Anyconnect TLS 1.3 browser error

[BorislavPenchev0962]

Hello,

we use SSL VPN with Anyconnect VPN Client. Service runs on Cisco3945E Router.

to load the VPN Client a Website should be opened, ex. https://shave.systems.at/khstp,then comes the Downloadlink.
we noticed that newer Browser versions does not show the Website as TLS Version 1.2 is outdated and Version 1.3 is requested;
we could not find how to enable TLS 1.3 on Router?

Chrome reports: err_ssl_version_or_cipher_mismatch

when we test with Internet Explorer 21H2 access is ok, but with newer browser version does not work:

eg. FF 100, Edge etc

Regards

[balaji.bandi]

Cisco3945E Router

going to be End of Life soon, what IOS code running on this router, as per i know with the information, the current version of code not support, try OLD browsers and test is that works, then enable 1.2 support in the browser and test it.

[BorislavPenchev0962]

with TLS 1.2 works for this Router Cisco 3945E

current IOS 15.7(3)M8

#sh ip http server secure status

HTTP secure server TLS version:  TLSv1.2 TLSv1.1 TLSv1.0

as router does not show TLSv1.3 we get the error on the Website;

 browsers are TLS1.3 compatible, but not sure for router;

[BorislavPenchev0962]

where can we check TLSv1.3 compatibility with ASR1001  as we will move eventually to this platform in future;

[Rob Ingram · Accepted solution]

@BorislavPenchev0962

A Cisco router is not the idea platform for a SSL-VPN, if using a router for a Remote Access VPN then the recommended solution is FlexVPN, which utilises IKEv2/IPSec - TLS support would not be required.

Though the ideal Cisco platform for Remote Access VPN is the FTD or to a lesser extent the ASA, you can then run TLS or IKEv2/IPSec.

[BorislavPenchev0962 · Accepted solution]

some details we got on this case:

TLS version 1.3 is introduced in IOS XE 17.8.1, as per the following link:
https://community.cisco.com/t5/networking-blogs/what-s-new-ios-xe-17-8-routing-release-update/ba-p/4601982

Besides that, I suggest you take a look at the Catalyst 8500 family, as this family is the next generation of the fixed ASR1k family, providing better performance and scale: https://www.cisco.com/c/en/us/products/collateral/routers/catalyst-8500-series-edge-platforms/datasheet-c78-744089.html

in case this is for SSL VPN use ? I say so because it seems TLS 1.3 will be supported only on C8000v, not any hardware-based platform.