First you have to add a valid Certificate to the ASA, then change following in the configuration.
[sourcecode]
tunnel-group SSLClientProfile general-attributes
authentication-server-group AAA-TACACS+
!
tunnel-group SSLClientProfile webvpn-attributes
authentication aaa certificate
[/sourcecode]
Then you can connect to the asa only with username and a user certificate.
The Authentication against Tacacs+ is quiet easy to configure.
Just add the Tacacs+ Servers as described here.
Than add following to the configuration:
[sourcecode]
tunnel-group SSLClientProfile general-attributes
authentication-server-group AAA-TACACS+
[/sourcecode]
If you feel this helps a bit or may be not ? Please leave a comment.
In my test enviroment i have a ASA5510 with a Basic Configuration. You can use this as a starting point for configuring the ASA5500 Series Firewalls.
The ASA5510 is connected behind the Outside ASA5500 Firewall, this ASA will do the Packet filtering,
because i am a friend of KISS (“keep it simple and straightforward”), things get complicated by it self.
For the same reasons i like diving after the DIR (“Do it right”) Method.
In this post we will begin with a basic Setup of the ASA firewall. In the next posts i will describe other topics based on this setup.
So i was testing some stuff with the Authentication on the ASA Firewall and the AnyConnect client in the last days. So i feel it is time to write things down a little bit.
First i discovered we have the same problem with Windows 7 Firewall. Windows is not detecting the Interface so the Firewall do not say here we are part of the domain:-( Sad very Sad. But as i described here, there is a workaround but this is not supported by Cisco in any way.
But anyhow, we have to move to the AnyConnect Client to get VPN running with WWAN Cards.
So lets begin with a basic setup, only localusers and connect to the ASA with the AnyConnect Client.
No complex things, just connectivity. So we will start here with the configuration.
In the next posts we will go to the more complex things.
Continue reading How to configure Cisco ASA 5500 for AnyConnect Client
As i former described we have problems with the Cisco IPSec VPN Client and WWAN Cards. So we are testing the AnyConnect Client. We are now faceing some common problems with both clients.
We discovered that the Network adapter created by the Cisco IPSec VPN Client (Version 5.0.07.0290) and also the Cisco AnyConnect SSL VPN Client (Version 2.5.0217) not recognized by the Windows 7 Advanced Firewall. And therefore the AD Grouppolicy for the Firewall is not applied.
As a Workaround you can drop following lines from the “vpnva.inf” file from the AnyConnect Package:
[sourcecode]
;Vista specific entry — benign on 2K/XP
HKR, , *NdisDeviceType, 0x00010001, 1
[/sourcecode]
or delete the Key for the adapter from the registry.
If you feel this helps a bit or may be not ? Please leave a comment.
Hm wasn das ???
Versuch mich an einem Windows XP Rechner anzumelden und werde dann direkt wieder abgemeldet. *grübel* Naja dann ist es doch besser wenn die Gäste abhauen. Mag mein Linux wieder haben.
Also erstmal XP CD ins Laufwerk und schauen was da Sache ist. XP auf der zweiten Platte installiert und dann ein Paar ungebetene Gäste von der anderen XP installation entfernt.
Die Regestry von der ersten Installation in Regedit geladen und kontolliert ob die Werte für Userinit und Shell noch stimmen.
Das eigentliche Problem war dann das userinit.exe nicht mehr dort war wo es sein sollte, also den Schlingel dann kurz an seinen Platz gebracht und siehe da die Anmeldung funktioniert wieder.
I love my Job 😉
We discovered a new Feature on the DSL Lines. It is called DownStream Power Back Off, this feature was introduced in November 2007 and is currently only supported on German Telekom lines. Where as the ADSL2+ specifcation is from 2004. The Ciscos have implementet the specifcation from 2004 and today no router supports the 2007 specs. So if you are useing Cisco Hardware have a look here to see if your router supporting it.
If you feel this helps a bit or may be not ? Please leave a comment.
Lately we discovered that Windows 7, Cisco IPsec VPNs and buildin UMTS Cards, also called WWAN Cards, do not work togehter. So we are now going the next step to the Cisco AnyConnect on the ASA Platform.
Here the snipplet from the release notes:
Support for Windows 7 on x64 (64-bit). This release, however, does not support WWAN devices (also called wireless data cards) on Windows 7 x86 (32-bit) and x64.
Reference : Release Notes for Cisco VPN Client, Release 5.0.0
For the ASA based AnyConnect you will find the nessesay Tools and Software here:
Cisco ASA Series Firewalls and VPN Gateways
Cisco AnyConnect Client
Cisco AnyConnect Client Profile Editor
A Basic Installation will follow.
If you feel this helps a bit or may be not ? Please leave a comment.
FCIP (Fibre Channel over IP) is a power full technologie for linking Fiber Channel based storage networks over IP network. We use this to link our mainframe with a second tape library in a different location, aprox 40 km.
Just for the record. They are old, they are good, but they are end of life and we don’t use them any more.
