4
votes
Accepted
How can I disable temporarily Cisco AnyConnect user from ASDM?
From ASDM:
Choose Configuration > Remote Access VPN > AAA/Local Users > Local Users.
Select the user you want to configure and click Edit.
In the left-hand pane, click VPN Policy.
Specify the number ...
- 2,628
4
votes
Accepted
Cisco anyconnect 4.6 client disable some security feature
Uninstall the AnyConnect packages and reinstall it, but uncheck the options for everything except Core in the setup wizard.
- 4,670
3
votes
Can I set the AnyConnect group policy from users source IP?
I've never seen a way to do that natively (in the ASAs themselves) but, if your AnyConnect setup uses RADIUS for authenticating users, you could assign group policies based on a condition statement ...
- 4,670
3
votes
Accepted
Configuring Cisco ASA DAP policies from CLI! (Automating bulk task)
From ASA 8.x Dynamic Access Policies (DAP) Deployment Guide :
Note: The dap.xml file, which contains the DAP policies selection attributes, is stored in the ASA's flash. Although you can export the ...
- 2,628
3
votes
Accepted
Ping LAN via Anyconnect VPN
1) To allow traffic from the Anyconnect client (which is on the outside) to go to the Internet (also outside) you need to enable:
same-security-traffic permit intra-interface
This is also known as ...
- 2,628
2
votes
Accepted
Cisco ASA, redirect Anyconnect SSL VPN to new address/url
The client just connects to an IP address so the ASA doesn't know which name the client resolved to get that IP address, and hence it cannot do any redirection.
The only 2 options I see are:
create ...
- 2,628
2
votes
Accepted
ASA anyconnect VPN not able to access remote LAN (inside) network
Solution
Nevermind i figured it out, it was nat rule missing (inside,outside)
nat (inside,outside) source static any any destination static NET-VPN-POOL NET-VPN-POOL no-proxy-arp route-lookup
- 4,301
2
votes
Accepted
ASA 5510 AnyConnect SSL VPN to Windows 3.1 client - connected but no traffic routed
If both sides indicate that there is a security association established, then it's like the encryption is working and there is some other problem.
One thing to check out is what is the default ...
- 1,125
1
vote
Configuring Cisco ASA DAP policies from CLI! (Automating bulk task)
One way to find that (when you can't find documentation to point you in the right direction) is to add one via ASDM, and then go to the CLI so you can issue a show run to find where your changes show ...
- 4,670
1
vote
Accepted
Cisco AnyConnect clients connects to Internet via L3 device on inside zone of ASA (default gateway is on the remote network)
Flow is a loopback log message indicates that the traffic is entering and exiting on the same ASA interface. And by default, ASA does not allow this traffic.
To fix this issue, you need two things:
...
- 3,754
1
vote
The VPN connection failed due to unsuccessful domain name resolution
Seems that configuration of SSL VPN is not completed or incorrect (according to provided part of config). Try to read this guide and do a walk thru steps in it.
- 2,764
1
vote
Accepted
Anyconnect doesn't tunnel internet
You can define an ACL and apply the ACL under the group policy using the split tunnel value command. You can then apply the group policy to the tunnel group.
It's explained in the documentation here:...
- 391
1
vote
Cisco ASA: Why does static NAT block access through VPN?
Please be informed that while accessing web based SSL VPN, the NAT and PAT are restricted in CISCO ASA. Also, the traffic flow must be specified using bi-directional ACLs, by allowing return ...
- 90
1
vote
Cisco ASA: Why does static NAT block access through VPN?
So, if I understand correctly you can't access the inside interface of your ASA via SSH when connected via VPN? Have you tried issuing the following command on the ASA:
management-access inside
If ...
- 11
1
vote
IKEv2 client authentication in tunnel RA vpn
Ideally you want to setup directory like Radius to authenticate against.
Please see guide hope that help: guide
Although you can have a local users as per this guide: guide
- 1,565
1
vote
Remote access vpn to connect company provided laptop only
If your network is based on Microsoft Active Directory, you can configure the system to only allow computers that are joined to the domain to access the corporate network. Since the employee won't ...
1
vote
Accepted
Anyconnect example configuration
Please find below configuration for both cases from AnyConnect over IKEv2 to ASA with AAA and Certificate Authentication:
Configuration on the ASA
This section describes the ASA ...
- 1,713
Only top scored, non community-wiki answers of a minimum length are eligible