User Anyconnect client interface customization

Similar Questions

• ASA5505 with 10 users. Need to connect 25 remote users with AnyConnect Client

  Hello to everyone.

  I ASA5505 with license 10 users. I need to connect 25 remote users via SSL VPN (in my case cisco Anyconnect client). So I have to buy the license more security (ASA5505-SEC-PL =) for more then 10 simultaneous VPN connections on Cisco ASA 5505. Fix?

  And the main question. What I need to order the user getting up-to-date (for example ASA5505-SW-10-50 =, or ASA5505-SW-10-UL =) license for my device Cisco ASA5505 in order to have 25 connections of concurrent remote users without restriction for each remote user?

  You need the license SecPlus for increased remote access users. But you don't need an extra user license if you still only up to 10 internal systems.

• Username, preserved in the AnyConnect Client user name dialog box

  I have one question remains on my client anyconnect 2.5.2006. The user in the dialog box name is cached. We do not want to be cached and have users to enter their username every time.

  Shilpa Gupta mentioned on another post of mine. I was wondering if anyone has any other thoughts! The 2.5.2006 resolved customer I had another question, so come back to 2.4 is not an option at this point.

  For clearing up the credentials in the dialog box when using AnyConnect I found one of the bug:-
  
  CSCsx76993
  
  

  Symptom:

  User credentials are cached in the preferences.xml file when you use the Anyconnect client.  So when they revive Anyconnect, the user name is displayed in the client.

  Conditions:

  You can see all the client anyconnect.  It is a configurable option in the IPSec client.

  Workaround solution:

  Currently there is no work around

  And I can see it resolved in 2.4.202 however, I'm not sure if its fixed in 2.5 also. For this I would like to hear from others.

  Kind regards

  Shilpa

  Hello

  All bug fixes and new features in 2.4.x are also in 2.5.

  However the "bug" Shilpa has pointed out, is not really a bug, but an enhancement request, in other words in 2.3 before the cached username is expected behavior and is always the default behavior in the 'fixed' versions, so just the upgrade won't change anything. What has changed is that now you can change the behavior by defining a new parameter RestrictPreferenceCaching in the local policy file:

  http://www.Cisco.com/en/us/docs/security/vpn_client/AnyConnect/anyconnect25/Administration/Guide/ac04localpolicy.html#wp1055429

  So for example the addition

      All
  
      

  your local police should achieve what you want.

  HTH

  Herbert

• Oracle BI Presentation Services User Interface Customization

  Hi, I read the chapter
  Oracle BI Presentation Services User Interface Customization
  in the manual
  Oracle Business Intelligence Presentation Services Administration Guide (Version 10.1.3.2 December 2006)
  
  There's a note (copied from this manual)
  
  NOTE: In Oracle BI, customization of the UI presentation Services and appearance
  is done by changing styles and the message XML files and skins and not through the use of
  JavaScript. You should not change the JavaScript files located in the SAROOTDIR\web\app\res folder.
  where SAROOTDIR is the installation directory. This is because the objects and methods in these
  scripts can change, and because these files may be replaced during the upgrade. (In a dashboard
  users with the appropriate permissions can customize an individual dashboard section by adding
  HTML to it. This HTML can include JavaScript. For more information, read Oracle Business
  Responses of intelligence, dashboards and offer interactive user guide.)
  
  My question is:
  When there is an upgrade, will be replaced only the javascript files?
  Should I need to customize, I have modified the files in SAROOTDIR\web\app\res files? (using IIS, not OC4J)
  When there is a willingness to upgrade, image, css, replaced xml files files files?
  If the files (for customizing the User Interface) will be replaced after the upgrade, is it possible to avoid replacing?
  
  
  If there is a deployment to another machine, do I need to copy files that have changed (for the customization of the User Interface) to paste the SAROOTDIR\web\app\res
  folder? is this a correct way? or correct anyway?
  
  
  Thank you very much!

  Not really. Best practice is not to touch the original skin + style files and work with the own. In this way there is no worries when you upgrade.

• Cisco ASA 5515 - Anyconnect users cannot ping other users Anyconnect. How can I allow icmp between Anyconnect users traffic?

  Configuration of the ASA is below!

  ASA Version 9.1 (1)

  !

  ASA host name

  domain xxx.xx

  names of

  local pool VPN_CLIENT_POOL 192.168.12.1 - 192.168.12.254 255.255.255.0 IP mask

  !

  interface GigabitEthernet0/0

  nameif inside

  security-level 100

  192.168.11.1 IP address 255.255.255.0

  !

  interface GigabitEthernet0/1

  Description Interface_to_VPN

  nameif outside

  security-level 0

  IP 111.222.333.444 255.255.255.240

  !

  interface GigabitEthernet0/2

  Shutdown

  No nameif

  no level of security

  no ip address

  !

  interface GigabitEthernet0/3

  Shutdown

  No nameif

  no level of security

  no ip address

  !

  interface GigabitEthernet0/4

  Shutdown

  No nameif

  no level of security

  no ip address

  !

  interface GigabitEthernet0/5

  Shutdown

  No nameif

  no level of security

  no ip address

  !

  interface Management0/0

  management only

  nameif management

  security-level 100

  192.168.5.1 IP address 255.255.255.0

  !

  passive FTP mode

  DNS server-group DefaultDNS

  www.ww domain name

  permit same-security-traffic intra-interface

  the object of the LAN network

  subnet 192.168.11.0 255.255.255.0

  LAN description

  network of the SSLVPN_POOL object

  255.255.255.0 subnet 192.168.12.0

  VPN_CLIENT_ACL list standard access allowed 192.168.11.0 255.255.255.0

  pager lines 24

  Enable logging

  asdm of logging of information

  Within 1500 MTU

  Outside 1500 MTU

  management of MTU 1500

  no failover

  ICMP unreachable rate-limit 1 burst-size 1

  ASDM image disk0: / asdm - 711.bin

  don't allow no asdm history

  ARP timeout 14400

  no permit-nonconnected arp

  NAT (exterior, Interior) static source SSLVPN_POOL SSLVPN_POOL static destination LAN LAN

  Route outside 0.0.0.0 0.0.0.0 111.222.333.443 1

  Timeout xlate 03:00

  Pat-xlate timeout 0:00:30

  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00

  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00

  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

  timeout tcp-proxy-reassembly 0:01:00

  Floating conn timeout 0:00:00

  dynamic-access-policy-registration DfltAccessPolicy

  WebVPN

  list of URLS no

  identity of the user by default-domain LOCAL

  the ssh LOCAL console AAA authentication

  AAA authentication http LOCAL console

  LOCAL AAA authorization exec

  Enable http server

  http 192.168.5.0 255.255.255.0 management

  No snmp server location

  No snmp Server contact

  Server enable SNMP traps snmp authentication linkup, linkdown warmstart of cold start

  Crypto ipsec pmtu aging infinite - the security association

  Crypto ca trustpoint ASDM_TrustPoint5

  Terminal registration

  E-mail [email protected] / * /

  name of the object CN = ASA

  address-IP 111.222.333.444

  Configure CRL

  Crypto ca trustpoint ASDM_TrustPoint6

  Terminal registration

  domain name full vpn.domain.com

  E-mail [email protected] / * /

  name of the object CN = vpn.domain.com

  address-IP 111.222.333.444

  pair of keys sslvpn

  Configure CRL

  trustpool crypto ca policy

  string encryption ca ASDM_TrustPoint6 certificates

  Telnet timeout 5

  SSH 192.168.11.0 255.255.255.0 inside

  SSH timeout 30

  Console timeout 0

  No ipv6-vpn-addr-assign aaa

  no local ipv6-vpn-addr-assign

  192.168.5.2 management - dhcpd addresses 192.168.5.254

  !

  a basic threat threat detection

  Statistics-list of access threat detection

  no statistical threat detection tcp-interception

  SSL-trust outside ASDM_TrustPoint6 point

  WebVPN

  allow outside

  CSD image disk0:/csd_3.5.2008-k9.pkg

  AnyConnect image disk0:/anyconnect-win-3.1.04066-k9.pkg 1

  AnyConnect enable

  tunnel-group-list activate

  attributes of Group Policy DfltGrpPolicy

  Ikev1 VPN-tunnel-Protocol l2tp ipsec without ssl-client

  internal VPN_CLIENT_POLICY group policy

  VPN_CLIENT_POLICY group policy attributes

  WINS server no

  value of server DNS 192.168.11.198

  VPN - 5 concurrent connections

  VPN-session-timeout 480

  client ssl-VPN-tunnel-Protocol

  Split-tunnel-policy tunnelspecified

  value of Split-tunnel-network-list VPN_CLIENT_ACL

  myComp.local value by default-field

  the address value VPN_CLIENT_POOL pools

  WebVPN

  activate AnyConnect ssl dtls

  AnyConnect Dungeon-Installer installed

  AnyConnect ssl keepalive 20

  time to generate a new key 30 AnyConnect ssl

  AnyConnect ssl generate a new method ssl key

  AnyConnect client of dpd-interval 30

  dpd-interval gateway AnyConnect 30

  AnyConnect dtls lzs compression

  AnyConnect modules value vpngina

  value of customization DfltCustomization

  internal IT_POLICY group policy

  IT_POLICY group policy attributes

  WINS server no

  value of server DNS 192.168.11.198

  VPN - connections 3

  VPN-session-timeout 120

  Protocol-tunnel-VPN-client ssl clientless ssl

  Split-tunnel-policy tunnelspecified

  value of Split-tunnel-network-list VPN_CLIENT_ACL

  field default value societe.com

  the address value VPN_CLIENT_POOL pools

  WebVPN

  activate AnyConnect ssl dtls

  AnyConnect Dungeon-Installer installed

  AnyConnect ssl keepalive 20

  AnyConnect dtls lzs compression

  value of customization DfltCustomization

  username vpnuser password PA$ encrypted $WORD

  vpnuser username attributes

  VPN-group-policy VPN_CLIENT_POLICY

  type of remote access service

  Username vpnuser2 password PA$ encrypted $W

  username vpnuser2 attributes

  type of remote access service

  username admin password ADMINPA$ $ encrypted privilege 15

  VPN Tunnel-group type remote access

  General-attributes of VPN Tunnel-group

  address VPN_CLIENT_POOL pool

  Group Policy - by default-VPN_CLIENT_POLICY

  VPN Tunnel-group webvpn-attributes

  the aaa authentication certificate

  enable VPN_to_R group-alias

  type tunnel-group IT_PROFILE remote access

  attributes global-tunnel-group IT_PROFILE

  address VPN_CLIENT_POOL pool

  Group Policy - by default-IT_POLICY

  tunnel-group IT_PROFILE webvpn-attributes

  the aaa authentication certificate

  enable IT Group-alias

  !

  class-map inspection_default

  match default-inspection-traffic

  !

  !

  type of policy-card inspect dns preset_dns_map

  parameters

  maximum message length automatic of customer

  message-length maximum 512

  Policy-map global_policy

  class inspection_default

  inspect the preset_dns_map dns

  inspect the ftp

  inspect h323 h225

  inspect the h323 ras

  inspect the rsh

  inspect the rtsp

  inspect esmtp

  inspect sqlnet

  inspect the skinny

  inspect sunrpc

  inspect xdmcp

  inspect the sip

  inspect the netbios

  inspect the tftp

  Review the ip options

  inspect the icmp

  !

  global service-policy global_policy

  context of prompt hostname

  no remote anonymous reporting call

  : end

  Hello

  Here's what you'll need:

  permit same-security-traffic intra-interface

  VPN_CLIENT_ACL standard access list allow 192.168.12.0 255.255.255.0

  destination NAT (outside, outside) SSLVPN_POOL SSLVPN_POOL SSLVPN_POOL SSLVPN_POOL static static source

  Patrick

• Disable the download Anyconnect client / turn off the url connection

  Hello

  Is there a way to disable the Anyconnect client download when you navigate to the anyconnect url? Or just make the connection of the url is not accessible
  While users can still connect with their client anyconnect installed in the corporate network.

  Thank you!

  Dave.

  You can't disable the download directly. This had been discussed several times here at least one CSC who also confirmed a case of TAC. Link.

  A hack is that if your image Anyconnect is an older, users will never invited to be updated.

  Re URL, you can turn off the alias that fill the drop-down list on the web portal, but also long as your have the SSL VPN service active, external interface of the ASA will be used toward the top of the login page to less than the default connection profile.

  What is your reason for wanting to turn off in the first place? Perhaps there is another method to achieve what you want.

• Impossible to ping anyconnect Client IP de ASA

  Hello world

  I can't connect to cisco anyconenct fine no problem.

  When connected I ping the SAA in interface and other subnets that are behind the ASA inside the interface from the PC connected through the VPN.

  My only problem is that of ASA, I cannot ping IP of 10.0.0.5.

  ASA1 # sh anyconnect vpn-sessiondb

  Session type: AnyConnect

  User name: anyconnect_user index: 54

  Assigned IP: 10.0.0.5         Public IP address: 192.168.98.2

  Protocol: AnyConnect-Parent-Tunnel SSL DTLS-Tunnel
  License: AnyConnect Essentials
  Encryption: AnyConnect-Parent: (1) no SSL Tunnel: (1) AES128 DTLS-Tunnel: (1) AES128
  Hash: AnyConnect-Parent: (1) no SSL Tunnel: (1) SHA1 DTLS-Tunnel: SHA1 (1)
  TX Bytes: 12318 bytes Rx: 73502
  Group Policy: anyconnect_group
  Tunnel of Group: anyconnect_connection_profile
  Connect time: 23:21:28 MST Friday, March 7, 2014
  Duration: 0 h: 34 m: 33 s
  Inactivity: 0 h: 00 m: 00s
  Result of the NAC: unknown
  Map VLANS: VLAN n/a: no

  I ping the switch connected to ASA inside interface

  ASA1 # ping 10.0.0.2

  Type to abort escape sequence.

  Send 5, echoes ICMP 100 bytes to 10.0.0.2, time-out is 2 seconds:

  !!!!!

  Success rate is 100 percent (5/5), round-trip min/avg/max = ms 04/01/10

  I can ping from the ASA inside interface

  ASA1 # ping 10.0.0.1 - ASA inside interface

  Type to abort escape sequence.

  Send 5, echoes ICMP 100 bytes to 10.0.0.1, time-out is 2 seconds:

  !!!!!

  Success rate is 100 per cent (5/5), round-trip min/avg/max = 1/1/1 ms

  ASA1 # ping 10.0.0.5

  Type to abort escape sequence.

  Send 5, echoes ICMP 100 bytes to 10.0.0.5, time-out is 2 seconds:

  ?????

  Success rate is 0% (0/5)

  ASA1 #.

  Journal of the shows

  March 7, 2014 23:00:52: % ASA-6-302020: built outgoing ICMP connection for 10.0.0.5/0(LOCAL\anyconnect_user faddr) gaddr laddr 192.168.1.171/1168 192.168.1.171/1168

  March 7, 2014 23:01:02: % ASA-6-302021: connection of disassembly ICMP for faddr 10.0.0.5/0(LOCAL\anyconnect_user) gaddr laddr 192.168.1.171/1168 192.168.1.171/1168

  Where IP 192.168.1.171 is ASA outside interface

  Concerning

  MAhesh

  Hello Manu,

  Have you tried to ping the network interior? Or the package from inside the source interface of the ASA? Remember, you should have some rules exemption nat for packets going through the VPN connection. That's how specify us which networks are allowed to join the VPN clients. If you ping without specify any interface the packet is going to come from the external interface, and probably this interface/subnet is not allowed through the VPN connection. Using split tunnel or tunnelall?

  You can try to activate the management of access to the inside interface and the ping from the inside. These packages should hit the exemption nat rule and will be sent through the tunnel instead of the Internet.

  These are the necessary commands:

  To specify an interface as an interface of management only, enter the following command:

   hostname(config)# management access inside

  Then, you could do an inside 10.0.0.5 ping to ping the ASA AnyConnect client.

  Notes on the access management command:

  If your VPN tunnel ends on an interface, but you want to manage the ASA by accessing a different interface, you can identify this interface as an interface for management access. For example, if you enter the ASA of the external interface, this feature allows you to connect inside the interface by using ASDM, SSH, Telnet or SNMP. or you can test inside the interface at the entrance to the external interface. Management is accessible by the following VPN tunnels types: client IPsec, the client AnyConnect SSL VPN and IPsec LAN-to-LAN.

  Hope this helps,

  Luis

• AnyConnect Client AnyConnect communication

  Hello

  We have users that are connected via AnyConnect that cannot communicate with each other using their software phones during extension call. They can communicate with each other when using 7 digits well. They use Split tunnel and we have unchecked network list under the internal policy of the Group and added the AnyConnect subnets. They can call for any other network but network AnyConnect. Is there a defect that does not allow AnyConnect AnyConnect communication?

  Also, I got their firewalls, turn to users and they still couldn't call or ping or tracert.

  Is it possible for a client AnyConnect ping on another AnyConnect client that is on the same subnet?

  Any suggestions?

  Thank you, Pat.

  You can remove the following because it is not necessary ("clear xlate):

  NAT (outside, outside) static source AP-SSLDHCP destination interface static any_vpn any_vpn

  It's OK that the OSPF is advertising and redistribute, so not know internal OSPF routers to send the 10.3.8.0 subnet to the ASA.

  And when I say roads that overlap, I mean when you have for example 10.3.8.0/21 pointing inward, you need to configure more specific routes (10.3.8.0/22) pointing outward. Otherwise, it's going to be routing inwards and the loop since the supposed to exist outside vpn pool. Routing should be good, because you can access internal networks, so I wouldn't change anything regarding the roads.
  

• Option 'The Anyconnect client profile' missing in ASDM

  Hello

  I am trying to configure Anyconnect on the SAA and have successfully updated licensing, as well as downloaded the pkg anyconnect for web deployment. I activated anyconnect on the external interface and can now have the ASA push the client machine. Works very well. However, I would like to add the backup servers that the client will attempt to reach where the primary is down. I understand that "customer profiles" can be created to customize the parameters as follows. Problem is, when I followed the setup guide with instructions for the manufacture of customer profiles here:

  http://www.Cisco.com/en/us/docs/security/vpn_client/AnyConnect/anyconnect30/Administration/Guide/ac02asaconfig.html#wp1289905

  It shows that I should have an option for the Anyconnect Client profile and settings of the Anyconnect Client.

  I don't have one of these options in ASDM. Here's what it shows mine:

  

  I have another 'Profiles of Client SSL' option, but it does not appear the same as the above.

  

  Can anyone help with what I have to do to get the customer profiles option to be available, so I can add backup server for the customer information? Thank you!

  It could be your version ASDM. I note, however, that the Release Notes for ASDM for 6.3 (1) Note that this version (when combined with the support ASA 8.3 (1)) introduced the AnyConnect profile editor.

  You can run the 6.4 (7) Version ASDM curent with your ASA remaining on 8.2 (1). It would not hurt to try this.

  A little more awkward alternative is to use the stand-alone profile AnyConnect editor and manually deploy the xml profiles that result.

• Error installing AnyConnect client v3.1.07021 on Windows 8.1

  Hi people, I'm trying to install the d'anyconnect-win-3.1.07021-pre-deploy-k9.msi anyconnect client (confirmed working on the machine of another user), and at the end of the installation process, I get the following error:

  There is a problem with this Windows Installer package. A program run as part of the Setup did not finish as expected. Contact your provider to support personal or package.

  Accept the error supports installation, and the customer will not be installed.

  I checked the windows logs and found this one:

  Product: Cisco AnyConnect Secure customer mobility - error 1722. There is a problem with this Windows Installer package. A program run as part of the Setup did not finish as expected. Contact your provider to support personal or package.  Action VACon64_ndis6_Install, location: C:\Program Files (x 86) \Cisco\Cisco AnyConnect Secure Mobility Client\VACon64.exe, command:-install "C:\Program Files (x 86) \Cisco\Cisco AnyConnect Secure Mobility Client\\vpnva-6.inf" VPNVA

  Can someone provide to advance this one?

  Kind regards

  Brendan

  Will you please follow this document and it should address the issue.

  Kind regards
  Dinesh Moudgil

  PS Please rate helpful messages.

• AnyConnect Client timeout

  Sorry if this question has already been addressed in another thread. I looked and found nothing, so I post here.

  We currently use the anyconnect client on of our ASA5520. The only question I have now is that the time-out is not

  seem to work correctly. I have never disconnected Timeout Idle current group policy set to 30 minutes and customers

  unless you disconnect manually.

  At first, I thought that KeepAlive or DPD has some how this affects. But after testing, they seem not to be. It seems

  that the timeout works everything simply. Anyone have any ideas of what I'm missing? Or the inactivity timeout function simply not work?

  Thank you!

  Jeff

  I look at the idle time-out as inheritance characteristic due to the fact that modern operating systems is inherently chatty.  If you run a sniffer on the AnyConnect AV and then let the PC for a few minutes, you can capture all kinds of packets to and from the client, even if you are not actively working on the PC.  If your intention is to manage user sessions, you can set a max session.  Once the maximum session time is reached, the user will be disconnected from the system.  Users must then reconnect if they require a continuous network access.  Dead Peer Detection is the mechanism used by the client or network to quickly detect a condition where the peer does not respond and the connection has failed.  For example, in a perfect world, all users of AnyConnect will right-click on the icon and click on disconnect to gracefully disconnect the session.  In reality, users might lose their connection to the Internet, on the eve of their PC when connected, etc..  Without DPD, head of network device will retain the now obsolete session information where the SSL client tries to reconnect.  Needed manual intervention by an administrator to manually disconnect sessions.  With DPD, the head can recognize the loss of conectivity to the customer and terminate the session information.  DPD is a Hello and ACK process between client and server.  If a series of Hello messages don't that would acknowledgment, the related session information are deleted from the client or server.  It is maintained by SSL and is not connected to the network traffic related timeout.

  Here are a few links for your reference.  Please let me know if I can be more useful.

  http://www.Cisco.com/en/us/docs/security/ASA/asa80/configuration/guide/SVC.html#wp1072975

  http://www.Cisco.com/en/us/docs/security/ASA/asa80/configuration/guide/vpngrp.html#wp1134794

• AnyConnect client profile

  When I deploy a clent on Cisco ASA, web deployment, but anyconnect client profile has been installed by file .msi locally on the pc, client anyconnect gets made profile updates on Cisco ASA? or is - this client anyconnect required to be downloaded, installed through Cisco ASA to get the profile desired?

  The profile.xml appropriate (or whatever you named it when you configure the profile on the SAA) should be automatically downloaded (or updated if changes have been made) as part of the connection process once that the user has chosen the connection profile and initiated the connection.

  By default (in Windows 7), these files are stored in the hidden directory C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client\Profile

• AnyConnect client reconnects after 1 minute

  AnyConnect client reconnects after 1 minute; WHY

  version 3.1.02026

  ASA:asa911 - k8.bin

  [25/04/2013 08:16:11] Establish the VPN session...

  [25/04/2013 08:16:11] Checking for updates to profile...

  [25/04/2013 08:16:11] Checking for updates...

  [25/04/2013 08:16:11] Checking for updates of customization...

  [25/04/2013 08:16:11] Execution of required updates...

  [25/04/2013 08:16:12] Establish the VPN session...

  [25/04/2013 08:16:12] Setting up VPN - initiate the connection...

  [25/04/2013 08:16:12] Setting up VPN - examining the system...

  [25/04/2013 08:16:12] Setting up VPN - activation card VPN...

  [25/04/2013 08:16:15] Setting up VPN - configuration system...

  [25/04/2013 08:16:16] Establish a VPN...

  [25/04/2013 08:16:16] Connected to my.vpn.com.

  [25/04/2013 08:16:16] Connected to my.vpn.com.

  [25/04/2013 08:17:19] Reconnection to my.vpn.com...

  [25/04/2013 08:17:19] Setting up VPN - examining the system...

  [25/04/2013 08:17:24] Setting up VPN - activation card VPN...

  [25/04/2013 08:17:25] Setting up VPN - configuration system...

  [25/04/2013 08:17:25] Establish a VPN...

  [25/04/2013 08:17:25] Connected to my.vpn.com.

  [25/04/2013 08:17:25] Reconnection to my.vpn.com...

  [25/04/2013 08:17:25] Setting up VPN - examining the system...

  [25/04/2013 08:17:25] Setting up VPN - activation card VPN...

  [25/04/2013 08:17:25] Setting up VPN - configuration system...

  [25/04/2013 08:17:25] Establish a VPN...

  [25/04/2013 08:17:25] Connected to my.vpn.com.

  [25/04/2013 08:16:11] Establish the VPN session...

  [25/04/2013 08:16:11] Checking for updates to profile...

  [25/04/2013 08:16:11] Checking for updates...

  [25/04/2013 08:16:11] Checking for updates of customization...

  [25/04/2013 08:16:11] Execution of required updates...

  [25/04/2013 08:16:12] Establish the VPN session...

  [25/04/2013 08:16:12] Setting up VPN - initiate the connection...

  [25/04/2013 08:16:12] Setting up VPN - examining the system...

  [25/04/2013 08:16:12] Setting up VPN - activation card VPN...

  [25/04/2013 08:16:15] Setting up VPN - configuration system...

  [25/04/2013 08:16:16] Establish a VPN...

  [25/04/2013 08:16:16] Connected to my.vpn.com.

  [25/04/2013 08:16:16] Connected to my.vpn.com.

  [25/04/2013 08:17:19] Reconnection to my.vpn.com...

  [25/04/2013 08:17:19] Setting up VPN - examining the system...

  [25/04/2013 08:17:24] Setting up VPN - activation card VPN...

  [25/04/2013 08:17:25] Setting up VPN - configuration system...

  [25/04/2013 08:17:25] Establish a VPN...

  [25/04/2013 08:17:25] Connected to my.vpn.com.

  [25/04/2013 08:17:25] Reconnection to my.vpn.com...

  [25/04/2013 08:17:25] Setting up VPN - examining the system...

  [25/04/2013 08:17:25] Setting up VPN - activation card VPN...

  [25/04/2013 08:17:25] Setting up VPN - configuration system...

  [25/04/2013 08:17:25] Establish a VPN...

  [25/04/2013 08:17:25] Connected to my.vpn.com.

  the newspaper is not enough

  Get more journal of asa

  Sent by Cisco Support technique iPad App

• Wierd NAT with AnyConnect client behavior

  Hello

  I have a problem with our customers AnyConnect not being able to access a particular resource that exists on a 3rd party VPN.

  Both the AnyConnect customers & 3rd Party Site to Site VPN terminate on the external Interface of the ASA.

  There is a NAT configuration between the 3rd party and our ASA network so that we share the 192.168.40.0/24 subnet. 25 first is for 3rd party guests & the second 25 is for our guests.

  We are trying to access a service on 192.168.40.10

  The NAT rule that I have in place to achieve this goal is

  Source = sub-VPN-network Dest = 192.168.40.0/25 = any Service

  XLate Source = 192.168.40.129 (PAT) Dest = XLateService Original XLate = Original

  With the NAT rule like this, the Web page only FACT NOT work. We get a Timeout of SYN, and looking at the logs, the AnyConnect client source address does not PAT would have to 192.168.40.129

  BUT...

  If I change the NAT rule for this...

  Source = sub-VPN-network Dest = 192.168.40.0/25 = any Service

  XLate Source = 192.168.40.129 (PAT) XLate Dest = 192.168.40.10 XLateService = Original

  THIS WORKS! The source address does get PAT'd from 192.168.40.129.

  BUT... the problem is now, that if the AnyConnect client attempts to access any other IP in 192.168.40.0/25, the destination address gets changed all the time at 192.168.40.10.

  I am new to ASA 8.3, so I was wondering if I'm missing something with how NAT rules changes since earlier versions of ASA...

  Can anyone help?

  Thank you

  Mario Rosa

  Hello

  The only reason to see a NAT rule that is configured at the top for not having applied are

  • The "permit same-security-traffic intra-interface" is NOT configured, but in this case, it's since we have already taken the exit "packet-tracer"
  • There is of course the possibility that networks of NAT rules match any traffic entering the ASA
  • Naturally, there is the change of a bug that there were several.

  If there is no clear reason for the rules does not match NAT do not, then I suggest opening a case of TAC or upgrade / downgrade to another level of software to determine if an error is the cause.

  I don't know if you mentioned the software level that you use?

  -Jouni

• Using VPN to push the update of the AnyConnect client

  Hello - we would use our ASA VPN device to push the latest AnyConnect to our user base. Previously, due to the requirement that the user has administrator rights to install, we could not do this and had to return to SCCM to push upgrades the AnyConnect client. We now have software that will allow the client to load as an administrator, even if the user is not an administrator on the system. Viewfinity is the name of the software.

  My question is on the speed control. I don't want to set up the VPN to push the new AnyConnect, and every user who logs in then gets the installation. We would rather control, based on the group if possible, which gets the new client. This limits the risk if there is a problem to a subset of VPN users and not all that connect and you're trying to download. I can't find a config or config guide which indicates that it is possible. What is there, no one knows if it is or isn't an option? If this isn't the case, we would have to assume a lot of risk for new customers of 1100 deployment in a day, a number of type we plugged on any given business day. Please notify.

  Thank you very much for your help.

  The f

  Hi Jeff,

  There is no option to enable the auto update by connecton profile.

  What you can do however, is to disable this feature on the XML profile, since the XML profile can be defined by group policy, you simply deploy the profile either by having users connect to the specific group tunnel where group policy with the No auto update profile XML or deploy the XML profile manually on each machine.

  Please see this:

  Automatic update	true	(Default) Automatically install new packages.
  	fake	Doesn't install new pacakges.

  http://www.Cisco.com/en/us/docs/security/vpn_client/AnyConnect/anyconnect30/Administration/Guide/ac13vpnxmlref.html#wp1220030

  In the profile XML (to disable):

  fake

  Where to find the profile?

  OPERATING SYSTEM	The directory path
  Windows 7 and Vista	C:\ProgramData\Cisco\Cisco AnyConnect secure mobility Client\Profile\
  Windows XP	C:\Document and Settings\All Users\Application Data\Cisco\Cisco AnyConnect secure mobility Client\Profile
  MAC OS X and Linux	/ opt/cisco/anyconnect/profile /.

  http://www.Cisco.com/en/us/docs/security/vpn_client/AnyConnect/anyconnect30/Administration/Guide/ac02asaconfig.html#wp1409000

  Let me know.

  Thank you.

  Portu.

  Please note all messages that you find useful.

  Post edited by: Javier Portuguez