Anyconnect Cisco Router 2921

[Raimund Schimanovits]

Hello

I want to configure Cisco Anyconnect on a Router but it doesn`t work. When i open the connection i got the message "Connection attemp has failed.

I have installed from this document.

https://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/200533-AnyConnect-Configure-Basic-SSLVPN-for-I.html#anc2

aaa new-model

aaa authentication login SSLVPN_AAA local

crypto pki trustpoint SSLVPN_CERT
enrollment selfsigned
subject-name CN=ComOne-SSLVPN.XXXXXXXXXXXXX
revocation-check crl
rsakeypair SSLVPN_KEYPAIR

crypto pki certificate chain SSLVPN_CERT
certificate self-signed 02
30820360 30820248 A0030201 02020102 300D0609 2A864886 F70D0101 05050030
49312130 1F060355 04031318 436F6D4F 6E652D53 534C5650 4E2E636F 6D2D6F6E
652E6174 31243022 06092A86 4886F70D 01090216 15436F6D 4F6E652D 48554231
2E617363 6F6D2E6E 6574301E 170D3137 30383331 30383235 31355A17 0D323030
31303130 30303030 305A3049 3121301F 06035504 03131843 6F6D4F6E 652D5353
4C56504E 2E636F6D 2D6F6E65 2E617431 24302206 092A8648 86F70D01 09021615
436F6D4F 6E652D48 5542312E 6173636F 6D2E6E65 74308201 22300D06 092A8648
86F70D01 01010500 0382010F 00308201 0A028201 01009FB5 9B1035CA C99108A5
215499C5 CE2B5DE8 67B2DD72 4BEE5605 AD81C258 2EE19A68 4C9FC08C 4D4F23A1
BB7C377B AE853679 66E689FC 15FF6D95 D689EB37 89714C13 3BAFD7FD 2EFD5ADD
4FE6751A C5D7A879 1910D389 0E92F92B E34FE95D F16F125D CA5C1F98 2452D856
56AD8ACD 014A36FF 42C58282 4AB61E05 39328CB8 9CFD7A60 E8B6AAAC 79A737D4
55AAF089 2D556916 195926AC E1F78BE2 956DC750 BCE9D14B F5D6DC9B 927F7D97
F74D7F94 DD7F7E54 F55293FC 713E2187 BD4B0A65 DB1FCB7A 24F04E0A 63CFF734
1B395501 9C0347F2 71B70AE0 96AA148C E2A3661C F5C79D4D 028A9536 E4997FD5
F559514F 8FED6FFC EDFD3A5B 85A4A160XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

username admin privilege 15 secret 5 XXXXXXXXXXXXXXXXXXXX

crypto vpn anyconnect flash0:/webvpn/anyconnect-win-3.1.14018-k9.pkg sequence 1

crypto vpn anyconnect profile SSL_Profile flash:Anyconnect_eshelter.xml

ip http server
ip http authentication aaa
ip http secure-server

interface Loopback0
ip address 172.16.1.1 255.255.255.255

ip local pool SSLVPN_POOL 192.168.200.1 192.168.200.10

access-list 1 permit 192.168.200.0 0.0.0.255

webvpn gateway SSLVPN_GATEWAY
ip address 188.21.X.XXX port 443
http-redirect port 80
ssl trustpoint SSLVPN_CERT
inservice
!
webvpn context SSL_Context
virtual-template 1
aaa authentication list SSLVPN_AAA
gateway SSLVPN_GATEWAY
!
ssl authenticate verify all
inservice
!
policy group SSL_Policy
functions svc-enabled
svc address-pool "SSLVPN_POOL" netmask 255.255.255.0
svc split include acl 1
default-group-policy SSL_Policy
!

Does anyone have a working config anyconnect on a IOS ?

Best Regards

[Seb Rupik]

Hi Raimund,

What do the logs of the Anyconnect client tell you? they should be more verbose than the error message you are seeing.

I recently had some fun&games with a similar setup, it turned out to be related to the SSL certificate being presented to the Anyconnect client. In particular the client was connecting to an IP and not a FQDN and as such expected the SSL cert to have the IP represented as a CN in the cert.

What is the output of  sh crypto pki certificates

cheers,

Seb.

[Raimund Schimanovits]

Hello

I have no IP Address in the cert. So there are only self-Signed. I will connect to an IP because i have no offi. cert.

04.09.2017
08:09:31 Ready to connect.
09:05:35 Ready to connect.
09:25:20 Ready to connect.
09:31:14 Contacting 188.21.X.XXXX
09:31:23 Connection attempt has failed.

Router Self-Signed Certificate
Status: Available
Certificate Serial Number (hex): 02
Certificate Usage: General Purpose
Issuer:
hostname=ComOne-HUB1.ascom.net
cn=ComOne-SSLVPN.com-one.at
Subject:
Name: ComOne-HUB1.ascom.net
hostname=ComOne-HUB1.ascom.net
cn=ComOne-SSLVPN.com-one.at
Validity Date:
start date: 10:25:15 CEST Aug 31 2017
end date: 01:00:00 CET Jan 1 2020
Associated Trustpoints: SSLVPN_CERT
Storage: nvram:ComOne-HUB1a#2.cer