1

So I downloaded Cisco Anyconnect to my Nexus 5x phone. Attempted to connect to my SSLVPN and it fails. I get the below information from debugging. This is the first time I've ever tried to set up an SSLVPN and would love to learn more, I have purchased a book however it doesn't cover setting SSL VPNs up on a router so I may need to purchase another or read more white pages. I'm unsure what the debugging information is telling me or if the issue is related to attempting to connect from my phone. I will attempt to install and test from a laptop later. The router is a CISCO1921/K9. Any information would be great, I have great interest in VPN technologies and would love to learn more.

Router#debug webvpn
WebVPN debugging is on
Router#show log
Oct 12 20:18:01.509: WV: sslvpn process rcvd context queue event
Oct 12 20:18:01.509: WV: sslvpn process rcvd context queue event
Oct 12 20:18:01.521: WV: sslvpn process rcvd context queue event
Oct 12 20:18:01.521: WV: Entering APPL with Context: 0x328661D0, 
      Data buffer(buffer: 0x2C6F83F8, data: 0xE94D758, len: 0, 
      offset: 0, domain: 0)
Oct 12 20:18:01.521: WV: Fragmented App data - buffered
Oct 12 20:18:01.521: WV: Entering APPL with Context: 0x328661D0, 
      Data buffer(buffer: 0x2C6F8418, data: 0xF773E58, len: 1099, 
      offset: 0, domain: 0)
Oct 12 20:18:01.521: WV: http request: / with no cookie
Oct 12 20:18:01.521: WV: validated_tp :  cert_username :  matched_ctx : 
Oct 12 20:18:01.521: WV: failed to get sslvpn appinfo from opssl

Oct 12 20:18:01.521: WV: Error: Failed to get vw_ctx
Oct 12 20:18:01.521: WV: Appl. processing Failed : 2

*********************************************************************************
Router#show run | s webvpn
webvpn gateway GatewayName
 hostname GatewayName
 ip address x.x.x.x port 443  
 http-redirect port 80
 ssl encryption aes128-sha1 aes256-sha1
 ssl trustpoint TP-self-signed-3721036327
 inservice
 !
webvpn context GatewayName
 title "Secure Access: Unauthorized users prohibited"
 !
 acl "webvpn-acl"
   permit ip 10.x.x.x 255.255.255.224 10.x.x.x 255.255.255.224
 login-message "Please enter your login credentials"
 aaa authentication domain domain.com
 gateway GatewayName domain domain.com
 max-users 3
 !
 ssl authenticate verify all
 !
 url-list "MyPages"
   heading "MyPages"
   url-text "companyweb" url-value "http://companyweb.local"
 inservice
 !
 policy group PolicyGroupName
   functions svc-enabled
   banner "Login Successful"
   timeout idle 600
   filter tunnel webvpn-acl
   svc address-pool "SSLVPN" netmask 255.255.255.224
   svc keep-client-installed
   svc rekey method new-tunnel
   svc split include 10.x.x.x 255.255.255.224
   url-list "MyPages"
   hide-url-bar
 default-group-policy PolicyGroupName
Router#show run | i pool
ip local pool SSLVPN 10.x.x.x 10.x.x.x
2
  • What is the full IOS version and feature set? – hertitu Oct 13 '16 at 6:04
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 9 '17 at 15:09
2

I haven't done this since Anyconnect 2.x and IOS 12.4T so things may have changed, but one of the things I remember is that you need to upload an Anyconnect package (pkg file) to the router. Not sure how it works for Android, since there is no pkg for that platform - it may be sufficient to install e.g. the Windows or Linux version.

See also "AnyConnect: Configure Basic SSLVPN for IOS Router Headend With the Use of CLI" which shows that you may also be missing a VTI interface (cfr. steps 2 & 7 (and step 9 to link the VTI to the Context).

Step 1. Confirm License is Enabled

Step 2. Upload and Install AnyConnect Secure Mobility Client Package on Router

Step 3. Enable the http Server on the Router

Step 4. Generate RSA Keypair and Self-Signed Certificate

Step 5. Configure Local VPN User Accounts

Step 6. Define Address Pool and Split Tunnel Access List to be Used by Clients

Step 7. Configure the Virtual-Template Interface (VTI)

Step 8. Configure WebVPN Gateway

Step 9. Configure WebVPN Context and Group Policy

Step 10 (Optional). Configure a Client Profile

1
  • Working on purchasing a license now (FL-SSLVPN10-K9=). – Skiltvakt Oct 14 '16 at 17:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.