Category Archives: Network

ASA, Cisco, Computer, Routing, Security, VPN

How to authentication AnyConnect VPN against RADIUS

Leave a comment

AnyConnect and Cisco ACS Radius is a bit more complected because the ASA5500 documentation states that you can not use the Same Radius for
Authentication and Authorization. So things getting more complex by it self 😉 But if i see things in the right light we don’t need authorization at all so we will on monday how things will develope.

How to authentication AnyConnect VPN against RADIUS

The Authentication against RADIUS is quiet easy to configure.

Just add the RADIUS Servers as described here.
Than add following to the configuration:

[sourcecode gutter=”false” autolinks=”false”]
tunnel-group SSLClientProfile general-attributes
authentication-server-group AAA-RADIUS
[/sourcecode]
By debuging the radius authentication is see our freeradius deliver the av-pairs with the authentication request so lets see if the ASA accepts them.
If you feel this helps a bit or may be not ? Please leave a comment.

Flickr : , , , , ,

ASA, Cisco, Computer, Security

How to use RADIUS for Authentication

Leave a comment

How to use RADIUS on Cisco ASA for Shell and Web Authentication

Assume the RADIUS Servers are:

Cisco ACS Server 1 10.120.10.11
Cisco ACS Server 2 10.120.10.12

[sourcecode gutter=”false” autolinks=”false”]
aaa-server AAA-RADIUS protocol radius
!
aaa-server AAA-RADIUS (Management) host 10.120.10.11
key YYYYXXXYYY
!
aaa-server AAA-RADIUS (Management) host 10.120.10.12
key YYYYXXXYYY
!
! Delete the old local only configuration
no aaa authentication http console LOCAL
no aaa authentication ssh console LOCAL
!
aaa authentication http console AAA-RADIUS LOCAL
aaa authentication ssh console AAA-RADIUS LOCAL
aaa authentication enable console AAA-RADIUS LOCAL
aaa authorization command AAA-RADIUS LOCAL
!
[/sourcecode]

If you have allready configured aaa for the ssh you might see something like

[sourcecode autolinks=”false” gutter=”false” highlight=”2″]
asa1(config)# aaa authentication ssh console AAA-RADIUS LOCAL
Range already exists.
[/sourcecode]

Then you must first disable the aaa authentication and than add the new settings.

[sourcecode autolinks=”false” gutter=”false”]
no aaa authentication ssh console LOCAL
aaa authentication ssh console AAA-RADIUS LOCAL
[/sourcecode]

If you feel this helps a bit or may be not ? Please leave a comment.

ASA, Cisco, Computer, Network, Routing, Security, VPN

How to use Radius/Tacacs+ and Certificate based Authentication for AnyConnect VPN

Leave a comment

First you have to add a valid Certificate to the ASA, then change following in the configuration.

[sourcecode]
tunnel-group SSLClientProfile general-attributes
authentication-server-group AAA-TACACS+
!
tunnel-group SSLClientProfile webvpn-attributes
authentication aaa certificate
[/sourcecode]
Then you can connect to the asa only with username and a user certificate.

Flickr : , , , , ,

ASA, Cisco, Computer, Network, Routing, Security, VPN

How to authenticate AnyConnect VPN against Tacacs+

Leave a comment

How to authentication AnyConnect VPN against Tacacs+

The Authentication against Tacacs+ is quiet easy to configure.

Just add the Tacacs+ Servers as described here.
Than add following to the configuration:

[sourcecode]
tunnel-group SSLClientProfile general-attributes
authentication-server-group AAA-TACACS+
[/sourcecode]

If you feel this helps a bit or may be not ? Please leave a comment.

ASA, Cisco, Computer, VPN

Cisco ASA5500 Setup

Leave a comment

Cisco ASA5500 Setup

In my test enviroment i have a ASA5510 with a Basic Configuration. You can use this as a starting point for configuring the ASA5500 Series Firewalls.

The ASA5510 is connected behind the Outside ASA5500 Firewall, this ASA will do the Packet filtering,
because i am a friend of KISS (“keep it simple and straightforward”), things get complicated by it self.
For the same reasons i like diving after the DIR (“Do it right”) Method.

In this post we will begin with a basic Setup of the ASA firewall. In the next posts i will describe other topics based on this setup.

Continue reading Cisco ASA5500 Setup →

ASA, Cisco, Computer, Routing, Security, VPN

How to configure Cisco ASA 5500 for AnyConnect Client

Leave a comment

So i was testing some stuff with the Authentication on the ASA Firewall and the AnyConnect client in the last days. So i feel it is time to write things down a little bit.

First i discovered we have the same problem with Windows 7 Firewall. Windows is not detecting the Interface so the Firewall do not say here we are part of the domain:-( Sad very Sad. But as i described here, there is a workaround but this is not supported by Cisco in any way.
But anyhow, we have to move to the AnyConnect Client to get VPN running with WWAN Cards.

So lets begin with a basic setup, only localusers and connect to the ASA with the AnyConnect Client.
No complex things, just connectivity. So we will start here with the configuration.
In the next posts we will go to the more complex things.

Continue reading How to configure Cisco ASA 5500 for AnyConnect Client →

ASA, Cisco, Computer, Security, VPN

Cisco VPN Clients are not recognized by Windows 7 Firewall

Leave a comment

As i former described we have problems with the Cisco IPSec VPN Client and WWAN Cards. So we are testing the AnyConnect Client. We are now faceing some common problems with both clients.

We discovered that the Network adapter created by the Cisco IPSec VPN Client (Version 5.0.07.0290) and also the Cisco AnyConnect SSL VPN Client (Version 2.5.0217) not recognized by the Windows 7 Advanced Firewall. And therefore the AD Grouppolicy for the Firewall is not applied.

As a Workaround you can drop following lines from the “vpnva.inf” file from the AnyConnect Package:
[sourcecode]
;Vista specific entry — benign on 2K/XP
HKR, , *NdisDeviceType, 0x00010001, 1
[/sourcecode]
or delete the Key for the adapter from the registry.

If you feel this helps a bit or may be not ? Please leave a comment.
Flickr : , , , ,

Cisco, Computer, Network, Routing, xDSL

DownStream Power Back Off (DPBO) and our Cisco gear

Leave a comment

I love my Job 😉

We discovered a new Feature on the DSL Lines. It is called DownStream Power Back Off, this feature was introduced in November 2007 and is currently only supported on German Telekom lines. Where as the ADSL2+ specifcation is from 2004. The Ciscos have implementet the specifcation from 2004 and today no router supports the 2007 specs. So if you are useing Cisco Hardware have a look here to see if your router supporting it.

If you feel this helps a bit or may be not ? Please leave a comment.

Flickr : , , ,

ASA, Cisco, Computer, VPN

Cisco IPSec VPN and WWAN Cards are not working so we move to Cisco AnyConnect

1 Comment

Lately we discovered that Windows 7, Cisco IPsec VPNs and buildin UMTS Cards, also called WWAN Cards, do not work togehter. So we are now going the next step to the Cisco AnyConnect on the ASA Platform.

Here the snipplet from the release notes:

Support for Windows 7 on x64 (64-bit). This release, however, does not support WWAN devices (also called wireless data cards) on Windows 7 x86 (32-bit) and x64.

Reference : Release Notes for Cisco VPN Client, Release 5.0.0

For the ASA based AnyConnect you will find the nessesay Tools and Software here:

Cisco ASA Series Firewalls and VPN Gateways
Cisco AnyConnect Client
Cisco AnyConnect Client Profile Editor

A Basic Installation will follow.

If you feel this helps a bit or may be not ? Please leave a comment.

Flickr : , , , ,