My understanding is that when using the SDI protocol for RSA integration, you cannot pass group/class info. However, if you reach the RSA server using RADIUS, then the RSA server can be configured to return a RADIUS Class attribute of the format "OU=group-policy-name;" which is then used to match a group-policy name in the ASA config. I've done it this way ...
AnyConnect and the old IPSec client are totally different beasts. AnyConnect provides a VPN over SSL/TLS and the other client uses IPSec.
The AnyConnect client does not leverage the same mechanism or any of the existing PCF files. So there should not have been any overwriting or deleting of config.
One of the advantages of the AnyConnect client is that it ...
I was able to figure this out within ACS. The missing piece was that I needed to create an identity store sequence. This allows me to authenticate to one place (RSA) and do an additional attribute lookup in another place (AD).
Thanks for the help though. You guys made me think of it differently which ultimately solved it!
More information on this topic can ...
Choose Configuration > Remote Access VPN > AAA/Local Users > Local Users.
Select the user you want to configure and click Edit.
In the left-hand pane, click VPN Policy.
Specify the number of simultaneous logins by the user as 0 (zero).
From the CLI:
username mydisableduser attributes
I've never seen a way to do that natively (in the ASAs themselves) but, if your AnyConnect setup uses RADIUS for authenticating users, you could assign group policies based on a condition statement that looks for CallingStationID (the IP address they're coming from) and matches the users that way.
From ASA 8.x Dynamic Access Policies (DAP) Deployment Guide :
Note: The dap.xml file, which contains the DAP policies selection attributes, is stored in the ASA's flash. Although you can export the dap.xml file off-box, edit it (if you know about xml syntax), and re-import it back, be very careful, because you can cause ASDM to stop processing DAP records ...
Regarding question 1 on mobile device licensing
Per your comment below, I did a couple tests on our ASA5525-X which has Essentials/Mobile licenses. I was indeed able to limit access using Dynamic Access Policies. I setup a test policy allowing only iOS devices on iPad2,7 models to connect in a new policy. Then I setup the default policy to terminate ...
1) To allow traffic from the Anyconnect client (which is on the outside) to go to the Internet (also outside) you need to enable:
same-security-traffic permit intra-interface
This is also known as Hairpinning since the traffic makes a U-turn at the firewall.
cfr. Permitting Intra-Interface Traffic (Hairpinning)
2) To allow the ping to the inside ...
The client just connects to an IP address so the ASA doesn't know which name the client resolved to get that IP address, and hence it cannot do any redirection.
The only 2 options I see are:
create a new profile (containing the new name) and distribute this to your users somehow out-of-band (e.g. email it to them or email them a URL where to download it)
If both sides indicate that there is a security association established, then it's like the encryption is working and there is some other problem.
One thing to check out is what is the default gateway for the machines that are on the LAN and do they have a way to route packets to 192.168.1.0/24.
One way to find that (when you can't find documentation to point you in the right direction) is to add one via ASDM, and then go to the CLI so you can issue a show run to find where your changes show up. If they aren't visible in the output, it may be one of the few things you have to do via ASDM (unfortunately, there are a few of those) because there is no ...
Flow is a loopback log message indicates that the traffic is entering and exiting on the same ASA interface. And by default, ASA does not allow this traffic.
To fix this issue, you need two things:
Explicitly permit this traffic on ASA with the command same-security-traffic permit intra-interface
And a dynamic NAT rule for Anyconnect Clients (let us say ...
Please be informed that while accessing web based SSL VPN, the NAT and PAT are restricted in CISCO ASA. Also, the traffic flow must be specified using bi-directional ACLs, by allowing return connections from a lower security host to a higher security host even if there is already an established connection from the higher level host to the lower level host (...
So, if I understand correctly you can't access the inside interface of your ASA via SSH when connected via VPN? Have you tried issuing the following command on the ASA:
If your VPN tunnel terminates on one interface, but you want to manage the ASA by accessing a different interface, you need to identify that interface as a ...
If your network is based on Microsoft Active Directory, you can configure the system to only allow computers that are joined to the domain to access the corporate network. Since the employee won't have the domain administrator credentials necessary to join his/her personal laptop to the domain, this will prohibit the personal machine from connecting to the ...
Please find below configuration for both cases from AnyConnect over IKEv2 to ASA with AAA and Certificate Authentication:
Configuration on the ASA
This section describes the ASA configurations that are required before
the connection occurs.
Note: The Cisco Adaptive Security Device Manager (ASDM) allows you to create the basic configuration ...
You can define an ACL and apply the ACL under the group policy using the split tunnel value command. You can then apply the group policy to the tunnel group.
It's explained in the documentation here:
Below will tunnel traffic ...
This is just a guess, but wouldn't a non-proprietary solution (perhaps the mobile version of something like OpenVPN) be a possible solution?
While some mobile phone OSes (Palm OS, etc.) do not support OpenVPN,
it is available for Maemo, Windows Mobile 6.5 and below, iOS
3GS+ devices, jailbroken iOS 3.1.2+ devices, Android 4.0+