Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Diego Lopez
Stats
Member since
09-17-2015
114
Posts
119
Helpful
24
Solutions
01-12-2017
10:53 AM
You can configure an XML profile "client profile"and enter the URLs that you want to see in the drop down menu of the anyconnect client in the "Server List" of the ASDM editor option you can follow this link to configure the client profile from the ASA:
http://www.cisco.com/c/en/us/td/docs/security/vpn_client/anyconnect/anyconnect30/administration/guide/anyconnectadmin30/ac02asaconfig.html#18358
... View more
03-23-2016
03:19 PM
Hello,
Creating a group policy for each user group will be a good option you can also use DAP to assign a web ACL to the user that is connecting to the clientless portal, you can use Cisco, LDAP or Radius attributes to associate the DAP to the user. For example if you are using LDAP you can create 2 separate groups there for employees and contractors and based on the LDAP group membership of the user they will be assigned with the specific web acl that you configured based on their access restrictions.
You can follow this link to configure a web acl:
http://www.cisco.com/c/en/us/td/docs/security/asa/asa83/asdm63/configuration_guide/config/acl_webtype.html#wp1100532
Once the ACL is ready you can follow this guide to setup the DAP: "check figure10 for web acls"
http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/108000-dap-deploy-guide.html#intro
Thanks, please rate!.
... View more
03-23-2016
01:50 PM
Hello,
Disabling the Anyconnect essentials from the global webvpn setting did the trick here.
CLI:
webvpn
no anyconnect-essentials
Thanks,
... View more
02-29-2016
08:01 PM
Hello,
On ASA1 you can set a
capture capin interface inside 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0
send traffic then do a show capture capin
make sure that you see packets back and forward
also run a packet tracer:
packet tracer input inside icmp 192.168.1.5 8 0 192.168.2.5 de
check the VPN phase if is allow then the VPN tunnel is fine
please make sure you ping an internal host dont ping the interface itself if you do so please enable management access to the interfaces with the command:
management-access inside
So that the interface can replay to the pings
If this still dont resolve the issue you will probably need to reload ASA1 there could be a duplicate spi stuck that is not letting the traffic be encrypted
Regards, please rate!
... View more
02-23-2016
08:28 PM
Is the same behavior as having just one peer the default is bidirectional
... View more
02-22-2016
12:54 PM
It will establish the tunnel it will match the crypto map and bring the tunnel up even if is listed as secondary.
... View more
02-22-2016
06:38 AM
Hello,
The tunnel will be established with the first ip that you have configured if the tunnel is successfully established is going to leave the second ip as the backup is not going to try to establish a tunnel with that ip until the primary tunnel goes down. It's important to configure keep alives so you can monitor the remote peer an identify when is down if the remote peer stop replaying the keep alives the ASA will turn down the tunnel and try to bring it back up with the secondary ip. If you receive a request from the secondary ip the ASA will accept it and form the tunnel but that's only when the primary is not active, you shouldn't get a request from the secondary if the primary is up.
Regards, please rate!
... View more
02-21-2016
07:40 PM
Hello,
This is not going to impact your other tunnels at all!!!
This NAT-T functionality will allow the ASA to detect devices behind a NAT and will use UDP port 4500 instead of UDP 500.
The current peers that are not behind a nat device will just work as usual with UDP port 500.
If you would like to know more about how NAT-T works you can check this documentation:
https://supportforums.cisco.com/document/64281/how-does-nat-t-work-ipsec
Regards, please rate!
... View more
02-18-2016
07:56 AM
Hello,
You can configure a static policy nat to translate 192.168.0.0/24 to 192.168.88.0/24 when the destination is Group1Servers, the CLI command will be:
Create objects for 192.168.0.0/24 and 192.168.88.0/24
object network obj-192.168.0.0 subnet 192.168.0.0 255.255.255.0
object network obj-192.168.88.0 subnet 192.168.88.0 255.255.255.0
NAT statement:
nat (inside,outside) source static obj- 192.168.0.0 obj- 192.168.88.0 destination static Group1Servers Group1Servers
You can refer to this documentation for NAT configuration:
https://supportforums.cisco.com/document/33921/asa-pre-83-83-nat-configuration-examples
Since this traffic is going over a site to site tunnel remember that the interesting traffic needs to be configured with the translated network "1 92.168.88.0/24 " not the real, that's a common mistake just take that in mind
Regards, please rate.
... View more
02-18-2016
07:47 AM
Hello,
You can refer to this documentations:
http://www.cisco.com/c/en/us/products/collateral/security/anyconnect-secure-mobility-client/qa_c67-712937.html
Q. Why does the Cisco AnyConnect Secure Mobility Client support IKEv2 and not IKEv1?
A. IKEv2 offers greater security and mobility capabilities when compared to the older IKEv1. Unlike IKEv1, IKEv2 is capable of supporting AnyConnect features such as HostScan and secure mobility. However, HostScan and client policy and software updates will be performed over a SSL connection.
The CSD is already deprecated you dont need it anymore the hostscan image will contain all the supported features you just need hostscan. Make sure that the hostscan image is the same or newer than the anyconnect image that you are going to use.
Regards, please rate.
... View more
02-17-2016
05:39 AM
Hello,
You can create a local user with the command:
username cisco password cisco123 privilege 15
Then to assign local authentication to ASDM and SSH you enter the command in case sensitive:
aaa authentication http console LOCAL
aaa authentication ssh console LOCAL
Regards, please rate.
... View more
02-15-2016
04:09 PM
If the packet tracer from inside to outside is working then it should work backwards the packet tracer is not the best way to simulate traffic from outside to the inside when it's coming from a VPN tunnel. What I will suggest next if the SA is up with this traffic and you see the tunnel up take captures on the ASA to see if the traffic is really getting to the inside interface to isolate the issue.
capture capin interface inside match ip 172.22.6.0 255.255.255.0 172.22.16.0 255.255.255.0
send ping and then do a "show capture capin" if you see the request and not the replay is an internal routing issue if you don't see the traffic on the ASA there's a problem in the remote device that is not sending the traffic correctly
... View more
02-15-2016
02:10 PM
Hello,
Ok so we know the nat is not an issue this has something to do with the ACL most likely the one you applied to the outside interface
access-group ping in interface outside
access-group ping out interface outside
Can you remove it from the config:
no access-group ping out interface outside
no access-group ping in interface outside
and configure another ACL don't specify icmp type just do icmp any any:
access-list test extended permit icmp any any
apply it to the outside interface inbound direction:
access-group test in interface outside
try the packet tracer again.
... View more
02-15-2016
01:50 PM
Hello,
If the users are connecting to the tunnel-group IPSEC_RA_ADMIN they will still have access because the default group policy on that connection profile is RA_ADMIN_GP.
You need to set the NOACCESS group policy to the IPSEC_RA_ADMIN, the mapping will be effective for the members of VPN_Admin and the rest of the users will be getting the NOACCESS group policy
configure this and test it out:
tunnel-group IPSEC_RA_ADMIN general-attributes
default-group-policy NOACCESS
Regards, please rate.
... View more
01-12-2017
You can configure an XML profile "client profile"and enter the URLs that
you want to see in the drop...
03-23-2016
Hello, Creating a group policy for each user group will be a good option
you can also use DAP to ass...
03-23-2016
Hello, Disabling the Anyconnect essentials from the global webvpn
setting did the trick here. CLI: w...
02-29-2016
Hello, On ASA1 you can set a capture capin interface inside 192.168.2.0
255.255.255.0 192.168.1.0 25...
02-22-2016
It will establish the tunnel it will match the crypto map and bring the
tunnel up even if is listed ...
02-22-2016
Hello, The tunnel will be established with the first ip that you have
configured if the tunnel is su...
02-21-2016
Hello, This is not going to impact your other tunnels at all!!! This
NAT-T functionality will allow ...
02-18-2016
Hello, You can configure a static policy nat to translate 192.168.0.0/24
to 192.168.88.0/24 when the...
02-18-2016
Hello, You can refer to this documentations:
http://www.cisco.com/c/en/us/products/collateral/securi...
02-17-2016
Hello, You can create a local user with the command: username cisco
password cisco123 privilege 15 T...
02-15-2016
If the packet tracer from inside to outside is working then it should
work backwards the packet trac...
02-15-2016
Hello, Ok so we know the nat is not an issue this has something to do
with the ACL most likely the o...
Public Statistics
| Date Registered | 09-17-2015 01:22 PM |
| Date Last Visited | 04-03-2018 04:29 AM |
| Total Messages Posted | 114 |
| Total Helpful Votes Received | 119 |
Helpful Votes From
| User | Helpful Count |
|---|---|
| 5 | |
| 25 | |
| 4 | |
| 5 | |
| 5 |
