Hello,
Cisco is not providing Anyconnect based SSL-VPN on IOS XE, stating IOS XE isn't a "strategic security platform". Aside from this decision annoying customers and administrators likewise, I fail to find a solution for this platform which is easy to implement on the IOS device, easy to deploy on the target platform.
Cisco provides so many Names, like EzVPN, FlexVPN, GetVPN, and more, without an easy to find, comprehensible overview which technology is current, which should no longer be deployed on new scenarios, and wich tchnology is appropriate for which use cases. Hints are well appreciated.
Today I was doing research for hours and hours what to do and came to the conclusion that there is no adequate replacement for SSL-VPN on IOS XE platforms. FlexVPN is immensely complex: To my understanding, a certificate infrastructure is necessary. Certificates expire sooner or later and this has proved to be a nightmare for many small customers. And you need to constantly refresh certificates for end users. A no-go for small shops. Also, the XML file being necessary for parameter passing to the AnyConnect client is annoyingly complex, includes many terms from the Microsoft Windows platform and increases setup complexity even more.
Besides that, it's hard (and unnecessarily expensive) to sell a customer a router for DMVPN-Access to the DC, and and ASA for VPN access.
No wonder people are so delighted about WireGuard!
Questions:
- Is there a "technology" available on IOS XE being equally easy to deploy like the SSL-VPN "server" configuration?
- Is there a "technology" available on IOS XE being equally easy to deploy on the target platforms? Preferably with the AnyConnect Client, users are already accustomed to?
- Is there a "technology" available on IOS XE not requiring cumbersome handling of an XML file, or similar "running-config external" means?
- Is there a "technology" available on IOS XE with decent security, where the OS provided VPN clients for Windows, macOS, Linux, iOS and Android can be used instead of AnyConnect?
- Are certificates mandatory for FlexVPN? Or only for the EAP-Auth part of FlexVPN?
Thank you for your valuable input.
