Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Marvin Ruiz
08-18-2017
Stats
Member since
08-27-2012
11
Posts
75
Helpful
0
Solutions
02-25-2016
09:11 AM
Great post.
To put my two cents in:
Once the necessary data has been collected, delete the "capture point" and "capture buffer":
- no monitor capture point ip cef CAPTUREONG1 g1/0 both
- no monitor capture buffer MYBUFFER
In situations where you do not have a TFPT server available, you can take a copy of the hex dump and use any online hex-pcap convertor in order to view the files.
Example:
http://sadjad.me/phd/
... View more
10-01-2015
09:51 AM
El término “Doble Autenticacion” se utiliza para describir dos autenticaciones del mismo tipo (primera autenticación con un servidor de AAA o Local, segunda autenticación también con AAA o Local). Para utilizar autenticación con AAA + Certificados el termino más apropiado seria “Autenticación de 2 factores (2factor). Es posible utilizar certificados tanto del store del usuario como certificados en el store de la maquina. Los siguientes enlaces te proporcionaran ejemplos de configuración: (No existe mucha información o guias en Españo, pero los siguientes documentos deberían ser relativamente simples de seguir) AnyConnect Certificate Based Authentication. https://supportforums.cisco.com/blog/152941/anyconnect-certificate-based-authentication ASA AnyConnect Double Authentication with Certificate Validation, Mapping, and Pre-Fill Configuration Guide http://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/116111-11611-config-double-authen-00.html En caso de que el ASA necesite revisar si el certificado de usuario aun es válido, se podría configurar chequeo de revocación en el “Trustpoint” que se usa para autenticar los clientes (El CA truspoint) Configuring Certificates (About Revocation Checking section) http://www.cisco.com/en/US/docs/security/asa/asa81/config/guide/cert_cfg.html#wp1054657
... View more
10-01-2015
09:48 AM
Hablando sobre cuán seguros son los protocolos no podemos decir que existe gran diferencia sobre IKEv2 o SSL. El usuario final tampoco percibe alguna diferencia cuando el protocolo de IKEv2 está habilitado para el cliente. Tal vez la razón para usarlos seria mas enfocada al administrador de la red, dado que para resolución de problemas es muy similar al antiguo cliente IPsec de Cisco. Tambien, otra opción para usarlos seria para cuando el puerto UDP 443 está siendo bloqueado (UDP 443 es utilizado por DTLS para dar un mejor rendimiento del cliente) en este caso se podría optar por usar el AnyConnect con IKEv2 que utiliza puerto TCP 443 y UDP 4500. En el siguiente enlace podrán encontrar una guía de configuración para AnyConnect IKEV2. AnyConnect over IKEv2 to ASA with AAA and Certificate Authentication http://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/113692-technote-anyconnect-00.html
... View more
10-01-2015
09:47 AM
DAP es una característica que se agrego en la versión de ASA 8.0 en adelante. Por medio de DAP podemos configurar autorización para conexiones de VPN basados en múltiples parámetros que son configurables, ayudándonos así a tener más control de quien se conecta con un cliente VPN aun en ambientes dinámicos o cambiantes. Por ejemplo, podríamos configurar el ASA para que busque por un archivo escondido en la PC, o por una llave de registró en especial (que solo las computadoras de la compañía tendrían) y asi permitir/denegar la connecion o agregar filtros (ACLs), bookrmarks y otras opciones. El siguiente enlace detalla la funcionalidad de DAP y explica su configuración. ASA 8.x Dynamic Access Policies (DAP) Deployment Guide http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/108000-dap-deploy-guide.html
... View more
Created by
Marvin Ruiz
in VPN and AnyConnect
in VPN and AnyConnect
11-09-2012
10:04 AM
11-09-2012
10:04 AM
Really useful information Javier, Thanks a lot.
... View more
Created by
Marvin Ruiz
in Security Blogs
in Security Blogs
10-16-2012
03:17 PM
10-16-2012
03:17 PM
Hello, In case the ASA needs to check if a specific certificate is still valid, or if it has been revoked; you could configure revocation checking in the trustpoint that is used to authenticate the clients. For further information you can check the link below: Configuring Certificates (About Revocation Checking section) http://www.cisco.com/en/US/docs/security/asa/asa81/config/guide/cert_cfg.html#wp1054657 I hope you find this information useful. Best regards,
... View more
Created by
Marvin Ruiz
in Security Blogs
in Security Blogs
09-30-2012
07:50 AM
09-30-2012
07:50 AM
Hello Burhan, The configuration for AnyConnect for mobile devices (Android, phone, Ipad, etc) will be just the same for the regular AnyConnect client. If it is already in place for PCs, then you should be able to connect the Smartphones. It would be good that you check if the ASA has a proper license for AnyConnect for mobiles as in the example below: show version output: Failover cluster licensed features for this platform: Maximum Physical Interfaces : Unlimited perpetual Maximum VLANs : 100 perpetual Inside Hosts : Unlimited perpetual Failover : Active/Active perpetual VPN-DES : Enabled perpetual VPN-3DES-AES : Enabled perpetual Security Contexts : 5 perpetual GTP/GPRS : Disabled perpetual AnyConnect Premium Peers : 250 perpetual AnyConnect Essentials : 250 perpetual Other VPN Peers : 250 perpetual Total VPN Peers : 250 perpetual Shared License : Enabled perpetual AnyConnect for Mobile : Enabled perpetual AnyConnect for Cisco VPN Phone : Enabled perpetual Advanced Endpoint Assessment : Enabled perpetual UC Phone Proxy Sessions : 52 perpetual Total UC Proxy Sessions : 52 perpetual Botnet Traffic Filter : Disabled perpetual Intercompany Media Engine : Disabled perpetual In case you do not have this license enabled in the ASA you can use the following link in order to get a 90 demo license for mobile devices: AnyConnect mobile 90 day demo license. https://tools.cisco.com/SWIFT/Licensing/PrivateRegistrationServlet If after installing the license you still face issue I would suggest opening a case with TAC support team for further trouble shooting. I hope this information can be helpful for you. Best regards,
... View more
Created by
Marvin Ruiz
in Security Blogs
in Security Blogs
09-30-2012
07:32 AM
09-30-2012
07:32 AM
Hello Sal, In answer to your questions, What you need to upload to the ASA for certificate authentication is the server CA certificate, then it is not going to have any sort of conflict with the 3 rd party certificate already installed in the ASA. The command "ssl certificate-authentication interface <interface> port <portnum>" is required just for version prior to 8.2.x, since your ASA is running 8.2.5 you will not need to use this command. Also, you can use the same IP local pool configured in the ASA for the new connection profile. In the above configuration example I am adding a group alias to the connection profile. Please check the above configuration example; it contains all that you require for your set up. Best regards,
... View more
Created by
Marvin Ruiz
in Security Blogs
in Security Blogs
09-26-2012
08:49 AM
09-26-2012
08:49 AM
Hello Sal, As Elias previously mentioned if you are about to create 2 separate groups in the ASA, one for certificate authentication and the other one for RSA authentication they should not interfere with each other. However, as you can check in the information at the top of the post, the ASA firewall should be running an OS version of 8.2.x or later. With 8.2.x we can enable per tunnel-group certificate authentication. Feature in the ASA 8.2.x release, using pre-8.2.x ASA code it will require to globally enabling the certificate authentication with the command: "ssl certificate-authentication interface <interface> port <portnum>" And the above command will affect the connections to all groups in the firewall, and also ASDM connections. Regarding you question about the AnyConnect image installed in you ASA It would be suggested that you upgrade to the AnyConnect version 2.5.6005 (Which is the one available in the Cisco web page) Since Cisco has remove the previous client versions from the public access due to vulnerabilities in the software: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120620-ac I hope this information can be helpful for you. Warm regards,
... View more
Created by
Marvin Ruiz
in Security Blogs
in Security Blogs
09-04-2012
08:07 AM
09-04-2012
08:07 AM
Hello Gustavo, Thank you very much for the additional info, I was not even aware of it. It is really helpful, I will keep it in mind. Regards,
... View more
Created by
Marvin Ruiz
in Security Blogs
in Security Blogs
08-31-2012
05:49 PM
08-31-2012
05:49 PM
Hello Matt, Thank you very much for your comments. In answer to your question, yes It is totally possible to use the built-in CA server feature of the ASA in order to Issue certificates to your SSL clients and perform certificate based authentication. This would be the process: 1-) Create the Certificate Authority as shown below: Follow the path below: Configuration > Remote Access VPN > Certificate Management > Local Certificate Authority > CA Server Check off the "Enable Certificate Authority Server" option and enter a passphrase. Optionally you could configure a SMTP e-mail server in with the ASA could send the certificate information to your users, but in this example We will work with the HTTP connection. 2-) You will need to add a user in the CA’s user database: Configuration > Remote Access VPN > Certificate Management > Local Certificate Authority > Manage User Database Select “Add” to add the “vpnuser”, Enter the username and optionally the e-mail id. You can also add specific values of the certificate subject name by using the “Select” button next to the “DN String” option. Once the user is created it will have a status of allowed but no yet enrolled. At this point you will want to generate the OTP in order to provide it to the SSL user. Either connecting with the AnyConnect client or through the web vpn portal you will get the option to “Get Certificate” (If the group where the user is connecting to is configured for certificate authentication). By clicking in the “Get Certificate” button you will be ask for the username and OTP After you enter the correct username and OTP you will be provided with the user certificate for the install (depending on the OS you could be prompted with the option to save the certificate before installing it, if that is the case it could ask you for a passphrase for the installation, and it would be the same OTP that you entered to request the certificate). After the certificate has been installed in the PC, the AnyConnect client will be able to establish the connection. Below you can find how the commands will look like using the CLI: crypto ca server smtp from-address 10.10.10.10 database path flash:/ no shutdown passphrase cisco123 crypto ca server user-db add vpnuser crypto ca server user-db allow vpnuser display-otp I hope this can be useful for you.
... View more
Created by
Marvin Ruiz
in Security Blogs
in Security Blogs
08-27-2012
05:20 PM
08-27-2012
05:20 PM
The information in this document is based on these software and hardware versions: ASA 5510 that runs software version 8.2(2) and ASDM version 6.4(9) Anyconnect client software version 3.0 (It will work the same for versions prior to 8.3) Microsoft Windows 2003 server as the CA server for the scenario. Since the ASA version in use is 8.2.x we can enable per tunnel-group certificate authentication. (Feature in the ASA 8.2.x release, using pre-8.2.x ASA code it will require to globally enabling the certificate authentication with the command "ssl certificate-authentication interface <interface> port <portnum>"). In order to acomplish the AnyConnect authentication using certificates the AnyConnect client should get a valid certificate from the CA server, at the same time the ASA should have the CA Root certificate in order to properly validate the certificate of the connecting client. 1-) Make sure you have an AnyConnect image applied in the ASA firewall: Configuration > Remote Access VPN > Network (Client) Access > AnyConnect Client Software Click the Add button, and browse the flash for the proper image (optionally you can upload the client from the local PC). 2-) Enable anyconnect in the outside interface: Configuration > Remote Access VPN > Network (Client) Access > AnyConnect Connection Profiles Check the box "Enable Cisco AnyConnect VPN Client or legacy SSL Client" Then select the interface where the AnyConnect clients will be connecting to (in this example the outside interface). The " Allow user to select connection profile" check option will allow the AnyConnect user to select the group they will be connecting to. 3-) Create a new AnyConnect connection profile: Configuration > Remote Access VPN > Network (Client) Access > AnyConnect Connection Profiles Click the Add button, the "AnyConnect connection profile" window will open. Give the connection profile a name and optionally a group alias. Click the "Select" button next to the "Client Address Pools" option. The " Select Address Pools" window will appear. Click the "Add" button in order to create a new pool of addresses. 4-) Create a Group-policy: Configuration > Remote Access VPN > Network (Client) Access > AnyConnect Connection Profiles Click the "Manage" button next to the "Group Policy" option in the connection profile. Click the "Add" button in order to create the new policy. Give the policy a name (In this example "AnyConnect-Policy") and check the "Clientless SSL VPN" and "SSL VPN Client" boxes, then click the "ok" button. The AnyConnect group have been created at this point. 5-) Install the CA certificate in the ASA: The CA certificate must be downloaded from the CA server and installed in the ASA. Complete these steps in order to download the CA certificate from the CA server. Perform the web login into the CA server CA-server with the help of the credentials supplied to the VPN server. Click Download a CA certificate, certificate chain or CRL in order to open the window, as shown. Click the Base 64 radio button as the encoding method, and click Download CA certificate. Save the CA certificate with the certnew.cer name on your computer. Go to Configuration > Remote Access VPN > Certificate Management > CA Certificates in the ASA firewall. Click on the "Add" button, the "Install Certificate" window will open. Click the "Browse" button next to the "Install from a file" option. Browse to the location where you saved the CA certificate, highlight the CA certificate and click on the "Install" button. At this point the CA certificate will be installed in the ASA fiwall and it willl be able to validate the connecting users, which user's certificate was created from the same CA server. 6-) Go back to the AnyConnect connection profiles and change the profile to use certificate authentication: Configuration > Remote Access VPN > Network (Client) Access > AnyConnect Connection Profiles Highlight the "AnyConnect-group" profile and click the "Edit" button. The "Edit AnyConnect Connection Profile" will open, then you will be able to select the authentication method to be "Certificate" Click the "OK" button and then click "Apply" (Remember to save the configuration performed) 7-) The next step would be to install the certificate in the AnyConnect client PC: The user will need to log in into the CA server with his credentials. Once in the CA server, the user will need to click in the "Request a certificate" option. The user will want to select the "User Certificate" option. At this point the CA sever will provide the user certificate to be installed. Once the certificate is installed the user will be able to connect the AnyConnect client authenticating with the previously installed certificate (No username and password required) Below you will find how the configuration should look like in the CLI interface: ip local pool AnyConnect 10.10.10.1-10.10.10.254 mask 255.255.255.0 group-policy AnyConect-policy internal group-policy AnyConect-policy attributes vpn-tunnel-protocol svc webvpn tunnel-group AnyConnect-group type remote-access tunnel-group AnyConnect-group general-attributes address-pool AnyConnect default-group-policy AnyConect-policy tunnel-group AnyConnect-group webvpn-attributes authentication certificate group-alias AnyConnect enable webvpn enable outside svc image disk0:/anyconnect-dart-win-2.5.6005-k9.pkg 1 svc enable tunnel-group-list enable crypto ca trustpoint ASDM_TrustPoint0 revocation-check none no id-usage enrollment terminal crypto ca authenticate ASDM_TrustPoint0 MIIEtDCCA5ygAwIBAgIQcNSMRXs696JMHFgTc+OKPjANBgkqhkiG9w0BAQUFADBV MRMwEQYKCZImiZPyLGQBGRYDY29tMRUwEwYKCZImiZPyLGQBGRYFY3J0YWMxFjAU BgoJkiaJk/IsZAEZFgZ2cG5sYWIxDzANBgNVBAMTBnZwbmxhYjAeFw0xMjA2MDUy MDAyNThaFw0xNzA2MDUyMDExNTdaMFUxEzARBgoJkiaJk/IsZAEZFgNjb20xFTAT BgoJkiaJk/IsZAEZFgVjcnRhYzEWMBQGCgmSJomT8ixkARkWBnZwbmxhYjEPMA0G A1UEAxMGdnBubGFiMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2Wo7 iCHElRUbgGAJgsf52AxlQLmeyMTSgS2I6/hTCOmra5BkP4cUieSeWqnOAPYgGTj/ it3qGVLBjkjf2sHBUBHfIUm8nnQF2UNjTbJZVIfCAyrHoRXNDFNV6qlKFoMmi7VG 2CudXsbuC86LsFDTMkk2Y2UB/T1xUpf5TBX+uQDb7w4jIZs1DkpQBmE946lH8vyA GHU6RdainLr/44Sa0iPjzngMdssq0QlE/8gYWr6HsAOvmKhf8RcokjqXEQ36JyAF +N/6sqoDTYl6jXg72PuoLO/zcmu8qbY+aRQGu5tlKXVemb9FyEKOuLe/Q4PirCz1 TUHw8urOHcHCquo5PwIDAQABo4IBfjCCAXowEwYJKwYBBAGCNxQCBAYeBABDAEEw CwYDVR0PBAQDAgGGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFNI2q3uAQNAg nR+BfjqEcGUZaHoNMIIBEgYDVR0fBIIBCTCCAQUwggEBoIH+oIH7hoG7bGRhcDov Ly9DTj12cG5sYWIsQ049dnBuLXNlcnZlci0wMSxDTj1DRFAsQ049UHVibGljJTIw S2V5JTIwU2VydmljZXMsQ049U2VydmljZXMsQ049Q29uZmlndXJhdGlvbixEQz12 cG5sYWIsREM9Y3J0YWMsREM9Y29tP2NlcnRpZmljYXRlUmV2b2NhdGlvbkxpc3Q/ YmFzZT9vYmplY3RDbGFzcz1jUkxEaXN0cmlidXRpb25Qb2ludIY7aHR0cDovL3Zw bi1zZXJ2ZXItMDEudnBubGFiLmNydGFjLmNvbS9DZXJ0RW5yb2xsL3ZwbmxhYi5j cmwwEAYJKwYBBAGCNxUBBAMCAQAwDQYJKoZIhvcNAQEFBQADggEBAEHyvayVbKqT 0rwZNFBC3GAnUCDCK3kJxyjvir+T2pcCVS5KLukhTcDtr5VBOrSGsFA+zJvqB7qS dwAvh9tKjpdb6rQKM5bo7NKii7mU71WxK8/wSupLMlNEZemvZcnaLKB2P5TGwJ0K 9LTp/rT89pvO9QbEMnRMPi0dPHQbu90sDLLBksxUfXII8qNyjjqNnVq2GDHX56Gz DzltLTLnrL4Gb/1M9ulwO2bzNV9J7uVg6iELJDbzkHFaCNXTvQJyDsN41xETg54Y uv6hViCXnu0SaaWi2rjVqx8pUXD7O3jrH9jnBC71cUqzv+MBvJI3th9iMMA80Gno Rl0Ipuf7dYk= quit I hope this information can be helpful for you..
... View more
Labels:
02-25-2016
Great post. To put my two cents in: Once the necessary data has been
collected, delete the "capture ...
10-01-2015
El término “Doble Autenticacion” se utiliza para describir dos
autenticaciones del mismo tipo (prime...
10-01-2015
Hablando sobre cuán seguros son los protocolos no podemos decir que
existe gran diferencia sobre IKE...
10-01-2015
DAP es una característica que se agrego en la versión de ASA 8.0 en
adelante.Por medio de DAP podemo...
Created by
Marvin Ruiz
in VPN and AnyConnect
11-09-2012
11-09-2012
Really useful information Javier, Thanks a lot.
Created by
Marvin Ruiz
in Security Blogs
10-16-2012
10-16-2012
Hello, In case the ASA needs to check if a specific certificate is still
valid, or if it has been re...
Created by
Marvin Ruiz
in Security Blogs
09-30-2012
09-30-2012
Hello Burhan, The configuration for AnyConnect for mobile devices
(Android, phone, Ipad, etc) will b...
Created by
Marvin Ruiz
in Security Blogs
09-30-2012
09-30-2012
Hello Sal, In answer to your questions, What you need to upload to the
ASA for certificate authentic...
Created by
Marvin Ruiz
in Security Blogs
09-26-2012
09-26-2012
Hello Sal, As Elias previously mentioned if you are about to create 2
separate groups in the ASA, on...
Created by
Marvin Ruiz
in Security Blogs
09-04-2012
09-04-2012
Hello Gustavo, Thank you very much for the additional info, I was not
even aware of it. It is really...
Created by
Marvin Ruiz
in Security Blogs
08-31-2012
08-31-2012
Hello Matt,Thank you very much for your comments. In answer to your
question, yes It is totally poss...
Public Statistics
| Date Registered | 08-27-2012 08:25 AM |
| Date Last Visited | 08-18-2017 04:00 AM |
| Total Messages Posted | 11 |
| Total Helpful Votes Received | 75 |
Helpful Votes Given To
.jpg "VIP Mentor"){kind=icon}
Helpful Votes From
