Cisco Anyconnect Central Manager

[network_geek1979]

Folks,

Does anyone know if we have a Cisco Anyconnect central manager? From what I understand we do not have one.

My use case is that we have had few Anyconnect nodes across the globe and managing the configuration to keep it same everywhere does become a challenge.

Are there any other recommendations anyone has?

Regards,

N.

[Francesco Molino]

Hi

What do you mean by keeping anyconnect configuration the same?

Are you talking about the xml profile itself or the VPN configuration on the FW ?

There’s no Central Manager as per say.

[network_geek1979]

Hi Francesco,

Thanks for the response, I meant the xml profile and the VPN configuration both.

sample use cases are: ensuring that all nodes have the same profile, the ACL name remain the same, the ACL gets applied to the same profile everywhere etc.

I am hearing about CDO(Cisco Defense Orchestrator) and wondering if that would be the correct fit here. I feel it should.

Regards!!

N.

[Marvin Rhoads]

Yes, CDO can centrally manage your ASAs' configurations, including the files (xml profile etc.) stored on them.

https://docs.defenseorchestrator.com/Configuration_Guides/ASA_File_Management

You can also use ISE to manage multiple ASAs' VPN profiles (but not the rest of the ASAs' configurations).

[network_geek1979]

Hi Marvin,

Many thanks.

I did not understand the part:

"You can also use ISE to manage multiple ASAs' VPN profiles (but not the rest of the ASAs' configurations)."

By VPN profiles, you mean specifically AnyConnect profiles, right? If yes, Can you provide me some links for this as well on how we can do this? I'll search for this as well.

Our use case is for the VPN profiles only. We want to ensure that configuration for one profile remains same on all the nodes.

i.e. the ACL, the associated policies etc.

Regards,

N!!!

[Francesco Molino · Accepted solution]

Hi 

You can setup your VPN access on all boxes the same way and authenticate all your users on ISE. So based on their AD group membership, ASA location, you can push different ACLs that are managed in 1 central place (ISE).

So your XML profiles will be quite the same except the url of the ASA that will  change.

Is it something like that you want to do?

[network_geek1979]

Hi Francesco,

Do you have a detailed document I can refer to? I did not quite understand the meaning of "url of the ASA that will change".

Regards,

N!