SSL-VPN [secure gateway has rejected the connection] ISR 4461

[nematosama]

We are planning to get remote access connectivity but we are having this issue, currently, we are using Cisco ISR 4661 with a securityk9 evaluation license. after the configuration of the SSL VPN, we get. 

-The router work as a turst ca, and local certificate is created.

-since webvpn commands doesn't appear in the cli we used the crypto ssl options.

boot system bootflash:isr4400v2-universalk9.17.07.01a.SPA.bin

aaa new-model
!
!
aaa authentication login default local
aaa authorization exec default local
aaa authorization network default local
!
!
!

crypto pki server CA
no database archive
issuer-name CN=CA-ISR.mmm.sd
grant auto
!

crypto pki trustpoint LOCAL-CA
enrollment url http://our-puplic-ip:80
serial-number
ip-address our-puplic-ip
revocation-check none
!

crypto ssl proposal ssl-proposal
protection rsa-3des-ede-sha1 rsa-aes128-sha1
!
crypto ssl authorization policy ssl-auth-polict
rekey time 1110
client profile ssl-isr
mtu 1000
module gina
keepalive 500
dpd-interval client 1000
netmask 255.255.255.0
pool SSLVPN_POOL
dns 8.8.8.8
banner SSL-VPN
route set access-list NET
timeout disconnect 10000
!
crypto ssl policy ssl-policy
ssl proposal ssl-proposal
pki trustpoint LOCAL-CA sign
ip address local our-public-ip port 443
!
crypto ssl profile ssl-profile
match policy ssl-policy
aaa authentication user-pass list default
aaa authorization user user-pass list sslvpn
aaa accounting user-pass list sslvpn
authentication remote user-pass
virtual-template 2
!Profile Incomplete (MUST have a policy matched and ssl authorization policy configured)
!
!
crypto vpn anyconnect bootflash:/webvpn/anyconnect-win-4.6.04056-webdeploy-k9.pkg sequence 1
!
crypto vpn anyconnect profile acvpn bootflash:/acvpn.xml
crypto vpn anyconnect profile ssl-isr bootflash:/ssl-isr.xml
!
!
!
interface Loopback0
ip address 172.16.1.1 255.255.255.255
!
interface GigabitEthernet0/0/0.1
description ***ISP***
encapsulation dot1Q xx
ip address 1our-public-ip 255.255.255.240
ip nat outside
crypto map VPN

interface Virtual-Template2 type vpn
ip unnumbered GigabitEthernet0/0/0.1
ip mtu 1400
ip tcp adjust-mss 1300
!
interface Vlan1
no ip address
!
ip local pool SSLVPN_POOL 172.250.250.1 172.250.250.200
no ip http server
no ip http secure-server
ip forward-protocol nd

!
ip access-list extended NET
10 permit ip host 10.10.10.10 any
20 permit ip host 10.20.10.17 any
!
!
!

-when try to connect anyconnect it aaccept the user and the passowrd and then give the pop-up messages. the log of the router show:

*May 17 08:39:06.466: %SSLVPN-5-LOGIN_AUTH_PASSED: vw_ctx: ssl-profile vw_gw: ssl-policy remote_ip: xx.xx.137.32 user_name: syber, Authentication successful, user logged in
*May 17 08:39:15.507: %SSLVPN-5-SESSION_TERMINATE: vw_ctx: ssl-profile vw_gw: ssl-policy remote_ip: xx.xx.137.32 user_name: xxxxx-local-user reason: session expired
*May 17 08:43:30.703: %SSLVPN-5-LOGIN_AUTH_PASSED: vw_ctx: ssl-profile vw_gw: ssl-policy remote_ip: xx.xx.137.32 user_name: xxxxx-local-user, Authentication successful, user logged in
*May 17 08:43:39.812: %SSLVPN-5-SESSION_TERMINATE: vw_ctx: ssl-profile vw_gw: ssl-policy remote_ip: xx.xx.137.32 user_name: xxxxx-local-user reason: session expired
*May 17 08:51:02.179: %SSLVPN-5-LOGIN_AUTH_PASSED: vw_ctx: ssl-profile vw_gw: ssl-policy remote_ip: xx.xx..137.32 user_name: xxxxx-local-user, Authentication successful, user logged in

Anyhelp will be appricated. 

[MHM Cisco World]

https://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/200533-AnyConnect-Configure-Basic-SSLVPN-for-I.html

You need webvpn getaway 

MHM

[nematosama]

All of the commands of webvpn gateway are not available.

[balaji.bandi]

-since webvpn commands doesn't appear in the cli we used the crypto ssl options.

what webvpn commands not found ? can you provide what License you using ?

SSL VPN should work since you are using 17.7 X code .

[nematosama]

All of them, 

webvpn gateway SSLVPN_GATEWAY

webvpn context SSLVPN_CONTEXT

 policy group SSLVPN_POLICY

[nematosama · Accepted solution]

the issue  was solved by editing the ssl profile the authorization part as this,

#crypto ssl profile ssl-profile
#aaa authorization user user-pass list default ssl-auth-polict

https://www.cisco.com/c/en/us/support/docs/security/ios-ssl-vpn/220267-configure-anyconnect-ssl-vpn-for-isr4k-w.html
thanks for helping 

[Mike-Zimmermann]

We would like to change from AnyConnect with IPsec to SSL. Is it ture, that AnyConnect with SSL works only on the hardware platforms ISR 4431, 4451 and 4461? And not for example on ISR 4321 or C8200 router? (With IOS-XE 17.9.x)

[balaji.bandi]

check some information supported :

https://www.cisco.com/c/en/us/support/docs/security/ios-ssl-vpn/220267-configure-anyconnect-ssl-vpn-for-isr4k-w.html

[Mike-Zimmermann]

Thanks for your feedback and the link. I am wondering why this feature is only supported on just these three hardware platforms and not more. Because of DS-Lite we have more and more colleagues who are not able to connect to the branch offices anymore via AnyConnect IPsec. So, "supported" means also that this is not working on other platforms?

[balaji.bandi]

ISR 4321 - sure i remember we ran ipsec on these hardware  (not test RA VPN)

New Cat8k should be supporting if the right license you have and higher version IOS XE

[Mike-Zimmermann]

I think you got me wrong. Yes, AnyConnect with IPsec works with these routers (ISR 4321 / Cat8K), but if you have a DS-Lite connection at home, then it doesn't work.
Only RA VPN SSL works with this technology. So, we would like to change the configuration on our branch routers from RA VPN IPsec to RA VPN SSL, so that our company colleagues which have this DS-Lite connection at home are able to connect to the branch routers.

My question are:

Why are only 3 HW models (4431/4451/4461), like written in the doc, are supported and not more? (Do these models perhaps have a special chip installed that the others don't have?)

"Supported" (like written in the doc) means that this is not working on other platforms, like on a ISR 4321or Cat8K, or just not supported from Cisco in any case of problems?