How do I create a SSL VPN with a Cisco 881

jsandau · ‎05-16-2014

I want to create a SSL VPN on a cisco 881 (version 15.4) that will work with the anyconnect client. I try to upload the anyconnect-win-3.1.05160-k9.pkg and install it but I get the error "You have entered an invalid full tunnel client package. Please specify a valid file". I have a feeling that this version of annyconnect isn't compatible with version 15.4 of the 881, but I don't have a support contract to upgrade the 881 to the latest version.

What version of anyconnect should I be using?

Also when I set up an SSL vpn on an ASA 5510 a few years ago I remember I needed to buy an extra license so that anyconnect would work with the ASA, do I still need to do this for the 881?

Thanks.

Marvin Rhoads · ‎05-16-2014

So you've copied the pkg file and are trying to use the "crypto vpn anyconnect <filename>" command?

That is supported from 15.2(1)T per the command reference.

The IOS SSL VPN is generally used in clientless mode which requires both the SEC and SSLVPN feature license on the ISR G2 family. That doesn't require AnyConnect.

An IKEv2 IPsec VPN can be used with AnyConnect. I believe the SEC license suffices in that case.

jsandau · ‎05-16-2014

I'm using CCP to upload and install the package, that's when I get the error message.

The licenses I have installed on the 881 are:

Advipservices

Advsecurity

The advsecurity license states that it is not deployed and that it is active, but not in use.

Are these licenses enough to do what I want?

Do I even need to install the .pkg file is the clients who will be using the VPN already have the any connect client software installed on them?

Marvin Rhoads · ‎05-16-2014

CCP lags behind what you can do with the ISR G2. Also, they only build in the most commonly deployed scenarios. AnyConnect client-based IPsec VPN is not among the CCP-supported configurations.

For AnyConnect SSL VPN, CCP should give you an indicator as to whether or not your router supports AnyConnect, you should be able to add packages via the Configure > Security > VPN > SSL VPN > Packages screen. as you note, deploying the package from the router is not required. They can be manually deployed or sent out separately via a 3rd party software delivery tool.

jsandau · ‎05-16-2014

I won't bother with trying to upload the package then. All the clients who will be using it already have annyconnect installed on their computers.

I went ahead and created the SSL VPN but I couldn't connect. Here is my config:

Building configuration...

Current configuration : 10075 bytes

!

! Last configuration change at 18:58:18 UTC Fri May 16 2014 by admin

!

version 15.4

no service pad

service timestamps debug datetime msec

service timestamps log datetime msec

no service password-encryption

!

hostname Cisco881

!

boot-start-marker

boot-end-marker

!

logging buffered 51200 warnings

!

aaa new-model

!

aaa authentication login default local

aaa authentication login ciscocp_vpn_xauth_ml_1 local

aaa authentication login ciscocp_vpn_xauth_ml_2 local

aaa authorization exec default local

aaa authorization network ciscocp_vpn_group_ml_1 local

!

aaa session-id common

memory-size iomem 10

!

crypto pki trustpoint TP-self-signed-350405548

enrollment selfsigned

subject-name cn=IOS-Self-Signed-Certificate-350405548

revocation-check none

rsakeypair TP-self-signed-350405548

!

crypto pki certificate chain TP-self-signed-350405548

certificate self-signed 01

30820229 30820192 A0030201 02020101 300D0609 2A864886 F70D0101 05050030

30312E30 2C060355 04031325 494F532D 53656C66 2D536967 6E65642D 43657274

69666963 6174652D 33353034 30353534 38301E17 0D313430 34303632 32313534

325A170D 32303031 30313030 30303030 5A303031 2E302C06 03550403 1325494F

532D5365 6C662D53 69676E65 642D4365 72746966 69636174 652D3335 30343035

35343830 819F300D 06092A86 4886F70D 01010105 0003818D 00308189 02818100

96BD1C8D 19D75452 CC1AA424 8B2E02F6 90B3DD06 7AF25293 E31BE71D E5D178D1

8B52CC44 60859F76 6B1CCA7C 99DC5C99 31C3F0F9 7F561620 BBCA5F1A CF7AE4E2

65062E3E 458F2883 7E738649 5F9B44FF 109AB9D8 4A708DD1 60943813 EA1889E1

9839AE0A 96BB78AC 68D87FC8 46D171F3 B266DE5C C52DD80C AD470F7C 9296E91D

02030100 01A35330 51300F06 03551D13 0101FF04 05300301 01FF301F 0603551D

23041830 16801426 8F229D22 43E6574C DA95AE99 932C0F05 81395430 1D060355

1D0E0416 0414268F 229D2243 E6574CDA 95AE9993 2C0F0581 3954300D 06092A86

4886F70D 01010505 00038181 00399765 8803B99F B8F1889A 7B59989E 4432296D

3505CB8C 0E3D1659 5198E653 E2A35C77 6DB46CC9 63BB12AA 9B8B1023 97B770EE

E48D3635 C344EDC8 BBD018DE 42708920 7AFDEF84 5EF9BB47 8855B6FE CB41588C

BEF59FC3 134179CB 837D5846 702E0394 2B139C6F 2239CFE5 CA6FF509 6DCFA4CA

015BD765 C5A9ABB4 0B20B721 2D

quit

!

ip dhcp excluded-address 10.10.10.1

!

no ip domain lookup

ip domain name

ip cef

no ipv6 cef

!

multilink bundle-name authenticated

license udi pid CISCO881-SEC-K9 sn FGL171923S0

!

username **** privilege 15 secret 4 lYvhHsFV7A5BvGuqvsNLuxtcA5voCJ5VRI2GIs3zEbU

username ***** secret 5 $1$/IF.$/CArlmMtxGo7qUAmqsMdO0

!

no cdp run

!

class-map type inspect match-all CCP_SSLVPN

match access-group name SDM_IP

class-map type inspect match-any SDM_AH

match access-group name SDM_AH

class-map type inspect match-any ccp-skinny-inspect

match protocol skinny

class-map type inspect match-any SDM_IP

match access-group name SDM_IP

class-map type inspect match-any SDM_WEBVPN

match access-group name SDM_WEBVPN

class-map type inspect match-any ccp-h323nxg-inspect

match protocol h323-nxg

class-map type inspect match-any ccp-cls-icmp-access

match protocol icmp

match protocol tcp

match protocol udp

class-map type inspect match-any ccp-h225ras-inspect

match protocol h225ras

class-map type inspect match-any SDM_ESP

match access-group name SDM_ESP

class-map type inspect match-any ccp-h323annexe-inspect

match protocol h323-annexe

class-map type inspect match-any ccp-cls-insp-traffic

match protocol dns

match protocol ftp

match protocol https

match protocol icmp

match protocol imap

match protocol pop3

match protocol netshow

match protocol shell

match protocol realmedia

match protocol rtsp

match protocol smtp

match protocol sql-net

match protocol streamworks

match protocol tftp

match protocol vdolive

match protocol tcp

match protocol udp

class-map type inspect match-any ccp-h323-inspect

match protocol h323

class-map type inspect match-all ccp-invalid-src

match access-group 100

class-map type inspect match-any ccp-sip-inspect

match protocol sip

class-map type inspect match-all ccp-protocol-http

match protocol http

class-map type inspect match-all SDM_WEBVPN_TRAFFIC

match class-map SDM_WEBVPN

match access-group 101

class-map type inspect match-all ccp-insp-traffic

match class-map ccp-cls-insp-traffic

class-map type inspect match-any SDM_EASY_VPN_SERVER_TRAFFIC

match protocol isakmp

match protocol ipsec-msft

match class-map SDM_AH

match class-map SDM_ESP

class-map type inspect match-all ccp-icmp-access

match class-map ccp-cls-icmp-access

class-map type inspect match-all SDM_EASY_VPN_SERVER_PT

match class-map SDM_EASY_VPN_SERVER_TRAFFIC

!

policy-map type inspect ccp-inspect

class type inspect ccp-invalid-src

drop log

class type inspect ccp-protocol-http

inspect

class type inspect ccp-insp-traffic

inspect

class type inspect ccp-h323-inspect

inspect

class class-default

drop

policy-map type inspect sdm-permit-ip

class type inspect SDM_IP

pass

class class-default

drop log

policy-map type inspect ccp-permit

class type inspect SDM_WEBVPN_TRAFFIC

inspect

class type inspect SDM_EASY_VPN_SERVER_PT

pass

class class-default

drop

policy-map type inspect ccp-sslvpn-pol

class type inspect CCP_SSLVPN

pass

class class-default

drop

policy-map type inspect ccp-permit-icmpreply

class type inspect ccp-icmp-access

inspect

class class-default

pass

!

zone security in-zone

zone security ezvpn-zone

zone security out-zone

zone security sslvpn-zone

zone-pair security sdm-zp-in-ezvpn1 source in-zone destination ezvpn-zone

service-policy type inspect sdm-permit-ip

zone-pair security ccp-zp-out-self source out-zone destination self

service-policy type inspect ccp-permit

zone-pair security sdm-zp-out-ezpn1 source out-zone destination ezvpn-zone

service-policy type inspect sdm-permit-ip

zone-pair security ccp-zp-self-out source self destination out-zone

service-policy type inspect ccp-permit-icmpreply

zone-pair security sdm-zp-ezvpn-in1 source ezvpn-zone destination in-zone

service-policy type inspect sdm-permit-ip

zone-pair security ccp-zp-in-out source in-zone destination out-zone

service-policy type inspect ccp-inspect

zone-pair security sdm-zp-ezvpn-out1 source ezvpn-zone destination out-zone

service-policy type inspect sdm-permit-ip

zone-pair security zp-out-zone-sslvpn-zone source out-zone destination sslvpn-zone