

  If anyone has the idea on different between cisco NAC agent and cisco Clean Access Agent, please let us know your ideas.

  Thank you

  In 4.6, the agent has been revised and is now called the NAC agent.  Previous versions were called the clean access Agent.  So roughly, 4.5 and 4.1.3.2 agent are own access agents, and agents 4.6.x and 4.7.x are called NAC agents.

  Some of the changes are moving a lot of the agent configuration in an XML file, redesign of the GUI, adding a service portion (of the sort that the agent of heel is no longer necessary) and the best journaling agent.

• Cannot install Clean Access Manager Server/Bundle (worm: HP Server 4.0)

  Hi all

  can someone help me with the following questions I encountered during the installation of own server access/Manager in

  HP Proliant DL 360 G5

  Type: SAS

  Controller: Controller HP Smart Array P400

  a. first question is if I can install the two Clean Access Server & Manager in a HP Server

  b. after the server starts on the CD, had break showing the command "being run/sbin / loader."

  When I checked it displays "Waiting for device to be stable 20 seconds."

  c.When I tried to only install the clean access server, after loading anaconda it says "no device valid only found o to create new file systems." Plese check your hardware for the problem.

  Waiting for your valuable response for the same

  Dietsch

  CASE and CAM comes as a built... cisco devices is not like a CUCM, Manager of calls where you download the software and put it on a customizable material by you... 3300 servers come on different features... Take a look at the data sheet:

  http://www.Cisco.com/en/us/prod/collateral/vpndevc/ps5707/ps8418/ps6128/product_data_sheet0900aecd802da1b5.html

  3350 and 3390 devices support smart array E200i... and also SAS raid disk controllers...

  b. you must order at least 2 boxes/servers, one for ca and one for CAM... PAK keys/licenses are important here, because the image can be also downloaded EAC, even if you lose the CD... When you order the box, it comes with the basic settings... just for short, you need 1 CAM, 1 CASE, licenses for two then CD are common for SCS and CAM. It's just, you must select the functionlaity in the last step of the installation...

  I hope this helps... all the best...

  REDA