Solved: Cisco ASA 5505 and comodo SSL certificate

Chris Whiteley · ‎04-29-2013

Hey All,

I am having an issue with setting up the SSL certificate piece of the Cisco AnyConnect VPN. I purchased the certificate and installed it via the ASDM under Configuration > Remote Access VPN > Certificate Management > Identity Certificates. I also placed the CA 2 piece under the CA Certificates. I have http redirect to https and under my browser it is green.

Once the AnyConnect client installs and automatically connects i get no errors or anything. The minute I disconnect and try to reconnect again, I get the "Untrusted VPN Server Certificate!" which isn't true because the connection information is https://vpn.mydomain.com and the SSL Cert is setup as vpn.mydomain.com.

On that note it lists the IP address instead of the vpn.mydomain.com as the untrusted piece of this. Now obviously I don't have the IP address as part of the SSL cert, just the web address. On the web side I have an A record setup to go from vpn.mydomain.com to the IP address of the Cisco ASA.

What am I missing here? I can post config if anyone needs it.

(My Version of ASA Software is 9.0 (2) and ASDM Version 7.1 (2))

Varinder Singh · ‎04-30-2013

Yes that is correct. technically you would require to EKU as server authentication keys which was kinda forced in 3.1 version. But subsequently it was taken away. If you are not getting error using browser and ot comes only with anyconnect client. Most likely you might not have values configured. I can confirm that if you can share the fqdn with me else you can try upgrading and verifying it.

Thanks,

Varinder

Regards, Varinder P.S. Please mark this post as 'Answered' if you find the above information helpful so that it brings goodness to other community users

View solution in original post

Varinder Singh · ‎04-29-2013

Chris,

Have you applied the ssl certifiacte on outside interface. Incase you have not applied here are the commands:

Click Configuration, and then click Device Management.
Expand Advanced, and then expand SSL Settings.
Under Certificates, select the interface that is used to terminate WebVPN sessions.
In this example, the outside interface is used.
Click Edit.
In the Certificate drop-down list, choose the certificate installed in Step 4.
Click OK.
Click Apply.

Alternatilvely you can apply from command prompt:

ssl trust-point my.trustpoint outside
!where my.trustpoint is the name of trust point that you have created.

If you have done the above steps already. WHat do you see in broswer information about the certifiacte. Do you see vpn.mydomain.com in cn value?

Regards,
Varinder

Regards, Varinder P.S. Please mark this post as 'Answered' if you find the above information helpful so that it brings goodness to other community users

Chris Whiteley · ‎04-29-2013

Yes, I have applied the SSL Certificate to the Outside Interface. The cn value is the vpn.mydomain.com.

Varinder Singh · ‎04-29-2013

what is the version of anyconnect? Do you have EKU (extended key usage ) value in your certifiacte? Also Can you post the config of ASA as well?

Varinder

Regards, Varinder P.S. Please mark this post as 'Answered' if you find the above information helpful so that it brings goodness to other community users

Chris Whiteley · ‎04-29-2013

It's AnyConnect version 3.0. I don't know about the EKU piece. I didn't know that was required. I will attach my config.

ASA Version 9.0(2)

!

hostname MyDomain-firewall-1

domain-name MyDomain.com

enable password omitted

xlate per-session deny tcp any4 any4

xlate per-session deny tcp any4 any6

xlate per-session deny tcp any6 any4

xlate per-session deny tcp any6 any6

xlate per-session deny udp any4 any4 eq domain

xlate per-session deny udp any4 any6 eq domain

xlate per-session deny udp any6 any4 eq domain

xlate per-session deny udp any6 any6 eq domain

passwd omitted

names

name 10.0.0.13.1 MyDomain-Inside description MyDomain Inside

name 10.200.0.0 MyDomain_New_IP description MyDomain_New

name 10.100.0.0 MyDomain-Old description Inside_Old

name XXX.XXX.XX.XX Provider description Provider_Wireless

name 10.0.13.2 Cisco_ASA_5505 description Cisco ASA 5505

name 192.168.204.0 Outside_Wireless description Outside Wireless for Guests

ip local pool MyDomain-Employee-Pool 192.168.208.1-192.168.208.254 mask 255.255.255.0

ip local pool MyDomain-Vendor-Pool 192.168.209.1-192.168.209.254 mask 255.255.255.0

!

interface Ethernet0/0

switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

!

interface Ethernet0/4

!

interface Ethernet0/5

!

interface Ethernet0/6

!

interface Ethernet0/7

!

interface Vlan1

nameif inside

security-level 100

ip address Cisco_ASA_5505 255.255.255.0

!

interface Vlan2

nameif outside

security-level 0

ip address Provider 255.255.255.252

!

boot system disk0:/asa902-k8.bin

ftp mode passive

clock timezone PST -8

clock summer-time PDT recurring

dns domain-lookup inside

dns server-group DefaultDNS

name-server 10.0.3.21

domain-name MyDomain.com

object network obj_any

subnet 0.0.0.0 0.0.0.0

object network MyDomain-Employee

subnet 192.168.208.0 255.255.255.0

description MyDomain-Employee

object-group network Inside-all

description All Networks

network-object MyDomain-Old 255.255.254.0

network-object MyDomain_New_IP 255.255.192.0

network-object host MyDomain-Inside

access-list inside_access_in extended permit ip any4 any4

access-list split-tunnel standard permit host 10.0.13.1

pager lines 24

logging enable

logging buffered errors

logging asdm informational

mtu inside 1500

mtu outside 1500

no failover

icmp unreachable rate-limit 1 burst-size 1

asdm image disk0:/asdm-712.bin

no asdm history enable

arp timeout 14400

no arp permit-nonconnected

nat (inside,outside) source static Inside-all Inside-all destination static RVP-Employee RVP-Employee no-proxy-arp route-lookup

!

object network obj_any

nat (inside,outside) dynamic interface

access-group inside_access_in in interface inside

route outside 0.0.0.0 0.0.0.0 XXX.XXX.XX.XX 1

route inside MyDomain-Old 255.255.254.0 MyDomain-Inside 1

route inside MyDomain_New_IP 255.255.192.0 MyDomain-Inside 1

route inside Outside_Wireless 255.255.255.0 MyDomain-Inside 1

timeout xlate 3:00:00

timeout pat-xlate 0:00:30

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

action terminate

dynamic-access-policy-record "Network Access Policy Allow VPN"

description "Must have the Network Access Policy Enabled to get VPN access"

aaa-server LDAP_Group protocol ldap

aaa-server LDAP_Group (inside) host 10.0.3.21

ldap-base-dn ou=MyDomain,dc=MyDomainnet,dc=local

ldap-group-base-dn ou=MyDomain,dc=MyDomainnet,dc=local

ldap-scope subtree

ldap-naming-attribute sAMAccountName

ldap-login-password *****

ldap-login-dn cn=Cisco VPN,ou=Special User Accounts,ou=MyDomain,dc=MyDomainNET,dc=local

server-type microsoft

user-identity default-domain LOCAL

aaa authentication ssh console LOCAL

http server enable

http MyDomain_New_IP 255.255.192.0 inside

http redirect outside 80

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec ikev2 ipsec-proposal DES

protocol esp encryption des