topic AnyConnect SSL VPN in VPN

AnyConnect SSL VPN

fatalXerror — Sat, 22 Feb 2020 05:28:24 GMT

Hi guys,

My VPN is using cert based authentication but we just found out that even non-corporate devices can still connect to the VPN by not checking the "Block Untrusted Servers" in the AnyConnect settings. Is it possible to block those non-corporate devices to connect to the VPN by using certificate alone?

Is it possible to block those 3rd party certificate right away?

Thanks

Re: AnyConnect SSL VPN

Marvin Rhoads — Sat, 29 Sep 2018 07:14:27 GMT

I think you are mixing up the certificate on the server (which is what the check box you mentioned covers) vs. a certificate on the clients.

Certificate-based client authentication requires the actual certificate and private key to be present on the client. While it's possible (in most cases) to copy the client certificate to another device it's much more involved than unchecking a checkbox.

Confirm your authentication type via the command:

show run tunnel-group

The output should include a subcommand indicating the type of authentication being used.

Re: AnyConnect SSL VPN

balaji.bandi — Sat, 29 Sep 2018 07:21:48 GMT

Yes, this is possible, But depends on how you configured, check the below configuration to help you.

https://community.cisco.com/t5/security-blogs/anyconnect-certificate-based-authentication/ba-p/3105546

How is the certificate installed to devices, is this pre-defined certificate as part of build ?