Are you able to ping anything else on the LAN on the 192.168.1.0/24 subnet? I think that this maybe has something to do with the way you have set up Local Lan Access. The right way for LLA is to to have a split exclude ACL for a 0.0.0.0/32 network. This automatically adds to local LAN to split tunnel exclusion list. I think there may be a Windows Firewall rule that blocks traffic to 192.168.1.0/24 on the VPN adapter when local lan access is enabled.  ... View more

AFAIK, the user with most inactive time gets disconnected and new user connects successfully. Inactivity timer usually starts 5 minutes after no contact with client.  ... View more

Yes, that is the correct setting. Order should not matter since the split tunnel ACL is essentially a list of networks added into the client routing table.    Collect the routing table information from the client machine after a connection and see what it looks like.  ... View more

If it is a common server that everyone needs access to, you can add a specific ACE just for that that server. This will install a /32 route on the client machine to send it over the tunnel. This should take precedence over the /24 subnet route that the Local LAN access feature installs.  ... View more

The ASA does not support Secure Renegotiation AFAIK. Below is the enhancement bug raised to enable support for RFC5746, but this has not been fixed:   https://bst.cloudapps.cisco.com/bugsearch/bug/CSCud62637   I think you results on SSLlabs will always be capped at A- because of this.  ... View more

Are you trying to add it into the same trustpoint as the Root? This won't be possible as a trustpoint can only hold 1 CA cert (Root or intermediate) . Try adding this to another trustpoint if you have not done that already.   Also, which CA is this? Can you paste the steps that you took to install the intermediate cert? ... View more

1) AnyConnect, by default, does not restrict which device a user can connect from. If you want to restrict AnyConnect to only corporate machines, you can use the Hostscan/DAP/Posture functionality to only allow Domain machines to connect successfully. Example: https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/115947-dap-adv-functions-00.html#anc21   2) I think @Dennis Mink mentioned a few of them. Duo is now part of Cisco, and works well in my experience. Example guide are here: https://duo.com/docs/cisco   ... View more

Had the exact same setup for one of my customers using Firepwower running FTD's and 2 Comcast circuits. No WAN IP address for both circuits on the secondary Firewall. Failover was pretty seamless from what I saw. Since the standby maintains the same ip address and the failover process takes care of the initial traffic flow, there was no downtime noticed.   One effect that was seen was when both the circuits had the same cost/weight. On initial setup, the route would point to circuit-1. A failover scenario would cause the route to take the secondary circuit route to take over (established earlier that primary) in some cases. This really depended on which BGP session established first. I don't think this should affect our scenario since there is a weight set from the other end.  ... View more

ASA has a feature called cut-through-proxy which sounds a lot like what Checkpoint calls client authentication. Two good guides on how to set this up are given here:   https://community.cisco.com/t5/security-documents/asa-cut-through-authentication-proxy-configuration-and-examples/ta-p/3118641   https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/113363-asa-cut-through-config-00.html   ... View more

You are probably running into the limitation of managing the ASA via VPN through a BVI interface. This is still an open enhancement: https://bst.cloudapps.cisco.com/bugsearch/bug/CSCve82307   Issue stems from the fact that you cannot issue "http x.x.x.x x.x.x.x inside" when inside is a BVI interface.  ... View more