topic Re: Cisco ASA 555-X VPN SSL disconnection in Network Security

Cisco ASA 555-X VPN SSL disconnection

Amirouche — Fri, 21 Feb 2020 16:52:06 GMT

Hello geeks,

My team and me implement à new solution for IPSEC and VPN SSL over anyconnect v4.6.We use the ASA FW in the mono context mode to have the two features IPSEC and VPN SSL.

The problème is that when we use the VPN SSL the connection is good tu surfe in the intranet ..etc but when we use an RDP connexion to our servers in the DataCenter we have frenquently à disconnection every 3,5, 10 minutes.

Do you know where the problem is situated ?

PS: the protocole for the annyconnect profil : DTLS and before the ASA we have à checkpoint FW with open flow HTTPS /UDP 443. All other FW is good and logs too. We just have à reset session in the servers. When we use the old solution with another ASA we don't have this problem

Thank you for the help

Re: Cisco ASA 555-X VPN SSL disconnection

balaji.bandi — Tue, 26 Feb 2019 16:05:17 GMT

what code the ASA running ? have you captured the log and see what is the reason the user disconnecting ?

Re: Cisco ASA 555-X VPN SSL disconnection

Amirouche — Tue, 26 Feb 2019 19:35:04 GMT

The code ? the ASA is running juste and IPSEC and VPN SSL configuration in mono contexts. The users have dosconnections in RDP . In the log we have no thing juste the reset of the server. The server is a windows

Re: Cisco ASA 555-X VPN SSL disconnection

balaji.bandi — Tue, 26 Feb 2019 19:39:39 GMT

what is the ASA OS Code, you can find show version ?

Re: Cisco ASA 555-X VPN SSL disconnection

Amirouche — Wed, 27 Feb 2019 09:23:26 GMT

Hello,

The version of the asa code is 9.9.1.2, the pictue below

Thank you

Re: Cisco ASA 555-X VPN SSL disconnection

balaji.bandi — Wed, 27 Feb 2019 11:44:29 GMT

Options :

1. This required more of Wire-shark capture and see the reason both the sides.

2 Other hand Look at the some documents, DTLS to work. AnyConnect must also be upgraded to Release 4.7 for DTLS 1.2 support.

3.Try one Device using 4.7 and update.

Look at the FAQ :

https://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/116312-qanda-anyconnect-00.html

section : When does the ASA drop the SSL-Tunnel?