Cisco AnyConnect Display Name

[a.amin@csm-compressor.com]

Hello There,

When I am trying to access cisco anyconnect via Display Name, it gives me a certificate is not trusted error.

Trusted certificate is already installed. but when I try to access by fqdn  "vpn.abc.com" it works without certificate error.

Can anyone help me out for this situation?

Thanks

Ankit 

[Francesco Molino]

Hi

When talking about display name you mean a local alias?
Can you explain a bit more please?

If your certificate has been signed/generated for vpn.abc.com and this isn't a wildcard certificate and you try to access using vpnabc (which redirect to an ip or something) it's normal that you're getting certificate not trusted.

That's why i'm asking please to some clarity on your connection process to make sure i can give you the correct answer.

[a.amin@csm-compressor.com]

Thanks for your reply.

I have attached image about display name.

The certificate we have got from geotrust.

when you connect anyconenct very first time with vpn.abc.com, the Anyconnect connection profile downloads on the computer and when you connect next time you can connect through display name. and we got certificate error message.

Thank you

Ankit

[stsargen]

Hi Ankit,

Could you post a screenshot of the error you are seeing.  AnyConenct has two possible dialogs that cna show up.  One for untrusted certificate because you don't have the proper chain installed on the client and the other is for a possible mismatch of servername on the identity cert compared to what is in the profile.

The entry (IP or FQDN) in the SAN field of your Identity certificate configured on the ASA must match what is in your profile under the "HostAddress" field for the Display Name you are connecting to.  AnyConnect will use the Display Name you entered and match it to the "HostName" field in the profile.

<HostEntry>
<HostName>VPN Displayname</HostName>  This is the "Display Name"
<HostAddress>foo.bar.com</HostAddress>  If this value doesn't match the SAN field of you ASA cert then you will get the untrusted message.

My guess is that one has the FQDN and the other has the IP address.

Hope this helps

Steve S.

[a.amin@csm-compressor.com]

Hello

Sorry for late reply.

It started working on Laptops without security warning. ( without disabling block connections to untrusted servers on anyconnect client software)

Now the problem is, it is still giving me an error on Cell phones and Macbook only. I have attached error image.

If i disabled Block connection to untrusted servers, it works but we don't want to do that.

Thanks

Ankit

[Francesco Molino]

Can you open the fqdn using your Internet browser and check the certificate. Can you share the certificate to see if it's a valid one with the full chain to be seen as trusted one.

You can also use openssl to view the certificate with the following command:
openssl s_client -connect vpn.xxxx.com:443

[a.amin@csm-compressor.com]

I can not send you private message so I am sending my main profile here

<?xml version="1.0" encoding="UTF-8"?>
<AnyConnectProfile xmlns="http://schemas.xmlsoap.org/encoding/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://schemas.xmlsoap.org/encoding/ AnyConnectProfile.xsd">
<ClientInitialization>
<UseStartBeforeLogon UserControllable="true">true</UseStartBeforeLogon>
<AutomaticCertSelection UserControllable="true">false</AutomaticCertSelection>
<ShowPreConnectMessage>false</ShowPreConnectMessage>
<CertificateStore>All</CertificateStore>
<CertificateStoreMac>All</CertificateStoreMac>
<CertificateStoreOverride>false</CertificateStoreOverride>
<ProxySettings>Native</ProxySettings>
<AllowLocalProxyConnections>true</AllowLocalProxyConnections>
<AuthenticationTimeout>30</AuthenticationTimeout>
<AutoConnectOnStart UserControllable="true">false</AutoConnectOnStart>
<MinimizeOnConnect UserControllable="true">true</MinimizeOnConnect>
<LocalLanAccess UserControllable="true">true</LocalLanAccess>
<DisableCaptivePortalDetection UserControllable="true">false</DisableCaptivePortalDetection>
<ClearSmartcardPin UserControllable="true">true</ClearSmartcardPin>
<IPProtocolSupport>IPv4</IPProtocolSupport>
<AutoReconnect UserControllable="true">true
<AutoReconnectBehavior UserControllable="true">ReconnectAfterResume</AutoReconnectBehavior>
</AutoReconnect>
<SuspendOnConnectedStandby>false</SuspendOnConnectedStandby>
<AutoUpdate UserControllable="false">true</AutoUpdate>
<RSASecurIDIntegration UserControllable="false">Automatic</RSASecurIDIntegration>
<WindowsLogonEnforcement>SingleLocalLogon</WindowsLogonEnforcement>
<LinuxLogonEnforcement>SingleLocalLogon</LinuxLogonEnforcement>
<WindowsVPNEstablishment>LocalUsersOnly</WindowsVPNEstablishment>
<LinuxVPNEstablishment>LocalUsersOnly</LinuxVPNEstablishment>
<AutomaticVPNPolicy>false</AutomaticVPNPolicy>
<PPPExclusion UserControllable="false">Disable
<PPPExclusionServerIP UserControllable="false"></PPPExclusionServerIP>
</PPPExclusion>
<EnableScripting UserControllable="false">false</EnableScripting>
<EnableAutomaticServerSelection UserControllable="false">false
<AutoServerSelectionImprovement>20</AutoServerSelectionImprovement>
<AutoServerSelectionSuspendTime>4</AutoServerSelectionSuspendTime>
</EnableAutomaticServerSelection>
<RetainVpnOnLogoff>true
<UserEnforcement>SameUserOnly</UserEnforcement>
</RetainVpnOnLogoff>
<CaptivePortalRemediationBrowserFailover>false</CaptivePortalRemediationBrowserFailover>
<AllowManualHostInput>true</AllowManualHostInput>
</ClientInitialization>
<ServerList>
<HostEntry>
<HostName>CSM Edmonton</HostName>
<HostAddress>vpn.csm-compressor.com</HostAddress>
<UserGroup>Staff/</UserGroup>
<PrimaryProtocol>IPsec
<StandardAuthenticationOnly>true
<AuthMethodDuringIKENegotiation>EAP-AnyConnect</AuthMethodDuringIKENegotiation>
</StandardAuthenticationOnly>
</PrimaryProtocol>
</HostEntry>
</ServerList>
</AnyConnectProfile>

[Francesco Molino]

I replied to your PM with an xml file to test and when it'll work we'll post here the solution that will help others

[a.amin@csm-compressor.com]

Hello Francesco,

Sorry I was busy with some other stuff. I will try ASAP and will you let you know.

Thanks for your help.