AnyConnect V4.7: Management VPN Tunnel

[gaigl]

Hi,

in the release notes of AC 4.7 there is one new feature:

"

Management VPN Tunnel—(Requires ASDM 7.10.1) Ensures connectivity to the corporate network whenever the client system is powered up, not just when a VPN connection is established by the end user.

This feature allows patch management on systems which may not come in to the office frequently. Endpoint OS login scripts requiring corporate network connectivity will also benefit from this feature."

has anyone tried this and can tell me how to test it?

I can't see the menue to activate (I've got all the requirements)

thanks

karl

[ccubeman]

Configuration details start on page 125 at: https://www.cisco.com/c/en/us/td/docs/security/vpn_client/anyconnect/anyconnect47/administration/guide/b_AnyConnect_Administrator_Guide_4-7.pdf

Works pretty well.  It only uses machine certificates, so no LDAP/radius/local/client cert auth.

[rmfalconer]

I've followed the instructions in this guide but it's not quite working. I do see my client attempt to connect prior to Windows login but the SSL sessions terminates immediately.

We use machine certs for VPN so the cert is present on the endpoint.

Is there something not included in this document that needs to be completed before the management tunnel works?

[Barrett Cowan]

It definitely takes quite a bit more then just "activating it". Check out my guide to learn how to configure it. It can be used with the local ASA CA as well, but I haven't wrote the guide yet, more to come ...

https://technook.home.blog/2019/07/11/cisco-anyconnect-managent-vpn-tunnel-microsoft-ca/

[tiwang]

hi out there

If one has multiple xml-profiles avalibly - which management vpn tunnel is tied to this - will there only be one avalibly or how is this sorted out? We have 4 different regions where we have 4 different XML profiles which we manually select from - currently. 

[Barrett Cowan]

The management tunnel isn't tied to any user tunnel, it just becomes active when no user tunnel is connected. Only one management tunnel can be configured at a time.