Hi there I have many users who complain that AnyConnect does not behave well in conditions of poor internet connectivity i.e public areas or travelling on a train etc.   In addition to this, my User base is looking for a more streamlined VPN experience where the User rarely interacts with the VPN client and it more or less works in the background.   As such I have been looking at using the native VPN client on macOS, my VPN is the following IKEv2 Cert Based AnyConnect XML Profile Instructs AnyConnect which Client Certificate to choose (which sits in user keychain)  When setting up the native VPN I have the following queries  What value goes in local ID and Remote ID? Choosing the VPN concentrator hostname for remote ID and the client certificate common name for local ID does not work. The ASA does not recognise the authentication method.  Am I missing something here and surely others have set up an IKEv2 native VPN on a macOS which uses cert based auth. Kind Regards ... View more

Hi there I have implemented a Wifi Network where I am hosting my RADIUS server externally  and I have some concerns are regarding the communication between our WLC and the external RADIUS server. 1 - I am finding that the RADIUS server certificate always appears and the user is required to explicitly trust the server certificate, even when properly signed by a public CA. How can I ensure that the connecting device always trusts the RADIUS server certificate? Does the CN of the cert need to match the SSID name and thus does the SSID name need to be a public DNS domain? 2 - I know EAP-PEAP uses TLS to create an encrypted tunnel to protect user passwords, however I can see via packet tracing that that tunnel is from CLIENT --> AP and not from AP to RADIUS server. The traffic from WLC to RADIUS are 4 UDP packets which are the Access Request packets. I can see the TLS tunnel being setup when capturing packets from user device however from our firewall edge I only see the RADIUS Access-Request and Challenge packets from WLC and RADIUS. These packets are UDP and not encrypted, they hold the WLC internal IP and host name along with the username in cleartext. How is the actual password transmitted to the RADIUS server at this stage? i.e under which RADIUS attribute is the password held and how is the hash calculated? ... View more

Hi there I have setup a local CA on my cisco 5512-X running 9.2(3)4 however when I publish the crl on my inside interface on port 80, all my requests are timing out.  I am using the same inside interface as the management interface and also use it to enrol users via the web interface on port 443... When I try to browse to the crl location at http://192.168.2.1/+CSCOCA+/asa_ca.crl I get SYN timeouts..  I have tried to telnet on port 80 and still get timeouts.. when running show asp table sockets I can see that the ASA is listening on port 80 on the inside interface.  To mention I am accessing the interface via a VPN connection, however I do not see how this can matter... any help or pointers would be much appreciated Kind Regards       ... View more

Hi Guys I am trying to setup an xml profile for cisco anyconnect that will look at multiple certificates that could be issued from 2 different CA's..... Currently having trouble setting this up and it does not look like it is possible.. Is there a way around this?   Regards   Mohamed ... View more

Hi Guys Looking to deploy a new AP to vWLC controller, want to make sure I dont effect any users.. will adding a new AP to existing AP group cause all the AP's in group to reboot or only the new AP being added. Kind Regards     ... View more

Hi there I have a AnyConnect VPN that terminates to an ASA on port Gi0/1..  On the same ASA I have a Site to Site VPN from port Gi0/1 (same port) to another firewall.   Can I route AnyConnect VPN traffic via the Site to Site vpn?   Regards   Mohamed  ... View more