How to configure Client Based Remote Access SSL VPN using AnyConnect Client

[kingnation]

Hello Everyone,

I need an help to setup a vpn connection for all the client in office to access the internal network when they are outside from office. Can anyone assist me on how to setup the vpn? i tried to search in web and i cant understand the configuration. Thank you

[Julio E. Moisa]

Hi

First you must have a VPN license (essential could be depending of the model) and anyconnect package to be upload to the firewall:

The configuration could be:

webvpn
enable OUTSIDE
anyconnect-essentials
anyconnect image disk0:/anyconnect-win-xxxx.pkg 
anyconnect enable
tunnel-group-list enable

ip local pool MY-POOL <network> mask <subnet mask>

object-group network MY-DESTINATION
network-object x.x.x.x y.y.y.y

access-list INSIDE-IN extended permit ip object-group MY-DESTINATION <MY POOL Network or object-group>

access-list SPLIT-TUNNEL standard permit <DESTINATION>

group-policy POLICY internal
group-policy POLICY attributes
vpn-tunnel-protocol ssl-client
split-tunnel-policy tunnelspecified
split-tunnel-network-list value SPLIT-TUNNEL

tunnel-group TUNNEL type remote-access
tunnel-group TUNNEL general-attributes
address-pool MY-POOL
default-group-policy POLICY
tunnel-group TUNNEL webvpn-attributes
group-alias <NAME OF YOUR VPN> enable

username <username> password <password>
username <username> attributes
vpn-group-policy POLICY
group-lock value TUNNEL
service-type remote-access

[kingnation]

Ok sir. But could u tell me where can i get the VPN License and Anyconnect package to upload in cisco ASA?

[Julio E. Moisa]

Hi

The license and the any connect must be requested to an authorized Cisco Partner. 

You can execute the command: show activation-key to see the available features. 

[kingnation]

This are the output for the command sir

IT-TEAM-ASA# sh activation-key
Serial Number:
Running Permanent Activation Key:

Licensed features for this platform:
Maximum Physical Interfaces : Unlimited perpetual
Maximum VLANs : 50 perpetual
Inside Hosts : Unlimited perpetual
Failover : Disabled perpetual
Encryption-DES : Enabled perpetual
Encryption-3DES-AES : Enabled perpetual
Security Contexts : 0 perpetual
GTP/GPRS : Disabled perpetual
AnyConnect Premium Peers : 2 perpetual
AnyConnect Essentials : Disabled perpetual
Other VPN Peers : 250 perpetual
Total VPN Peers : 250 perpetual
Shared License : Disabled perpetual
AnyConnect for Mobile : Disabled perpetual
AnyConnect for Cisco VPN Phone : Disabled perpetual
Advanced Endpoint Assessment : Disabled perpetual
UC Phone Proxy Sessions : 2 perpetual
Total UC Proxy Sessions : 2 perpetual
Botnet Traffic Filter : Disabled perpetual
Intercompany Media Engine : Disabled perpetual
IPS Module : Disabled perpetual
Cluster : Disabled perpetual

This platform has a Base license.

Sorry i had to remove the serial number and Activation key sir. So for the vpn license, should i use the activation key ? i had download the anyconnect vpn client from outside links. Is it usable? Is it the same as wat u mentioned earlier?

[Julio E. Moisa]

Hi, 

You need an essential license: 

AnyConnect Essentials : Disabled perpetual

There are license providing 750 concurrent VPN users. 

The anyconnect software can be download from the official Cisco website but you need a valid contract / credencials to download. The best way is be in contact with a Cisco Partner to provide the best solutions. 

[kingnation]

so i should buy the license to enable the vpn?

If yes, then is there any other way to do vpn connection to use it from home pc?

Thank you

[Julio E. Moisa]

Hi

Yes, you need to buy VPN license. Unfortunately there isn´t other way.