On some devices you won't see the recursive routing log, instead will only see this one: ADJ-5-PARENT  Midchain parent maintenance for IP midchain out of TunnelXXX - looped chain attempting to stack Just wanted to add it here in case someone is googling for the above message ... View more

Hi Bill, As per the following documentation the tunnel should remain up when you are using NEM: http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00808a61f4.shtml#v2 Though if you have the chance to test it in the lab first I would suggest doing so, I did some research and couldn't find anyone else with this same query on a PIX. HTH Jonnathan ... View more

Corey, This is a known issue documented on the following link: https://supportforums.cisco.com/docs/DOC-26829 Quoting from the above document: Generally it is a good idea to stick with the same version that you are running so if you are current running:      Anyconnect 2.5.xxxx upgrade to 2.5.6005 or later      Anyconnect 3.0.xxxx upgrade to 3.0.10055 or later      Alternatively you could upgrade to the latest 3.1 version.      For CSD upgrade to Cisco Secure Desktop 3.6.6020 or later.               HTH Jonnathan ... View more

Another option that will be supported by Cisco is L2TP over IPsec: http://www.cisco.com/en/US/tech/tk583/tk372/technologies_configuration_example09186a00800942ad.shtml ... View more

That's what the group-lock feature Karsten suggested is for, it will bind a tunnel-group to a group-policy, if you authenticate to a tunnel-group but the RADIUS mapping sends you to a group-policy different than the one specified in the group-lock value your connection attempt will be denied. Further reading: https://supportforums.cisco.com/thread/2085928 Herbert's reply offeres a very good explanation on how this feature works. ... View more

Just adding to Karsten's recommendation, this guide shows how to use the ACS to assign the group-policy with the class attribute: http://www.cisco.com/en/US/products/sw/secursw/ps2086/products_configuration_example09186a00808cf897.shtml After assigning the attribute for allowed users you can just set a default group-policy denying access, similar to the following: group-policy NOACCESS internal group-policy NOACCESS attributes vpn-simultaneous-logins 0 It can also be done with a Microsoft server using RADIUS policies to assign attribute 25 ... View more

Based on three outputs: VPN-DES:                     Enabled VPN-3DES-AES:                Enabled Which tells me encryption is enabled on the PIX, and from: IKE peers:                   10 Which specifies the number of users. ... View more

Yes, for 10 users. ... View more

You would get a yes or no answer if you were more specific from the very beginning, VPN is a wide technology and unfortunately answer are never that simple. Also, if you take a look at the link I provided you will find your own answer: "These licenses activate encryption services on  Cisco PIX Security Appliances, which are required before using certain  features including VPN, secure remote management, and more" So it doesn't depend on your users license, it depends on your encryption license: You can check it by doing a "show version" and looking at the following outputs: VPN-DES                           : Enabled        VPN-3DES-AES                      : Enabled ... View more

So the VPN endpoint will be the WIndows server and not the PIX itself right? If so, the PIX will be working as a pass-through device and VPN licenses won't have anything to do, the concurrent number of connections is what will limit the VPN traffic, but you will be able to build the tunnel with no problems. Further reading on PIX licensing: http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5708/ps5709/ps2030/product_data_sheet09186a00800b0d85.html As you can see on table 4 the number of connections allowed with a 10 user license is 7500, which doesn't mean 7500 users. but 7500 connections between your local network and the VPN traffic. HTH Jonnathan ... View more

Hi, Configuration on the ASA side is the same as in the following example: http://www.cisco.com/en/US/products/ps5855/products_configuration_example09186a0080a9a7a3.shtml I couldn't find any specific document for the RV042 but the GUI is intuitive, the only limitation on this side is that it can only build one SA (one slot for remote network and another for local network) so summarization must be used if you want this site to reach multiple subnets on the other network, buildling multiples might work but the results are variable and not supported. HTH Jonnathan ... View more

Hi, AnyConnect or the VPN Client will just add the suffixes you specify on the ASA, so if you add one that is already on the computer you will see a duplicate, but it shouldn't affect functionality. HTH Jonnathan ... View more

Hi, It might be a good idea to also post the "show version" output of your PIX, also, what specific type of VPN are you thinking of? IPsec site to site, remote access or SSL remote access? Jonnathan ... View more