topic Re: ASA 5520 to ASA FP 2130 in Network Security

ASA 5520 to ASA FP 2130

latenaite2011 — Tue, 12 Mar 2019 14:01:06 GMT

Hi Everyone,

SecurityI am just curious if there is anything special that I need to do to migrate the Anyconnect using certificate besides exporting and re-importing the certificate? I am getting a certificate validation error when trying to connect. This is part of a cluster and the primary is working now but when I connect individually and directly to the both ASA using their IP, I get the same error so it make me thing that something is bound to the main configuration - which is the profile? I imported all xml file too.

Thank you in advance,

Re: ASA 5520 to ASA FP 2130

Marvin Rhoads — Fri, 05 Oct 2018 07:36:41 GMT

Are you talking about the server certificate on the headend (old ASA > new ASA)? If so, you need the private key as well as the certificate for the new ASA device to be able to use it.

If you don't have the private key, you would need to reissue a certificate for the new ASA based on a CSR you generate on it (or a CSR you generate externally using openssl or such where you have access to the private key).

Re: ASA 5520 to ASA FP 2130

latenaite2011 — Fri, 05 Oct 2018 11:27:43 GMT

Thank you for the response.

Yes, I imported the private also. Still get Certification Validation error.

Re: ASA 5520 to ASA FP 2130

Marvin Rhoads — Fri, 05 Oct 2018 12:22:57 GMT

Check that the certificate bound to your interface matches the one you intend to use.

"show run ssl" will show you the first bit.

"show crypto ca certificates" will tell you the certificate details for the bound trustpoint.

Re: ASA 5520 to ASA FP 2130

latenaite2011 — Sat, 06 Oct 2018 00:26:43 GMT

Hi Marvin,

Yes I did that.

thank you!

Re: ASA 5520 to ASA FP 2130

Marvin Rhoads — Sat, 06 Oct 2018 05:46:43 GMT

Can you share a screenshot of the error you are getting and the output of the commands I mentioned earlier?

Re: ASA 5520 to ASA FP 2130

latenaite2011 — Tue, 09 Oct 2018 05:47:43 GMT

Hi Marvin,

Sorry for the delay as I had to get the command as requested. Attached is
the error and also the output from the show run ssl:

fw# show run ssl
ssl server-version tlsv1-only
ssl encryption aes256-sha1 aes128-sha1 dhe-aes128-sha1 dhe-aes256-sha1
ssl trust-point XX external_interface
ssl trust-point XXX inside

Thank you!

Re: ASA 5520 to ASA FP 2130

Marvin Rhoads — Tue, 09 Oct 2018 05:56:57 GMT

Please check - the screenshot wasn't attached.

Re: ASA 5520 to ASA FP 2130

latenaite2011 — Tue, 09 Oct 2018 06:04:23 GMT

Re: ASA 5520 to ASA FP 2130

latenaite2011 — Tue, 09 Oct 2018 06:04:43 GMT

Sorry here it is again Marvin.

Re: ASA 5520 to ASA FP 2130

Marvin Rhoads — Tue, 09 Oct 2018 09:25:59 GMT

That sort of error normally points to a client-side certificate issue. What is the authentication method for your VPN?

If you access the ASA VPN portal using your browser (vs. using Anyconnect directly), does the portal open up ok with the expected ASA-side certificate being presented?

Re: ASA 5520 to ASA FP 2130

latenaite2011 — Tue, 09 Oct 2018 15:25:57 GMT

Hi Marin, Yes, it is and I selected the correct certification and I
received this error:

"an error occurred during the opening of the Enterprise Trust Store"

I tried to import manually to my Personal folder and that took it.

thank you!