cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
882
Views
5
Helpful
2
Replies

Multiple SSL on ASA-5506-X with 9.7

Kerry Kriegel
Beginner
Beginner

 Hi,

 

I have several ASA's with a /28 on a single "outside" interface.

We host individual customer servers, using private addressing, on each inside interface - ifname Company-X

 

We are trying to setup each company with their own AnyConnect client ssl that will be answered by one of the /28 ip addresses.

 

i.e.  vpn.mycompany.com  resolves to w.x.y.1

i.e.  vpn.company-A.com  resolves to w.x.y.3

ie.  vpn.company-B.com  resolves to w.x.y.5

etc.

 

I have seen some posts (circa 2012-14) indicating that this can NOT be done because there is only one ssl per interface.  Others indicate that there are ways that "should work".

 

Has anyone actually done this?

Using what methodology?

 

Any assistance is greatly appreciated.

1 Accepted Solution

Accepted Solutions

You can achieve this using Group-URL, you can match the fqdn used to
connect to vpn server (ASA) and allocate the corresponding group-policy
automatically

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/98580-enable-group-dropdown.html

View solution in original post

2 Replies 2

Karsten Iwen
VIP Mentor VIP Mentor
VIP Mentor

Also today, VPNs are terminated on the outside IP of the ASA. But you can use different FQDNs that point to this same address and also different certificates for each FQDN.

You can achieve this using Group-URL, you can match the fqdn used to
connect to vpn server (ASA) and allocate the corresponding group-policy
automatically

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/98580-enable-group-dropdown.html
Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Recognize Your Peers