There are few steps for a solution:
1. For SBL-feature surely is required to enable client certificate authentication on ASA. Command, for WebVPN default-port:
!
ssl certificate-authentication interface OUTSIDE port 443
!
2. Trustpoint, ASA certificate and FQDN of VPN (where the AnyConnect client is connected), must have the identical appropriate FQDN/subject-name parameters, for example:
!
interface Ethernet0/0
nameif OUTSIDE
security-level 0
ip address
!
crypto ca trustpoint TRUSTPOINT-ASA
revocation-check crl none
enrollment url http://:80/certsrv/mscep/mscep.dll
fqdn ..
subject-name cn=,dc=,dc=,o=,l=
ip-address
password *
keypair TRUSTPOINT-ASA
no client-types
!
ssl trust-point TRUSTPOINT-ASA
ssl certificate-authentication interface OUTSIDE port 443
!
ASA# sh crypto ca certificates TRUSTPOINT-ASA
Certificate
Status: Available
Certificate Serial Number: ....
Certificate Usage: General Purpose
Public Key Type: RSA (1024 bits)
Signature Algorithm: SHA1 with RSA Encryption
Issuer Name:
...
Subject Name:
cn=
o=
l=
dc=
dc=
hostname=..
ipaddress=
...
Associated Trustpoints: TRUSTPOINT-ASA
CA Certificate
Status: Available
Certificate Serial Number: ...
Certificate Usage: Signature
Public Key Type: RSA (2048 bits)
Signature Algorithm: SHA1 with RSA Encryption
Issuer Name:
...
3. Using AnyConnect we are connected by FQDN (for example above, ".."), not by IP (otherwise there will be an error, see above).
