What does deploying AnyConnect look like?

[AxelAxel]

Right now, we are using Azure p2s VPN within the virtual network. I am running into so many issues because of it so I wanted to look into using AnyConnect, which I used at our last job. It seems a lot more solid than this Azure P2S stuff, plus I can configure who has access to what. 

My question is, what does it look like to deploy this? We don't have an "on-prem" data center, we are purely in Azure with all remote laptops.  I have looked at pricing on CDW's site, and it looks surprisingly reasonable. My question is, what does the server look like? Is it a physical appliance? Can it run as a VM? Can it be hosted in Azure? Is it just an install on Windows? Do you have to purchase other licenses to run an AnyConnect "server" or do you only need the one license? We do not have anything cisco currently if that makes a difference. I am just wanted to deploy Cisco AnyConnect and nothing else right now.

[Milos_Jovanovic · Accepted solution]

Hi @AxelAxel,

If you would like to run AnyConnect inside Azure, then yes, it is possible. You would need to deploy ASA or FTD in Azure (like VM appliance from Azure Marketplace), and once you successfully deploy it, it is more-less like standard ASA/FTD deployment with AnyConnect - you would need to deploy certificate, AAA servers, policies, etc. I know about BYOL concept, and not sure if there is any other. However, please bare in mind that in Azure different concepts apply given that there is no L2 concept, so standard HA is not working there, but HA is achieved via LB.

Kind regards,

Milos

[AxelAxel]

Thanks for that @Milos_Jovanovic ! My follow up question would be I assume the ASA would have to be licensed as well? We have 0 Cisco products currently and beyond a simple switch with a few VLANs, I have no experience with Cisco as an admin. 

[Milos_Jovanovic · Accepted solution]

Yes, given it is a SW product, you'll need to license it as well (ASAv license per throughput plus AnyConnect license per user). If you don't have any experience with this, I would recommend to contract someone to guide you through most optimal setup for you and to do necessary configuration, as I tend to find this a complicated task to be executed with zero experience.

Kind regards,

Milos

[AxelAxel]

Thanks, that is exactly what I needed to know!