Folks,
We had some DR testing done withing our network few weeks back. What happened was the Primary site(Dallas) was cutout from the network and applications were made to run from the Backup site(Singapore). One of the observations was that end users were not able to login to the Anyconnect node at the Backup site during this exercise. To give some back ground we have few more site where folks can login to the Anyconnect devices. i.e. Sydney, Frankfurt, Markham etc. Folks could only login to the Anyconnect node which is hosted in Sydney. All other nodes just threw up an error saying "Your certificate is invalid for this selected group".
I am trying to find out what could be the error and here is one of the discrepancy that I see.
1) I went to Configuration --> Remote Access VPN --> Network(Client) Access --> AnyConnect Client Profile.
2) The I select the required Profile on the Right Hand Side view and click on Edit.
3) When the profile window pops up I scroll down to VPN --> Certificate Matching and within that Window I look at the place where we enter the Distinguished name(Max 10).
4) Now the node where the login was working i.e. Sydney nothing is mentioned in the Distinguished Name(Max 10) field.
5) The nodes where this was failing we have mentioned to check the certificate and there is a value mentioned in the Pattern field. The value matches the value of the Primary site only.
Could this be the reason of the failure?
Is there anything else we can look at?
Thanks,
N.
