SSL VPN Anyconnect

[Peter Miller]

Hey all I am attempting to get an SSL-VPN working for my home router and not getting much success.  When I attempt to connect it errors saying, No valid certificates available for authentication.  Attached is my config and version information for review.  Any help would be a tremendous help.

Thank you,
Andy

[Marvin Rhoads]

You have an authentication list defined:

aaa authentication login ciscocp_vpn_xauth_ml_1 local

Now you need to call it out in the webvpn context section:

aaa authentication list ciscocp_vpn_xauth_ml_1

See this guide (specifically section 4.3) for more details.

[Peter Miller]

Hey Marvin,

I have changed it to aaa authentication login ssl_global local and applied still no change the web context to aaa authentication login ssl_global and still the same results.  I am afraid I am missing something.

[pjain2]

did you do "no inservice" under the webvpn gateway and the policy and then try again; also the cert that you are using, can you try and generate it using a 2048 RSA key pair and check if that works for you

[Peter Miller]

I put both the gateway and the policy out of service with the no inservice command and regenerated my RSA cert and still no success.

[pjain2]

can you send the below output:

debug crypto pki transactions

debug crypto pki messages

debug crypto validation

[Peter Miller]

I turned on those debugs and attempted several connections and still nothing.  I turned on term mon as I am over SSH.  Am I missing something or am I not even triggering these events?

[pjain2]

can you try accessing the url from the browser and see what happens.

also please add the following config:

webvpn gateway SSL-VPN-GW

 ip address <> port 443 

[Peter Miller]

I added that line to the webvpn gateway and still nothing from normal methods.  I also do not have a working URL setup for this.

[pjain2]

you just have to access the router from the browser using the ip address:

https://<ip address>

[Peter Miller]

When I did that, I get a usual chrome screen showing its a cert site and then I accept it and get this:

No data received

ERR_EMPTY_RESPONSE

[pjain2]

can you try the same from internet explorer and see what happens