Hi Marwan!
I've investigated on this matter for some time, and here are the results and the information you need:
Objective: Use the IPhone with Cisco Jabber (ex Cisco Mobile 8.x) connected by VPN automatically.
Requirements
In order to achieve this you need:
1) An Iphone, or Android based phone
2) A Cisco ASA (anyconnect for mobiles is not supported on ISR's)
3) The license Cisco Anyconnect Mobile for ASA (L-ASA-AC-M-55XX). This license is necesary in order to accept ssl vpn connections from mobile devices
4) You should also have SSL VPN Licenses installed on the ASA. For example Essential (L-ASA-AC-E-55XX=)
So, first thing you need is an ASA. The 5505 should be ok (but with the additional licenses i've mentioned above).
Config
In order to achieve a VPN that is automatically connected on demand, and that doesn't ask for "user and pass", you need to config the usage of Certificates for authentication.
Here is the main steps:
1) You need a certificate for the ASA. When you try to connect through an SSL VPN, the ASA "offers" his own Digital Certificate in order to proove his identity. The right way to do it is to buy a certificate from a trusted certificate authority (ex: godaddy). For that kind of certificates you need to pay. So, for testing purpouses, you can also use a self-signed certificate (you can generate it from the ASA directly). The problem with this kind of self-signed certificates is that when you try to connect you will get a warningn saying that the identity cannont be verified, etc
2) For the clients (mobiles) that are going to connect and authenticate with a certificate (remember that you don't want to use user and pass, so the connection is totally automatic and there is no need for the user interaction) you need to generate a certificate. Thus, a certificate authority is needed. That role can be accomplish by the ASA itself, by a Windows Sercer CA, etc.
3) You need to config the SSL VPN on the ASA, with all the usual parameters. The only diference is that you need to config it to authenticate only by certificate
4) You need to install the certificate on the IPhone, install the Anyconnect client on the Iphone and config it
5) In order to use the "autoconnect" feature, you need to specify on the anyconnect client the URL. So when the phone tries to reach that URL the vpn will be connected.
Here is some usefull info:
How to config VPN on demand for Jabber
http://dl.dropbox.com/u/7952696/How%20to%20Configure%20VPN%20On%20Demand%20for%20Jabber.pdf
How to Guide - Cisco ASA SSL VPN using certificates for 2-factor Auth
http://dl.dropbox.com/u/7952696/How%20to%20guide%20-%20Cisco%20ASA%20SSLVPN%20using%20Certificates%
Iphone in business
http://dl.dropbox.com/u/7952696/iPhone%20in%20Business.pdf
And here's the config i used on an ASA5505:
http://dl.dropbox.com/u/7952696/ASA5505_Config_Example.txt
Hope it helps!
Regads,
Martin
20for%202-factor%20Auth.pdf
