HI, You need to do 2 things:- 1) create a "persistant self signed certificate in the ASA" - see below URL. http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00808efbd2.shtml 2) Once you have the cert - you need to install them in the laptops "local machine certificate store" The certificate cannot be installed in any other location - as the anyconnect software needs to access the machine, before anyone logs in.....
... View more
Hi, Yes - ideally the machine would already be part of the domain. And the user has their credentials cached on the machine. When logged into the SBL, the machine looks like its locally connected on the LAN and the domain.
... View more
There is the issue Oct 02 14:03:24 [IKEv1]: Group = BENKERTVPN, Username = regina, IP = 60.53.6.0, Remote peer has failed user authentication - check configured username and password I think it could be one of three things:- 1- The PSK for the group authentication is incorrect in the client config 2- The username/password in Radius has changed or requires to be changed due to password aging policy 3- The ASA is no longer able to query and pass on auth requests to the Radius server HTH.
... View more
In the routing world, and configuring a GRE tunnel - you would get the same issue if you route the GRE end points into the tunnel, the tunnel cannot form - chicken and the egg. I will not ask why you are soing this, but you will need to split-tunnel the traffic you need to encrypt, not the IP connection that the RDP session is created with. HTH./
... View more
If the remote end VPN user gets this message once in a while - in my experiance 100% of the time it is a connectivity issue from the users remote network and or Internet connectivity. However if they cannot connect or have never been able to connect then check here:- http://www.cisco.com/en/US/products/ps6120/products_tech_note09186a00807e0aca.shtml#intro HTH./
... View more
AnyConnect carries on the Cisco tradition of "SBL" Start Before Logon" the user has to initiate the AnyConnect VPN before they logon and anuthenticate to the machine. SBL allows a VPN to be connected to the corperate environment - once connected the user logs in like they were connected on the LAN, all drives and services work as normal. See the below link.... http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00809f0d75.shtml I finished a project 3 months ago to roll this out for 5000+ users - it works very well.
... View more
Your issue is here> 005093: Oct 1 05:23:05.512: ISAKMP:(0):No pre-shared key with ! & 005113: Oct 1 05:23:36.704: ISAKMP:(0):No pre-shared key with ! Your configuration is missing a pre-shared key, re-configure and test again.
... View more
Darren, Read the below link:- http://www.cisco.com/en/US/docs/switches/lan/catalyst3750/software/release/12.2_52_se/configuration/guide/swmcast.html HTH>
... View more
DMZ link bandwidth command enables a BGP extended community to be sent to iBGP peers describing the size of the bandwidth for links exiting the AS (but only for directly connected neighbors). This allows for unequal cost load balancing out of the AS. HTH>
... View more
I know you can write a specific script to look for key words and alert on them like "en" "conf t" "wr mem" etc and send an email alert. but you should have a look @ the below before you start scripting:- http://www.cisco.com/en/US/docs/ios/12_3t/12_3t4/feature/guide/gtconlog.html HTH>
... View more
Simlpy - yes, but you will have to do some realy digging for the actual settings. You will have to monitor the interface TX & RX packets in a specific time period and I suspect convert them to value you are checking for in the script. Once the condition is met - a simple config change of applying the policy to the interface. the same would be said to remove it - I have seen something like this done before, I suggest you use your favorite search engine and start searching...... HTH>
... View more
.jpg "Hall of Fame Master"){kind=icon}
