6

In a project to replace the last Cisco PIXes and VPN 3000 Concentrators we have [finally], I've already spec'd out the new ASA 5515-X and 5545-X's. I have no experience with the X models; only exp with the older ASAs. These are replacing enterprise firewalls for our employees, L2L tunnels (HQ/branch), and RA VPN. Every pair of PIXes (primary/failover) and pair of VPN 3000 (clustered) will move to a single pair of ASA-X's. I am considering the CX Application & Visibility Control and Web Security Essentials option to handle all desktop/laptops and BYOD devices.

Are the AnyConnect Essentials VPN and AnyConnect Mobile licenses all that are needed to be able to do ACLs that consider device type (from some basic posture assessment of the AnyConnect client) -- no ISE in environment -- along with CX to be able to do something like block iPADs/iPhones from *.facebook.com but allow Android devices?

Besides the filtering above, the BYOD devices with AnyConnect would need to do RA VPN over IPSec if a particular device type (determined by ASA) and group membership (determined by ACS) are allowed -- SSL VPN not needed.

And are there any client-side licenses as it seems not, since the costs of those AnyConnects ASA licenses are so dirt cheap that it almost doesn't make sense for Cisco to even charge for them -- $150 ea. MSRP for the 5515 -- and have no client-side license requirements?

And, yes, I'm familiar with the EOL dates for both -- VPN 3000 past and PIX in July.

3

Regarding question 1 on mobile device licensing

Per your comment below, I did a couple tests on our ASA5525-X which has Essentials/Mobile licenses. I was indeed able to limit access using Dynamic Access Policies. I setup a test policy allowing only iOS devices on iPad2,7 models to connect in a new policy. Then I setup the default policy to terminate sessions. This worked and allowed my Verizon iPad Mini to connect but not my iPhone. Here is the license breakdown:

Session Type: AnyConnect

Username     : <user>                 Index        : 40
Assigned IP  : 10.10.121.1            Public IP    : 70.194.2.165
Protocol     : AnyConnect-Parent SSL-Tunnel DTLS-Tunnel
License      : AnyConnect Essentials, AnyConnect for Mobile
Encryption   : AnyConnect-Parent: (1)none  SSL-Tunnel: (1)RC4  DTLS-Tunnel: (1)AES128
Hashing      : AnyConnect-Parent: (1)none  SSL-Tunnel: (1)SHA1  DTLS-Tunnel: (1)SHA1
Bytes Tx     : 3200                   Bytes Rx     : 940
Group Policy : anyconnect-split-policy
Tunnel Group : anyconnect-split-group
Login Time   : 11:46:24 EDT Fri Jun 7 2013
Duration     : 0h:01m:52s
Inactivity   : 0h:00m:00s
NAC Result   : Unknown
VLAN Mapping : N/A                    VLAN         : none

Note: When configuring these settings, if you don't have the "Apply" button highlight afterwards, you will need to do something in ASDM that will activate the button and allow you to click it. None of the DAP settings for AnyConnect specifics would apply automatically nor trigger the Apply button so I could apply the settings. I had to go modify another setting, click apply, modify the setting back, click apply. This was using ASDM 7.1 on a 9.1.2 ASA5525-X.

Regarding question 2 on the licensing:

There are no client-side licensing options that I am aware of. The only license not necessarily tied to the ASA directly is the AnyConnect Premium which may be pulled off of a "server" ASA with a pool of session licenses for multiple "client" ASAs. In the end, they're applied to an ASA still.

Source:http://www.cisco.com/en/US/docs/security/asa/asa91/license/license_management/license.html

  • 'ASAs running Release 8.2(5+) and 8.4(2) feature AnyConnect Identification Extensions (ACIDEx) for mobile device detection. ACIDEx lets you accept or restrict mobile connections without Cisco Secure Desktop, so you can use it to grant access to mobile users without activating an AnyConnect Premium license.' -- cisco.com/en/US/docs/security/vpn_client/anyconnect/… seems to indicate some mobile detection is possible with Essentials and Premium isn't required. Is that your interpretation? – generalnetworkerror Jun 7 '13 at 2:40
  • Yes, mobile detection does work with just Essentials and Mobile licenses. I was able to setup a DAP which said only iOS devices on platform iPad2,7 could connect. My iPhone was unable to connect but my Verizon iPad Mini was able to. I will edit my answer with output from the VPN stats showing the licenses used. – some_guy_long_gone Jun 7 '13 at 15:50
  • Your repro and license dump are invaluable! Thanks for editing the answer to make it shine. – generalnetworkerror Jun 7 '13 at 21:57
  • No problem, happy to help! – some_guy_long_gone Jun 7 '13 at 22:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.