Community Ask Me Anything - Secure Remote Workers

[ciscomoderator]

You can ask your question on your own language:

Español

Português

Français

Русский

日本語

简体中文

Here’s your chance to discuss Cisco Secure Remote Working technologies such as AnyConnect, ASA, FTD, Duo, and Umbrella. In this session, the experts will answer questions about emergency licenses, design, configuration, and troubleshooting. Our experts span more than 12 time zones. Also, we’ll be translating the session into multiple languages to provide you with the best experience possible.

This forum event works well as an introduction for those who are not familiar with these security solutions and/or have recently started using them.

To participate in this event, please use the button below to ask your questions

Ask questions from Friday, March 20 to Friday, April 3, 2020

Featured experts

Divya Nair is a Technical Marketing Engineer with the Security Business Group in Raleigh, North Carolina. She has more than 10 years of experience in Cisco network security technologies, including firewalls, IPS, VPN, and AAA; and is currently focusing on VPN and firewall management platforms. Divya holds a Bachelor's degree in Computer Science and Engineering.

Jonny Noble leads the Technical Marketing team for Cloud Security at Cisco, with expertise in Cisco Umbrella and surrounding technologies. For more than 20 years, Jonny has obtained experience in customer-facing disciplines for global hi-tech organizations. He also has rich experience in presenting breakout sessions and proctoring labs at Cisco Live events along with representing Cisco at numerous customer and partner events, trade shows, and exhibitions. Jonny holds degrees in Electronics, Sociology, a Business MBA, and is CISSP certified.

Aditya Ganjoo is a Technical Marketing Engineer in Bangalore, India. He has been working with Cisco for the past seven years in Security domains such as Firewall, VPN and AAA. Aditya has delivered trainings on ASA and VPN technologies. He holds a Bachelor's degree in Information Technology. Additionally, he is a CCIE in Security (CCIE#58938). He has been a consistent contributor on Cisco Support Community and has delivered multiple sessions at Cisco Live.

Due to the anticipated volume for this high in-demand event, Divya, Aditya, Jonny might not be able to answer each question. Thus, remember that you can continue the conversation directly in the Security community.

By posting a question on this event you're giving permission to be translated in all languages we have in the community.

Find further events on https://community.cisco.com/t5/custom/page/page-id/Events?categoryId=technology-support

**Helpful votes Encourage Participation! **
Please be sure to rate the Answers to Questions

[elite2010]

Hi,

Any guidelines for troubleshooting DNS queries ,resolving local dns always giving pain when connected using anyconnet vpn 

Thanks

[Aditya Ganjoo]

Hello,

Are you facing issues with local DNS resolution through the VPN tunnel?

If yes, you can check the group-policy attributes for the specific value.

If you are looking for best practices, you can configure the following three options for DNS with Anyconnect:

1. Split DNS -  The DNS queries which match the domain names, are configured on the Cisco Adaptive Security Appliance (ASA). They move through the tunnel (to the DNS servers that are defined on the ASA, for example) while others do not.
   
   
2. Tunnel-all-DNS - Only DNS traffic to the DNS servers which are defined by the ASA is allowed. This setting is configured in the group policy.
   
   
3. Standard DNS - All of the DNS queries move through the DNS servers which are defined by the ASA. In the case of a negative response, the DNS queries might also go to the DNS servers which are configured on the physical adapter.

You can also check the following link for more clarity on DNS behavior with Anyconnect:

https://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/116016-technote-AnyConnect-00.html#anc1

Regards,

Aditya

Please rate helpful posts

[elite2010]

Hi,

Thanks for the reply 

"Split DNS -  The DNS queries which match the domain names, are configured on the Cisco Adaptive Security Appliance (ASA). They move through the tunnel (to the DNS servers that are defined on the ASA, for example) while others do not."

When you say " DNS servers that are defined on the ASA"  means the DNS server's configured on the ASA firewall or in the tunnel or group policy 

The DNS queries which match the domain names, you mean the domain name is configured on the firewall or in the group policy ? 

What if we have  split domain like test.local and test.com ?

 test.com (it's a forward zone in the same test.local dns server (eg:192.168.1.100)
test.com also resolves to  private ip addresses

this is my current configuration
dns domain-lookup Inside
dns server-group DefaultDNS
name-server 192.168.1.100
domain-name test.local

Thanks  

[Aditya Ganjoo]

Hello,

All the values would be under the group-policy. You can add multiple values/domains under the group-policy.

https://www.cisco.com/c/en/us/td/docs/security/asa/asa-command-reference/S/cmdref3/s16.html#pgfId-1597902

[BasavarajNingappa6558]

Hi,

Do we have any options in cisco anyconnect using FTD firewall for blocking non-windows joined machines and allow only domain computers to connect to anyconnect ?

Thanks

Basavaraj

[Divya Nair]

Hi Basavaraj,

You can use machine certificate authentication for AnyConnect users to ensure that only domain machines can join. Config guide - https://www.cisco.com/c/en/us/td/docs/security/firepower/650/configuration/guide/fpmc-config-guide-v65/firepower_threat_defense_remote_access_vpns.html#id_login_via_clientcert

[BasavarajNingappa6558]

Hi Divya,

Thanks for the response

Basically what I'm looking for are domain computers I'm already enforcing DLP and all they cant copy anything of the computers and all, for example, if my employees connect to a corporate network using their personal computers and how can I prevent them not to copy anything except working on the required applications and all, basically I don't them to copy any data from the network when they connect to the network.

how can I achieve this ? can I create one tunnel-group for domain-joined machines and another tunnel-group for non-domain joined machines and enforce the policy?
Thanks
Basavaraj

[Aditya Ganjoo]

Hi Basavaraj,

Yes, you would need to create different connection profiles and enforce the policies.

This can be done by different ways like by providing users group-URLs, through Radius attributes or by group-lock feature on ASA.

Regards,

Aditya

[BasavarajNingappa6558]

Hi Aditya,

Can you please provide an example configuration guide for me to follow and do it
Thanks
Basavaraj

[Aditya Ganjoo]

Here you go:

https://community.cisco.com/t5/security-documents/steps-to-configure-group-lock-for-vpn-users-on-microsoft-radius/ta-p/3151643

https://community.cisco.com/t5/security-documents/asa-ssl-vpn-tunnel-group-group-url-and-group-alias-selection/ta-p/3111990

[BasavarajNingappa6558]

Hi Aditya,

Those links are configuring different group tunnel-group and group alias, but I'm looking for is enforcing DLP kind of policies on each group policy so that they won't be able to copy any data over Anyconnect tunnel.

Basically they should not copy any data over the Anyconnect VPN tunnel how can I enforce this kind of policy on the Anyconnect VPN

[Divya Nair]

Hi,

If I understand, you are looking to enforce DLP for BYOD users. The best way to do this on the FTD would be to have the BYOD users connect to a separate connection profile/group-policy. I would give this connection a different address pool from the domain users. You can then use application filters on the FTD access policy to block file transfer protocols for the BYOD VPN pool. Keep in mind that FTD is not a true DLP application, but the application filter will help accomplish what you need to do - https://www.cisco.com/c/en/us/td/docs/security/firepower/650/configuration/guide/fpmc-config-guide-v65/rule_management_common_characteristics.html#id_16281

HTH

[Aditya Ganjoo]

In addition to what Divya said you can also do On-demand Scripts using Anyconnect:

https://www.cisco.com/c/en/us/td/docs/security/vpn_client/anyconnect/anyconnect40/administration/guide/b_AnyConnect_Administrator_Guide_4-0/customize-localize-anyconnect.html#ID-1408-00000396

Regards,

Aditya

[elite2010]

Hi,

Thanks for the reply . 

I have tried all split-dns ,standard ,tunnel all dns ... Still I cannot resolve (Dns server is reachable from the server ) . I am using anyconnect 4.8 and asa code 9.2 

Please advise