Anyconnect with automatic Active Directory credentials authentification

[sam cook]

Hi,

I need to setup a new Anyconnect configuration with automatic Active Directory credentials authentification.

The purpose is that Anyconnect will be launched automatically with windows start and detect if the user is outside corporate network and connect remote VPN automatically using Active Directory credentials.

After some reserachers I found that I need to use : "Start VPN when AnyConnect is started" and "Trusted Network Detection"option .

But I still did not find how to enable automatic Active Directory credentials authentification.

Any help please ?

[Mohammed al Baqari]

This can be done only using certificate authentication. Auto connection
won't work with AAA authentication.

What you can do is to have SCEP proxy with tunnel-group for users to enroll
and get certificates 1st time they connect. Then you have another
tunnel-group with certificate map that matches users connecting based on
CA-Name, for example, and accept their connections.

[sam cook]

Hi @Mohammed al Baqari

Thank you for your help, so if I have well understood. First time , user need to manually login using his AD credentials, and then ASA will generate a certificate that wil be stored on the user machine and then used automatically at each VPn  start ?

[Mohammed al Baqari]

Thanks is correct in case you decided to go with my suggested solution.

2 x Tunnel Groups

tunnel-group 1 (one time use only when connecting 1st time)
*****************************
* AAA authentication
* SCEP proxy pointing to CA server to enroll users based in AD username
used for login to VPN

tunnel-group 2
*****************************
* Certificate authentication
* certificate-map matches certificates issues from test-lab ca server (or
any other attribute) and authenticate users.

This with TND and alway-on-VPN option or start vpn with client start
(depending on what you want) will give seemless experience to users with vpn

[sam cook]

SCEP proxy pointing to CA server to enroll users based in AD username
used for login to VPN ==> CA server is my AD server ?

Certificate-map matches certificates issues from test-lab ca server (or
any other attribute) and authenticate users. ==> what's test-lab ca server ?

[Mohammed al Baqari]

CA is a ca server not AD server (you can have both roles in same server).

Test-lab is a dummy name I suggested for ca