cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
343
Views
5
Helpful
5
Replies
Highlighted
Beginner

AnyConnect Certificate Security Warning for ASA IP?

Hi,

We're getting a Security Warning when we try to login with our AnyConnect clients to vpn.domain.com.

The warning shows the IP address of vpn.domain.com instead of the domain-name? We have a valid DigiCert wildcard certificate for *.domain.com installed on the ASA firewall. We've tried with different client versions. We've seen that laptops that are not part of our AD domain, don't get the warning. Any ideas or anyone experienced this before?

warning.png

Best regards,

Peter

1 ACCEPTED SOLUTION

Accepted Solutions
Highlighted
VIP Mentor

So are you manually typing in the FQDN or do you have a pre-configured profile defined and you selecting the VPN from the list? If using a profile double check what is configured.

 

Run a debug on the ASA and run wireshark on the laptop, connect to the VPN tunnel and provide the output here for review.

View solution in original post

5 REPLIES 5
Highlighted
VIP Mentor

Hi @PeterLin09157 

Do the domain joined laptops have the DigiCert Root/Intermediate certificates in the certificate store?

Are these non domain joined computers connecting to the same FQDN and Tunnel-Group as the domain joined computers?

Highlighted

Hi @Rob Ingram 

Thank you for your reply. The domain laptops have the DigiCert root and intermediate certs installed in windows cert store. Also thought of this. The non-domain computers connect to the same FQDN and tunnel-groups.

Best regards,

Peter

Highlighted
VIP Mentor

You've amended your screenshot and typed IP address, are you connecting to the IP address or the FQDN? If you aren't connecting to the FQDN then you would receive and error, use the FQDN of the domain as defined in the certificate.

Highlighted

We're of course using the FQDN to connect. That's why I'm perplexed that the warning states the IP address.

Highlighted
VIP Mentor

So are you manually typing in the FQDN or do you have a pre-configured profile defined and you selecting the VPN from the list? If using a profile double check what is configured.

 

Run a debug on the ASA and run wireshark on the laptop, connect to the VPN tunnel and provide the output here for review.

View solution in original post