Anyconnect and IPSec on ASA5505

[robert_bukowicki]

hello,

ASA 5505 has only 2 SSL VPN peers and 25 VPN peers. When we connect to our company via AnyConnect I can see that these persons use protocol IKEv2 IPsecOverNatT. so it's suggested that they don't use SSL VPN. But when the third person is trying to connect via AnyConnect, receives information about failied login.

is it possible to set up AnyConnect or on ASA that everyone who is defined on ASA uses only IPsec, not SSL VPN?

I'm using

ASA version: 9.1

ASDM version: 7.1

thanks for your help 

Robert

[Rudy Sanjoko]

What is the error message when they tried to login using AnyConnect? If someone is using AnyConnect, it means that they are using SSL VPN, if you don't want to use SSL VPN because of the license issue, then you can also use VPN client not AnyConnect but you will need to change the VPN configuration on the ASA as well. In short, VPN client is for IPSec VPN and AnyConnect client is for SSL VPN.

[Karsten Iwen · Accepted solution]

For AnyConnect you need an additional license if you want to exceed two concurent users. This is also for IPSec.

You have two choices:

1) Buy the license L-ASA-AC-E-5505= it's about $50)

2) Configure IKEv1 and use the traditional IPSec VPN-Client (EOS/EOL is announced for the Cisco client, but there are many other clients available)

-- 
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni

[robert_bukowicki]

hi Karsten,

if I good understood....it doesn't metter how many licenses of VPNs I have. If I use AnyConnect I have to take into consideration only SSL VPN peers.

thanks

Robert

[Rudy Sanjoko]

I just realized that AnyConnect can also be used for normal IPSec VPN

[robert_bukowicki]

hi Rudy,

so why I couldn't use VPN connection when 2 persons were logged to my company's ASA?

everyone uses AnyConnect and everyone received the same infortmation like on the file below

[Rudy Sanjoko · Accepted solution]

According to Vishnu, Cisco Anyconnect version 3.0 and above support SSL as well as IPSECv2  connection. If you want the user to connect using IPSECv2 from the  Anyconnect client then it will consume the SSL license and not the IPsec  license however if you use IPSECv2 for connections like site to site  vpn then it will consume normal IPSec VPN license. https://supportforums.cisco.com/thread/2149289

hth

[Karsten Iwen · Accepted solution]

I don't really understand what you mean, but for remote-access it's quite simple:

- legacy VPN (IKEv1) is free

- modern VPN (SSL and IKEv2) comes with a fee

-- 
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni