As you’ll see, you can initiate a client-based SSL VPN session from a broad range of devices and operating systems that support the install of AnyConnect Client (desktops, laptops, mobile devices), as shown in Figure 3-1.
)
Figure 3-1 AnyConnect SSL VPN
Deploying a Basic Cisco AnyConnect Full-Tunnel SSL VPN Solution
Basic Cisco AnyConnect full-tunnel SSL VPN uses user authentication by username and password, provides IP address assignment to the client, and uses a basic access control policy. The client also authenticates the ASA with identity certificate-based authentication. Deployment tasks for this scenario are as follows:
- Configure the basic ASA SSL VPN gateway features.
- Configure local user authentication.
- Configure IPv4/IPv6 address assignment.
- Configure basic access control.
- Install the Cisco AnyConnect Secure Mobility Client.
Initially, AnyConnect was an SSL-only VPN client. Starting with Version 3.0, AnyConnect became a modular client with additional features (including IPsec IKEv2 VPN terminations on Cisco ASA), but it requires a minimum of ASA 8.4(1) and ASDM 6.4(1).
Configuring Basic Cisco ASA SSL VPN Gateway Features
To initially prepare the ASA for SSL VPN termination, complete the following steps:
- STEP 1. Provision the ASA with an identity certificate. Your options are as follows:
- Use a self-signed certificate.
- Enroll ASA in Public Key Infrastructure (PKI) with Simple Certificate Enrollment Protocol (SCEP).
- Enroll ASA in PKI with manual cut-and-paste method enrollment.
To install a self-signed certificate using the ASDM, navigate to Configuration > Remote Access VPN > Certificate Management > Identity Certificates and click Add. Give the PKI trustpoint a name, choose Add a New Identity Certificate, check Generate Self-Signed Certificate, and then click Add Certificate. To configure a self-signed certificate via the command-line interface (CLI), use the following commands:
ciscoasa(config)# crypto key generate rsa label SELF-SIGNED modulus 2048 ciscoasa(config)# crypto ca trustpoint TEST-CA ciscoasa(config-ca-trustpoint)# id-usage ssl-ipsec ciscoasa(config-ca-trustpoint)# subject-name CN=cisco.com ciscoasa(config-ca-trustpoint)# enrollment self ciscoasa(config-ca-trustpoint)# keypair SELF-SIGNED ciscoasa(config)# crypto ca enroll TEST-CA noconfirm
To enroll with SCEP by using the ASDM, navigate to same section as for self-signed certificates. Give the PKI trustpoint a name, choose Add a New Identity Certificate (do not check Generate Self-Signed Certificate), and click the Advanced button for enrollment options. From here, you have two options:
- For SCEP enrollment, navigate to Enrollment Mode and choose the Request from a CA method and complete the URL (which is in the form http://IP_ADDRESS/certserv/mscep/mscep.dll). Navigate to SCEP Challenge Password and provide the challenge in case the certificate authority (CA) requires it.
- For manual enrollment, navigate to Enrollment Mode and choose Request by Manual Enrollment. This requires an additional step: After the certificate is issued, it needs to be imported onto the ASA from a file. For this, select the created trustpoint and click Install. In the new window, choose Install from a File and provide the full path to the base64-encoded certificate.
To configure SCEP enrollment via the CLI, use the following commands:
ciscoasa(config)# crypto key generate rsa label SELF-SIGNED modulus 2048 ciscoasa(config)# crypto ca trustpoint TEST-CA ciscoasa(config-ca-trustpoint)# id-usage ssl-ipsec ciscoasa(config-ca-trustpoint)# subject-name CN=cisco.com ciscoasa(config-ca-trustpoint)# enrollment url http://10.10.10.10/certsrv/mscep/mscep.dll ciscoasa(config-ca-trustpoint)# keypair SELF-SIGNED ciscoasa(config)# crypto ca authenticate TEST-CA nointeractive ciscoasa(config)# crypto ca enroll TEST-CA
- STEP 2. Load the AnyConnect image onto the ASA.
- There are different AnyConnect web deployment packages (PKG files) for different client operating systems. Choose the one you need, download it from , and load it into ASA flash memory. To make the transfer using the ASDM, navigate to Tools > File Management.
- STEP 3. Enable SSL VPN termination on desired interfaces.
- To enable SSL using the ASDM, navigate to Configuration > Remote Access VPN > Network (Client) Access > AnyConnect Connection Profiles and check the Enable Cisco AnyConnect VPN Client Access on the Interfaces Selected in the Table Below check box. In the pop-up window, select the AnyConnect image. Choose Allow Access and, optionally, Enable DTLS for desired interfaces.
To enable SSL via the CLI, use the following commands:
ciscoasa(config)# webvpn ciscoasa(config-webvpn)# enable outside ciscoasa(config-webvpn)# anyconnect enable ciscoasa(config-webvpn)# anyconnect image disk0:/ anyconnect-win-3.0.1047-k9.pkg 1
- STEP 4. Configure and optionally tune SSL Transport Layer Security (TLS) settings. Here, you can tune SSL VPN by allowing only certain SSL/TLS versions and algorithms and by specifying the identity certificate used (if many exist). To configure it using the ASDM, navigate to Configuration > Remote Access VPN > Advanced > SSL Settings (see Figure 3-2).
Figure 3-2 SSL VPN Tuning
To configure it via the CLI, use the following commands:
ciscoasa(config)#ssl trust-point TEST-CA outside ciscoasa(config)# webvpn ciscoasa(config-webvpn)#ssl server-version tlsv1 ciscoasa(config-webvpn)#ssl encryption aes128-sha1 aes256-sha1 3des-sha1 des-sha1
)