Block non-AnyConnect VPN client

[AlexFer]

Hi Experts,

we have a requirement to block all non-AnyConnect RA VPN access, eg. Cisco Legacy VPN client and MacOS & IOS' built-in IPsec VPN clients.

My understanding is that (all?) alternatives use IKEv1, whilst AnyConnect via IPsec uses IKEv2, so, I should be able to remove "ikev1" value from group-policy's "vpn-tunnel-protocol" to effect this.

However, is there a smarter way (perhaps, on tunnel-group level)?

R's, Alex

[marce1000 · Accepted solution]

 - Check if this thread can help you :

           https://community.cisco.com/t5/vpn/block-the-use-off-old-vpn-client/td-p/1403389

 M.

[Rob Ingram]

Hi,

If you are using a RADIUS server for authentication and authorisation, when the client establishes a VPN it sends various attributes to the RADIUS server including the information on the client (AnyConnect or Cisco VPN Client) and protocol (SSL or IPSec), you can then use the RADIUS attribute Cisco-VPN3000·CVPN3000/ASA/PIX7x-Client-Type to make policy decisions.

So you could permit connections from AnyConnect-Client-SSL-VPN or AnyConnect-Client-IPSec-VPN clients and deny all others, or perhaps authorise them differently.

Reference:-

https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/115962-differ-auth-types-asa-ise-00.html

HTH

[AlexFer]

Thank you, both.

Wondering, wouldn’t my proposed solution be equally effective? 

[Rob Ingram]

Sorry your suggestion will work fine. I was giving you an alternative suggestion....so perhaps instead of denying the connection from an older "Cisco VPN Client" you can authorise them differently. You will then have a list of devices that need an upgrade, rather than deny them access.

[AlexFer]

Given 3 solutions - I chose simplest:

hostname(config-group-policy)# vpn-tunnel-protocol ikev2 ssl-client ssl-clientless

BTW, since "client-access-rule" is related to IPsec (IKEv1) connections, this would have been the alternative:

hostname(config-group-policy)# client-access-rule 1 deny type * version *