AnyConnect SSL VPN

[fatalXerror]

Hi guys,

My VPN is using cert based authentication but we just found out that even non-corporate devices can still connect to the VPN by not checking the "Block Untrusted Servers" in the AnyConnect settings. Is it possible to block those non-corporate devices to connect to the VPN by using certificate alone?

Is it possible to block those 3rd party certificate right away?

Thanks

[Marvin Rhoads]

I think you are mixing up the certificate on the server (which is what the check box you mentioned covers) vs. a certificate on the clients.

Certificate-based client authentication requires the actual certificate and private key to be present on the client. While it's possible (in most cases) to copy the client certificate to another device it's much more involved than unchecking a checkbox.

Confirm your authentication type via the command:

     show run tunnel-group

The output should include a subcommand indicating the type of authentication being used.

[balaji.bandi]

Yes, this is possible, But depends on how you configured, check the below configuration to help you.

https://community.cisco.com/t5/security-blogs/anyconnect-certificate-based-authentication/ba-p/3105546

How is the certificate installed to devices, is this pre-defined certificate as part of build ?