CONFIGURING CISCO SSL VPN ANYCONNECT (WEBVPN) ON CISCO IOS ROUTERS ( 8

[2D-Technology Services]

Hi Community members.,

I am encountering difficulties trying to setup Cisco AnyConnect VPN on Cisco 891F/K9 router.

Firstly to Generate the  self signed certificate on cisco router has not worked

My IOS version is as follows: c800-universalk9-mz.SPA.154-3.M3.bin

Please can anyone help with the solutions 

Thanks

[MHM Cisco World]

https://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/200533-AnyConnect-Configure-Basic-SSLVPN-for-I.html

[2D-Technology Services]

The suggested site did not solve my issues as i keep getting the following errors::

HQ_VPN_ROUTER(config)#crypto pki enroll SSLVPN_CERT
% Include the router serial number in the subject name? [yes/no]: no
% Include an IP address in the subject name? [no]: no
Generate Self Signed Router Certificate? [yes/no]: yes
% Attempt to request a certificate failed: status = FAIL

[MHM Cisco World]

can you share full config of router.

[2D-Technology Services]

Router#
Router#sh run
Building configuration...

Current configuration : 1919 bytes
!
! Last configuration change at 07:09:29 UTC Wed Jul 6 2022
!
version 15.4
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router
!
boot-start-marker
boot system flash:c800-universalk9-mz.SPA.154-3.M3.bin
boot-end-marker
!
aqm-register-fnf
!
!
no aaa new-model
!
crypto pki trustpoint my-trustpoint
enrollment selfsigned
subject-name CN=firewallcx-certificate
revocation-check crl
rsakeypair my-rsa-keys
!
!
crypto pki certificate chain my-trustpoint
!
!
!
!
!
!
!
!

!
!
!
!
no ip domain lookup
ip domain name funmistore.com
ip cef
no ipv6 cef
!
!
!
!
!
multilink bundle-name authenticated
!
!
!
!
!
!
!
!
cts logging verbose
license udi pid C891F-K9 sn FCZ194192EE
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
interface BRI0
no ip address
encapsulation hdlc
shutdown
isdn termination multidrop
!
interface FastEthernet0
no ip address
shutdown
duplex auto
speed auto
!
interface GigabitEthernet0
no ip address
!
interface GigabitEthernet1
no ip address
!
interface GigabitEthernet2
no ip address
!
interface GigabitEthernet3
no ip address
!
interface GigabitEthernet4
no ip address
!
interface GigabitEthernet5
no ip address
!
interface GigabitEthernet6
no ip address
!
interface GigabitEthernet7
no ip address
!
interface GigabitEthernet8
ip address dhcp
duplex auto
speed auto
!
interface Vlan1
no ip address
!
interface Async3
no ip address
encapsulation slip
!
ip forward-protocol nd
no ip http server
no ip http secure-server
!
!
!
!
!
control-plane
!
!
mgcp behavior rsip-range tgcp-only
mgcp behavior comedia-role none
mgcp behavior comedia-check-media-src disable
mgcp behavior comedia-sdp-force disable
!
mgcp profile default
!
!
!
!
!
!
!
line con 0
no modem enable
line aux 0
line 3
modem InOut
speed 115200
flowcontrol hardware
line vty 0 4
login
transport input all
!
scheduler allocate 20000 1000
!
!
!
end

[Mohammed al Baqari]

Hi,

Can you remove or disable revocation check, configure ntp and retry? If it
doesn't work, share the output of debug crypto pki.

**** please remember to rate useful posts

[2D-Technology Services]

Same result even after configuring NTP:

outer(config)#crypto pki trustpoint my-trustpoint
Router(ca-trustpoint)#enrollment selfsigned
Router(ca-trustpoint)#subject-name CN=firewallcx-certificate
Router(ca-trustpoint)#rsakeypair my-rsa-keys
Router(ca-trustpoint)#
Router(ca-trustpoint)#
Router(ca-trustpoint)#
Router(ca-trustpoint)#exit
Router(config)#
Router(config)#
Router(config)#
Router(config)#crypto pki enroll my-trustpoint
% Include the router serial number in the subject name? [yes/no]: no
% Include an IP address in the subject name? [no]: no
Generate Self Signed Router Certificate? [yes/no]: yes
% Attempt to request a certificate failed: status = FAIL

%%%%%%%%%%%%%%%%%%%%%%%

Jul 6 07:06:18.335: %SSH-5-ENABLED: SSH 1.99 has been enabled
*Jul 6 07:07:36.355: %SYS-5-CONFIG_I: Configured from console by console
*Jul 6 07:09:29.539: %SYS-5-CONFIG_I: Configured from console by console
*Jul 6 07:23:39.107: %SYS-5-CONFIG_I: Configured from console by console
*Jul 6 12:11:56.470: %CRYPTO-6-AUTOGEN: Generated new 768 bit key pair
Jul 7 20:51:59.407: %SYS-5-CONFIG_I: Configured from console by console
Jul 7 20:55:03.099: %SYS-5-CONFIG_I: Configured from console by console
Jul 7 20:58:17.992: CRYPTO_PKI: using private key my-rsa-keys for enrollment
Jul 7 20:58:17.992: ../cert-c/source/certobj.c(535) : E_VALIDITY : validity period start later than end
Jul 7 20:59:35.957: %SYS-5-CONFIG_I: Configured from console by console
Jul 7 20:59:35.957: CRYPTO_PKI: Initializing renewal timers
Router#

[MHM Cisco World]

subject-name CN=firewallcx-certificate<<- 

please add FQDN to certificate.

[2D-Technology Services]

Still the same  result:

Router(config)#crypto pki trustpoint my-trustpoint
Router(ca-trustpoint)#enrollment selfsigned
Router(ca-trustpoint)#subject-name CN=firewallcx-certificate.funmistores.com
Router(ca-trustpoint)#rsakeypair my-rsa-keys
Router(ca-trustpoint)#
Router(ca-trustpoint)#
Router(ca-trustpoint)#
Router(ca-trustpoint)#
Router(ca-trustpoint)#
Router(ca-trustpoint)#
Router(ca-trustpoint)#
Router(ca-trustpoint)#
Router(ca-trustpoint)#
Router(ca-trustpoint)#
Router(ca-trustpoint)#
Router(ca-trustpoint)#
Router(ca-trustpoint)#crypto pki enroll my-trustpoint
% Include the router serial number in the subject name? [yes/no]: no
% Include an IP address in the subject name? [no]: no
Generate Self Signed Router Certificate? [yes/no]: yes
% Attempt to request a certificate failed: status = FAIL

Router(config)#
Jul 8 11:20:15.910: CRYPTO_PKI: using private key my-rsa-keys for enrollment
Jul 8 11:20:15.910: ../cert-c/source/certobj.c(535) : E_VALIDITY : validity period start later than end

[2D-Technology Services]

No result still.

[MHM Cisco World]

sorry I will make deep look tonight ,

sorry again.