Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About gaigl
01-21-2019
Stats
Member since
10-10-2010
76
Posts
13
Helpful
0
Solutions
01-01-2019
11:47 PM
Hi Mohammed,
that didn't change something, the MTU Size was the default of 1406, I've changed to 1420 and the messages still appear.
I think I need to change the treshold, or not?
... View more
01-01-2019
10:57 PM
Hello,
I've updatet our ASA to 9.10.1 and the anyconnect-client to 4.7.00136, now I receive a lot of messages:
the connections are working and I don't see any drops, but it's annoying.
Does anyone know about this or what Vlue to set?
Received large packet 1406 (threshold 1390)
... View more
- Tags:
- anyconnect
Labels:
Created by
gaigl
in VPN and AnyConnect
in VPN and AnyConnect
12-11-2018
05:28 AM
12-11-2018
05:28 AM
@ 2.: your Certificate needs "extended Key Usage: Client Auth" and in the Profile Editor you can activate this check.
But again: to use a Cert for Anyconnect-Connection, the Cert needs Key-Usage: Client Auth
and to use "Start before Logon" the Cert should be in the machine store
maybe have a look to "advanced - > ssl-settings.
or: does your ASA trust the CA?
I know it is a bit difficult
... View more
Created by
gaigl
in VPN and AnyConnect
in VPN and AnyConnect
12-11-2018
03:19 AM
12-11-2018
03:19 AM
that's quit difficult, because we've got some other restrictions.
maybe some screenshots:
client-profile #1
client-profile #2
under tab "Server List" do not enter a group-url after the Servername
cert-map:
under AnyConnect Connection Profiles: (on the Bottom)
deactivate:
maybe this helps, I cannot make screenshots of every point with Anyconnect
... View more
Created by
gaigl
in VPN and AnyConnect
in VPN and AnyConnect
12-11-2018
02:39 AM
12-11-2018
02:39 AM
you can use the certificate ... map, I did it too.
But you have to remove group-url and such things, also you need a client-profile where you set user/machine certificate, automatic cert-selection and so on.
not very easy but it works.
(We've a 5525-x with 9.8.3
... View more
12-10-2018
11:36 PM
Hi,
in the release notes of AC 4.7 there is one new feature:
"
Management VPN Tunnel—(Requires ASDM 7.10.1) Ensures connectivity to the corporate network whenever the client system is powered up, not just when a VPN connection is established by the end user.
This feature allows patch management on systems which may not come in to the office frequently. Endpoint OS login scripts requiring corporate network connectivity will also benefit from this feature."
has anyone tried this and can tell me how to test it?
I can't see the menue to activate (I've got all the requirements)
thanks
karl
... View more
Labels:
09-17-2018
12:42 AM
deleting the Group-URL and Alias did the Job, now I cannot change the Connection Profile manually.
Decisions are only made by the Cert Map.
Thanks a lot
... View more
08-06-2018
04:13 AM
Hello,
at the moment we are using only one anyconnect connection profile, but soon we need a second one.
I want to build a "Certificate to AnyConnect and Clientless SSL VPN Connection Profile Map", where the connection profile should be selected by a machine Cert on the client. This can be achieved by a "Cert Map, no problem.
But how can i prevent a user on the client to manually change the connection-profile by appending the "wrong" group-url repectively alias?
One group has a cert with cn=client1.aaa.int, should only use connection-profile aaa, another group has a cert with cn=client1.bbb.int should only use connection-profile bbb
ASA has v 9.8.2, Anyconnect 4.6.01103
any idea's?
... View more
Labels:
Created by
gaigl
in VPN and AnyConnect
in VPN and AnyConnect
08-05-2018
11:46 PM
08-05-2018
11:46 PM
That was it, thank you very much
... View more
Created by
gaigl
in VPN and AnyConnect
in VPN and AnyConnect
07-31-2018
10:15 PM
07-31-2018
10:15 PM
Hello Paul,
- DNS resolves different adresses, the test- and prod ASA's are completely seperated
- no, only one active profiles (I changed the other xml-files to .old or so) and I don't want a drop-down for the users, they shouldn't have to enter anything.
- no, no always-on activated
best regards
Karl
... View more
07-31-2018
05:31 AM
Hello,
we've got a ASA5525-X, v 9.8.2-33 and Anyconnect v 4.6.01103, authentication with Cert, SBL working, Anyconnect is connecting to "vpn.company.com/anyconnect", so everything's fine.
Now I want a Test-PC connect to a Test-ASA with an external adress "vpntest.company.com/anyconnect"
So on the Test-ASA I create a Anyconnect-Profile with the external adress in the Server List.
I export the xml-file copy it on the PC under ./Profile/ now I restart the PC, but the PC always connects to the produktive ASA (vpn.company.com/anyconnect), if I manually want to enter the other adress, I can't connect because of cert in machine store.
Question: doesn't the client read the adress from the xml-file? If I check the file, everything is fine.
Any idea where to search?
content of profile.xml:
<AnyConnectProfile xmlns="http://schemas.xmlsoap.org/encoding/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://schemas.xmlsoap.org/encoding/ AnyConnectProfile.xsd">
<ClientInitialization>
<UseStartBeforeLogon UserControllable="false">true</UseStartBeforeLogon>
<AutomaticCertSelection UserControllable="false">true</AutomaticCertSelection>
<ShowPreConnectMessage>false</ShowPreConnectMessage>
<CertificateStore>Machine</CertificateStore>
<CertificateStoreMac>All</CertificateStoreMac>
<CertificateStoreOverride>true</CertificateStoreOverride>
<ProxySettings>IgnoreProxy</ProxySettings>
<AllowLocalProxyConnections>true</AllowLocalProxyConnections>
<AuthenticationTimeout>12</AuthenticationTimeout>
<AutoConnectOnStart UserControllable="false">true</AutoConnectOnStart>
<MinimizeOnConnect UserControllable="false">true</MinimizeOnConnect>
<LocalLanAccess UserControllable="false">false</LocalLanAccess>
<DisableCaptivePortalDetection UserControllable="false">true</DisableCaptivePortalDetection>
<ClearSmartcardPin UserControllable="false">false</ClearSmartcardPin>
<IPProtocolSupport>IPv4</IPProtocolSupport>
<AutoReconnect UserControllable="false">true
<AutoReconnectBehavior UserControllable="false">ReconnectAfterResume</AutoReconnectBehavior>
</AutoReconnect>
<AutoUpdate UserControllable="false">true</AutoUpdate>
<RSASecurIDIntegration UserControllable="false">Automatic</RSASecurIDIntegration>
<WindowsLogonEnforcement>SingleLogon</WindowsLogonEnforcement>
<WindowsVPNEstablishment>LocalUsersOnly</WindowsVPNEstablishment>
<AutomaticVPNPolicy>false</AutomaticVPNPolicy>
<PPPExclusion UserControllable="false">Disable
<PPPExclusionServerIP UserControllable="false"></PPPExclusionServerIP>
</PPPExclusion>
<EnableScripting UserControllable="false">true
<TerminateScriptOnNextEvent>false</TerminateScriptOnNextEvent>
<EnablePostSBLOnConnectScript>true</EnablePostSBLOnConnectScript>
</EnableScripting>
<CertificateMatch>
<MatchOnlyCertsWithKU>false</MatchOnlyCertsWithKU>
<ExtendedKeyUsage>
<ExtendedMatchKey>ClientAuth</ExtendedMatchKey>
</ExtendedKeyUsage>
</CertificateMatch>
<EnableAutomaticServerSelection UserControllable="false">false
<AutoServerSelectionImprovement>20</AutoServerSelectionImprovement>
<AutoServerSelectionSuspendTime>4</AutoServerSelectionSuspendTime>
</EnableAutomaticServerSelection>
<RetainVpnOnLogoff>false
</RetainVpnOnLogoff>
<AllowManualHostInput>true</AllowManualHostInput>
</ClientInitialization>
<ServerList>
<HostEntry>
<HostName>vpntest.company.com/anyconnect</HostName>
<HostAddress>vpntest.company.com</HostAddress>
<UserGroup>anyconnect</UserGroup>
</HostEntry>
</ServerList>
</AnyConnectProfile>
... View more
Labels:
08-17-2017
04:21 AM
very simpel:
all my browsers blocked the Flashplayer.
but: in the year 2017: do we really need flashplayer on a security-device???
... View more
01-25-2017
10:37 PM
No, doesn't work.
tried this on our testmachine (no cluster, all on one machine)
... View more
01-25-2017
04:57 AM
Hello,
today i've installed patch 6 (5-8-0-32-6.tar.gpg) on 3 1121's.
Everything's working fine but I can't see any logs. On the dashboard I click on "Radius Authentication" or "Tacacs Authentication", a new tab opens, the light blue appears with a frame, but no data.
We've got a standalone and a cluster, were the secondary acs is the log-collector, this behavior is on all machines
I've tried with Firefox 45esr and IE 11
Any help?
thanks
Karl
... View more
- Tags:
- acs 5.8 patch 6 log
Labels:
12-08-2016
04:52 AM
ok, I've made a sub-interface on the inside-if with the IP of the NAT-object.
so the problem, was, that the ASA doesn't translate traffic originated by it self.
... View more
01-01-2019
Hi Mohammed, that didn't change something, the MTU Size was the default
of 1406, I've changed to 142...
01-01-2019
Hello, I've updatet our ASA to 9.10.1 and the anyconnect-client to
4.7.00136, now I receive a lot of...
Created by
gaigl
in VPN and AnyConnect
12-11-2018
12-11-2018
@ 2.: your Certificate needs "extended Key Usage: Client Auth" and in
the Profile Editor you can act...
Created by
gaigl
in VPN and AnyConnect
12-11-2018
12-11-2018
that's quit difficult, because we've got some other restrictions. maybe
some screenshots: client-pro...
Created by
gaigl
in VPN and AnyConnect
12-11-2018
12-11-2018
you can use the certificate ... map, I did it too. But you have to
remove group-url and such things,...
12-10-2018
Hi, in the release notes of AC 4.7 there is one new feature: "
Management VPN Tunnel—(Requires ASDM ...
09-17-2018
deleting the Group-URL and Alias did the Job, now I cannot change the
Connection Profile manually. D...
08-06-2018
Hello, at the moment we are using only one anyconnect connection
profile, but soon we need a second ...
07-31-2018
Hello Paul, - DNS resolves different adresses, the test- and prod ASA's
are completely seperated - n...
07-31-2018
Hello, we've got a ASA5525-X, v 9.8.2-33 and Anyconnect v 4.6.01103,
authentication with Cert, SBL w...
08-17-2017
very simpel: all my browsers blocked the Flashplayer. but: in the year
2017: do we really need flash...
01-25-2017
Hello, today i've installed patch 6 (5-8-0-32-6.tar.gpg) on 3 1121's.
Everything's working fine but ...
Public Statistics
| Date Registered | 10-10-2010 10:37 PM |
| Date Last Visited | 01-21-2019 12:03 AM |
| Total Messages Posted | 76 |
| Total Helpful Votes Received | 13 |
.jpg "VIP Advocate"){kind=icon}
