topic Any Connect VPN in Network Security

Any Connect VPN

Learnercisco — Sun, 04 Oct 2020 08:02:55 GMT

Hi Tech guys,

in my Internet edge deployment, My FTD (21110) is behind the ASR1000 Router(Internet Gateway). I want to allow any connect vpn clients to establish vpn connection to FTD via NAT Configured on ASR1000. From the Firewall perspective, Is there any Special configuration on firepower e.g related to NAT/PAT to access the Local LAN subnets from Internet? Any connection VPN configurations will be done FTD.

Thanks in advance

Re: Any Connect VPN

balaji.bandi — Sun, 04 Oct 2020 08:06:47 GMT

Steps :

1. You need NAT on ASR 1000 Public to PrivateIP ( allocated on FTD)

2. follow below guide to RAVPN

https://www.cisco.com/c/en/us/support/docs/network-management/remote-access/212424-anyconnect-remote-access-vpn-configurati.html

3. You need to have ACP/ ACL should be in place what resouce required access for the VPN subnet.

Hope make sense ?

Re: Any Connect VPN

Learnercisco — Sun, 04 Oct 2020 08:33:06 GMT

thanks balaje for your reply,

1. You need NAT on ASR 1000 Public to PrivateIP ( allocated on FTD)

The NAT ACL on ASR1K will include the FTD Outside IP address which makes sense.

2. follow below guide to RAVPN

I have FMC ,The concept will be the same.

3. You need to have ACP/ ACL should be in place what resouce required access for the VPN subnet.

Yes Correct. Access to Service VLAN in DMZ.

SSL Certificate

we can generate Self signed certificated and map this certificate to our domain (e.g vpn.cisco.com) on the FTD, as its shown in the guide.

Thanks in advance.

Re: Any Connect VPN

balaji.bandi — Sun, 04 Oct 2020 12:40:08 GMT

SSL Certificate

we can generate Self signed certificated and map this certificate to our domain (e.g vpn.cisco.com) on the FTD, as its shown in the guide.

BB - if this is external i would advise CA authority to sign. ( like Godaddy or DigiCert)