Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About RJI
RJI
Advisor
Independant IT consultant based in the UK, specialising in design and implementation of network/security solutions, such as VPN (DMVPN, FlexVPN, Remote Access and Site to Site), Firewalls (ASA and FTD), ISE, Trustsec and Umbrella.
Awards
Recent Badges
Stats
Member since
12-05-2010
2913
Posts
3902
Helpful
514
Solutions
Certifications
03-30-2020
03:19 PM
Hi, Yes, you can generate the certificate using openssl, then you get the CSR signed by the public CA. Then you need to import the signed identity certificate and the Public CA's Root certificate(s) via FDM. Client and Server authentication should be fine, you don't need any additional parameters. HTH
... View more
03-30-2020
01:41 PM
Hi, It sounds like the users are not receiving a DNS server, can you check the configuration of the tunnel-group/connection profile they connect to upon logon. Example:- group-policy GP-1 attributes dns-server value 192.168.10.5 Is split-tunnel configured for these users? Or do you intend to route their internet traffic through the VPN and access the internet from the main site? HTH
... View more
03-30-2020
10:38 AM
Yes, you can have multiple VPN pools or you can even use DHCP, this can be configured statically or dynamically via RADIUS. HTH
... View more
03-30-2020
10:23 AM
Hi, No you don't necessarily need to have a dedicated VPN concentrator, large organsiations do for separation of roles rather than have one device do everything, this helps reduce complexity. You can purchase the Cisco Firepower 1000 series firewalls, datasheet here. The FP1010 model support maximum 75 VPN peers, the 1020 model supports 150 VPN peers and the 1040 supports up to 400 VPN peers. You should purchase based on your maximum connections, so you might need to purchase the 1040 To assign a static IP address to users if you use LDAP to authenticate you can follow this guide, or alternatively if you use RADIUS follow this guide. HTH
... View more
03-30-2020
09:28 AM
As it's a public IP address and you are tunnelling all AnyConnect VPN traffic through the ASA and back out you need to all traffic to be routed back out the same interface in came in on with this command:- same-security-traffic permit intra-interface And a nat rule:- object network NETWORK_OBJ_172.21.1.0_28 nat (outside,outside) dynamic interface HTH
... View more
03-30-2020
07:55 AM
Hi, Yes this is possible, once connected to the VPN you can connect to your entire internal network. Do you already have the ASA setup for remote access? If so is it just rdp that you cannot access or other services? If just rdp, check the server doesn’t have a local firewall turned on blocking your connection. If you cannot access the internal network check your Nat rules. Provide your configuration of the ASA if you need further assistance. HTH
... View more
03-30-2020
05:19 AM
The source port(s) is going to be random, so don't define it in the ACL - just define the destination port(s). permit tcp any host 10.10.20.5 eq 32400 The IP address 10.10.20.5 also does not match the same IP address used in the NAT rule (10.10.20.100), you should ensure they are correct. HTH
... View more
03-30-2020
03:46 AM
Hi, The FMC does not currently provide a lot of session information. You have 2 options, use RADIUS as the authentication server, this will have the information you require (login, logoff etc). If you wish to use syslog, refer to this guide. HTH
... View more
03-29-2020
02:44 PM
In your "nat-list" ACL, you have your deny ACE under the permit, which basically means the deny is doing nothing. Place the deny statement above the permit to ensure it works as expected. You'll probably need "ip nat inside" defined on the virtual-template for internet access. You appear to have ZBFW configured, disable this until you've got the NAT working as expected to make sure you aren't inadvertently blocked traffic. Once you have established connectivity, then re-enable.
... View more
03-29-2020
02:36 PM
Hi, You would define the DNS server under the group-policy E.g:- group-policy RAVPN_GP attributes dns-server value 192.168.10.5 Check your group-policy configuration, ensure the users are actually receiving the group-policy "show vpn-sessiondb detail anyconnect" - run this command when a user is logged in to the VPN. Upload your configuration if you need further assistance and the output of "show vpn-sessiondb detail anyconnect". HTH
... View more
03-29-2020
01:33 PM
Hi, I imagine the problem is either NAT or ACL. Ensure that traffic from your VPN Pool to your local LAN networks is not natted. You will need to ensure the VPN Pool is included in the NAT ACL. Please provide your configuration so we can determine what the exact issue is. HTH
... View more
03-29-2020
12:21 PM
Hi, You should double check your ACL ip access-list extended WAN-TO-LAN permit icmp any 10.10.20.0 0.0.0.255 permit tcp any eq 55555 host 10.10.20.5 eq 5555 The destination port in your NAT rule is 55555, so you are missing a 5 in your ACL. Also your source port may not be 55555, I leave that out and just define the correct destination. HTH
... View more
03-28-2020
03:00 AM
Hi. If DHCP is configured on the tunnel-group then the users that don't get a static IP address assigned dynamically should receive an IP address via DHCP. If you want to use ISE you can use the radius atrribute value pair -" Framed-IP-Address" in an authorisation profile. E.g HTH
... View more
03-27-2020
08:29 AM
Hi, The error messages says AUTHENTICATION_FAILED, re-enter your PSK and try again. HTH
... View more
03-26-2020
02:17 PM
Hi, You've seem to have everything covered regarding the configuration changes required. The nat connections would remain until they timeout, clear the connections should hopefully resolve the issue. HTH
... View more
03-30-2020
Hi,Yes, you can generate the certificate using openssl, then you get the
CSR signed by the public CA...
03-30-2020
Yes, you can have multiple VPN pools or you can even use DHCP, this can
be configured statically or ...
03-30-2020
Hi,No you don't necessarily need to have a dedicated VPN concentrator,
large organsiations do for se...
03-30-2020
As it's a public IP address and you are tunnelling all AnyConnect VPN
traffic through the ASA and ba...
03-30-2020
Hi,Yes this is possible, once connected to the VPN you can connect to
your entire internal network.D...
03-30-2020
The source port(s) is going to be random, so don't define it in the ACL
- just define the destinatio...
03-30-2020
Hi,The FMC does not currently provide a lot of session information. You
have 2 options, use RADIUS a...
03-29-2020
In your "nat-list" ACL, you have your deny ACE under the permit, which
basically means the deny is d...
Created by
RJI
in Network Security
03-29-2020
03-29-2020
Hi,You would define the DNS server under the group-policy E.g:-
group-policy RAVPN_GP attributes dns...
03-29-2020
Hi,I imagine the problem is either NAT or ACL.Ensure that traffic from
your VPN Pool to your local L...
03-29-2020
Hi,You should double check your ACL ip access-list extended
WAN-TO-LANpermit icmp any 10.10.20.0 0.0...
03-28-2020
Hi.If DHCP is configured on the tunnel-group then the users that don't
get a static IP address assig...
Created by
RJI
in Software-Defined Access (SD-Access)
03-26-2020
03-26-2020
Hi,I assume the PAN roles are also on your MnT nodes? If so then pxgrid
is probably best enabled on ...
Public Statistics
| Date Registered | 12-05-2010 06:35 AM |
| Date Last Visited | 03-30-2020 08:10 AM |
| Total Messages Posted | 2,913 |
| Total Helpful Votes Received | 3902 |
Helpful Votes Given To
| User | Helpful Count |
|---|---|
| 15 | |
| 5 | |
| 35 | |
| 45 | |
| 5 |
.jpg "VIP Mentor"){kind=icon}
.jpg "Hall of Fame Guru"){kind=icon}
Awards
Cisco Designated VIPs
2019 VPN, Policy and Access, Firewalls
Community Spotlight Award
English Community Member's Choice, January 2020
Community Spotlight Award
English Community Questions Answered, February 2020
