Yes, if this is an internal CA that you control, you can add multiple SAN fields to your certificate and add it to the ASA. The ASA cannot generate a CSR with multiple SAN, but you can definitely import a pkcs12 cert for the ASA (issued by CA directly and includes cert+key) that has the 2 FQDN's that you have on the outside.     You can use openssl or other tools (I use a tool called xca) to generate CSR's outside of the ASA. Once you receive the cert, you can use the same tool to combine the cert and key together and export it out as a pkcs12/pfx file. This can then be imported on the ASA.  ... View more

You can add an ACL on the inside interface to block these servers going out. You just have to create an object/objectgroup that includes the ip range needed.   access-list inside-out extended deny ip <object-group of servers> any access-list inside-out extended permit ip any any   access-group inside-out in inside   If you already have an ACL, then just add statement#1 to that one.  The above is under the assumption that your internal routing is handled by your core switch.  ... View more

Can you share the NAT and ACL config that you added for this server?   Also, why add specific ports to NAT if you want to allow ICMP? ... View more

DHCPD/RA: Relay msg received, fip=ANY, fport=0 on inside_1 interface DHCP: Received a BOOTREQUEST from interface 3 (size = 300) DHCPRA: relay binding found for client 7058.1226.d22f. DHCPRA: setting giaddr to 192.168.1.1. dhcpd_forward_request: request from 7058.1226.d22f forwarded to 10.5.200.1.   We don't see a response back from the server. You mentioned that the server received this request. The server has to respond back to 192.168.1.1 since the giaddr is set to the inside ip address as expected. Can you check on the server to see if the route to 192.168.1.1 points back to the ASA?   Reference this document to understand how this works: https://www.cisco.com/c/en/us/support/docs/security/adaptive-security-appliance-asa-software/116265-configure-product-00.html#anc6   ... View more

You can use an internal certificate with the SAN of your outside interface FQDN. But you have to remember that your internal CA generated certificate is not inherently trusted by your external users. In short, if your ASA/FTD certificate fulfills the following 4 requirements, users should not see an error:   1) Date&Time is between issued and expired date on cert. 2) Issued by CA who is trusted by client. You would need to import the internal CA certificate in the trusted root/intermediate CA store to achieve this.  3) FQDN of the VPN url matches the SAN or subject name CN field. 4) Certificate has the right key usage/extended Key usage - EKU should have Server authentication for the ASA/FTD certificate. ... View more

The configuration is to create a reference to the actual Anyconnect profile location. This reference can then be called under the group-policy so that you can download different profile for different group-policies. ASDM is the best way to create profiles since it automatically saves the created profile in flash.  You can also use the standalone Anyconnect profile editor application to create it outside of the ASA. You would then have to upload the profile and assign to the group-policy manually.  ... View more

Run debugs on the ASA to see what happens:   debug dhcprelay packet debug dhcprelay event   Also, apply captures on the ASA to capture traffic between ASA outside interface and DHCP server   capture capo interface outside match ip host <ASA-outside-intf> host <dhcp-server> show capture capo ... View more

@Marvin Rhoads is correct. If your users are non-admins, you don't have to do anything extra. They wont be able to install new software but updates should work just fine. IF they have admin rights, you can shutdown the portal page so that they cannot download the image from the ASA.    ciscoasa(config)# webvpn ciscoasa(config-webvpn)# keepout “The Portal is not available” ciscoasa(config-webvpn)#   You can then push the Anyconnect clients through your desktop software and have them connect directly to the url from the client. They should still be able to update the client with the portal shutdown.  ... View more

I think the most important feedback is this: Additional Certificates (if supplied)   Certificates provided 1 (1507 bytes) Chain issues Incomplete   Do you have the output of "show crypto ca certificate" and "show run ssl" that you can share? ... View more

2 Peers would work because you have only 1 crypto map entry, hence the traffic can only match that crypto map entry. When you have 2 crypto map entries, it matches crypto entries one by one. So it will always match sequence 1. As mentioned before, if you want to build 2 separate tunnels, keep the crypto ACL's unique so that it not conflict with each other.    Since you are using GRE tunnels, you can have 2 different tunnel interfaces where the tunnel source and destination combination is unique. For example:   int Tunnel1 tunnel source <ISP interface> tunnel destination 10.10.10.253   int Tunnel 2 tunnel source <ISP interface> tunnel destination 10.10.10.254   access-list Sky_ACL1 permit gre <isp interface> 10.10.10.253 access-list Sky_ACL2  permit gre  <isp interface> 10.10.10.254   crypto map MAP_A 10 ipsec-isakmp  set peer 10.10.10.253 set transform-set Sky_TS  match address Sky_ACL1  ! crypto map MAP_B 15 ipsec-isakmp  set peer 10.10.10.254 set transform-set Sky_TS  match address Sky_ACL2   You can then send routing protocol through Tunnel 1 and 2 with the right metrics  to prefer Tunnel1 to Primary site. ... View more

If the users are not receiving an error when they access the ASA via the FQDN, then you are probably ok. There is a still a possibility of the scan tool not having the intermediate cert in their trusted cert section (while your users may have this). The best practice is to have all the CA certificates imported on the ASA so that it sends the full chain to the client/scan tool. The client then only needs to have the root certificate in its certificate store to validate the chain. Also, the scan tool should access the ASA via FQDN in order for you to validate this correctly. You can run a free check against the Qualys SSL checker to see if your external cert infrastructure is correct:   https://www.ssllabs.com/ssltest/   ... View more