EASY VPN Alternative for SSL VPN

[mmercaldieze]

As of right now I have a bunch of ASA 5505's at users homes connecting to the network using easyvpn. However due to certain issues with the ASA 5506 I am looking to see if there is something better to suite my needs.  I know Palo Alto and Sophos have an option to setup a firewall as a ssl vpn client, which is also a lot more secure as well as no longering using antiquited ipsec technology.  Is there a way to have an ASA or a Router or some other cisco device to act as an Anyconnect client or a SSL VPN client?

[Flavio Miranda]

Hello,

 Sure it is. Here a detailed guide:

https://www.cisco.com/c/en/us/support/docs/security-vpn/webvpn-ssl-vpn/119417-config-asa-00.html

[mmercaldieze]

I am sorry I think you misunderstood, I am looking for a way to do ASA to ASA or Meraki to ASA if the Meraki or ASA at one location has a dynamic wan ip

[GioGonza]

Hello @mmercaldieze,

As per your question, the ASA cannot be SSL VPN Client only Server. The only one that can act as VPN Client is the ASA 5505 and using EzVPN. The rest of the ASAs series can only be servers for either IPSec or SSL connections. 

HTH

Gio

[mmercaldieze]

The problem is the ASA 5505s are no longer getting security updates and the EOL notice has already gone out for them.  Also EASYVPN is based on deprecated technology that is not supported well on the next gen firewalls so it is not really any option anymore

[Karsten Iwen]

There is no SSL-Client, but there are still some options for you. But IPsec is not outdated, most of the time it will provide better security than TLS. But this is more from a theoretical standpoint. What could you do:

1. Use a Meraki MX at the HQ and Meraki MX or Z1/Z3 at the home-offices. This setup will probably be the easiest to implement.
2. The router has many options for VPNs where the client doesn't need a fixed IP. There are VTI/DVTI, DMVPN or FlexVPN. On version 9.7/9.8 the VTI-option is also available on the ASA and can also connect to a router with DVTI.