topic Re: Anyconnect certificate based authentication error 1838 in Network Security

Anyconnect certificate based authentication error 1838

Chewbakka1 — Fri, 21 Feb 2020 16:44:37 GMT

Hi,

In an attempt to setup Anyconnect to authenticate users by certificates instead of the more common username/password based

authentication, i have created my own CA and issued:

Both the Asa and the Client certificate are signed by, and correctly verifies against the root certificate.

In the identity cert for the Asa i have set the CN= to its outside ip address, as it does not have a fqdn set.

The client certificate also has it's CN= corresponding to its public ip

When attempting to connect to the vpn-gateway(Asa) from the client pc, the debug output looks like this:

I have also tried setting 'revocation-check none' under the trustpoint, without any result.

Any idea what i am missing?

Rob Ingram — Sun, 03 Feb 2019 12:13:43 GMT

Hi,

What is your ASA configuration in regard to the trustpoint and remote access VPN? Do you have the following configured?

ssl trust-point LAB_PKI OUTSIDE

crypto ikev2 remote-access trustpoint LAB_PKI

This reference describes how to use certificate authentication with AnyConnect RAVPN.

HTH

Marius Gunnerud — Sun, 03 Feb 2019 19:23:29 GMT

try re-importing your CA certificate.

Chewbakka1 — Sun, 03 Feb 2019 21:59:35 GMT

My suspicion here is that Anyconnect barfs on the cn= being an ip address....

Let me know if this really is the case.