Hướng dẫn cài đặt cisco vpn client Informational năm 2024
|
Trong Windows 10, việc cài đặt Cisco VPN Client có thể gặp sự cố. Khi bạn tiến hành cài đặt, chương trình thông báo lỗi “Error 27850. Không thể quản lý thành phần mạng. Có thể do hệ điều hành bị hỏng đang ngăn cản quá trình cài đặt. “ Vậy làm thế nào để sửa lỗi Error 27850 này và tiếp tục cài đặt Cisco VPN Client? Theo dõi bài viết dưới đây của Mytour nhé. Show
Cisco VPN Client là công cụ giúp bạn kết nối đến cổng mạng được mã hóa mạnh mẽ với độ bảo mật cao cho thiết bị di động của bạn. Nó hỗ trợ trên nhiều hệ điều hành như Windows, Mac, Linux, Solaris,… Tuy nhiên, để sử dụng công cụ này trên Windows 10, bạn cần khắc phục lỗi Error 27850 trước. HƯỚNG DẪN SỬA LỖI ERROR 27850 KHI CÀI CISCO VPN Client Bước 1: Đảm bảo rằng bạn đang sử dụng phiên bản Cisco VPN Client từ 5.0.0.7 trở lên. Bạn có thể tải phiên bản mới nhất tại trang chính thức của Cisco VPN Client Bước 2: Nếu bạn đã cài đặt Cisco VPN Client phiên bản 5.0.0.7 trở lên và vẫn gặp lỗi Error 27850, hãy thử tải và cài đặt phiên bản mới nhất của DNE. Đây là công cụ hỗ trợ hệ điều hành, giao thức mạng kiểm soát và đo lường cơ sở hạ tầng mạng. Tải DNE cho Windows 32-bit tại đây: Download DNE 32-bit Tải DNE cho Windows 64-bit tại đây: Download DNE 64-bit Bước 3: Thực hiện cài đặt DNE từ tệp tin đã được tải về để khắc phục lỗi Error 27850. Bước 4: Sau khi hoàn tất cài đặt DNE, thử lại việc cài đặt Cisco VPN Client và kiểm tra xem lỗi Error 27850 còn xuất hiện không. Dưới đây là hướng dẫn giúp bạn khắc phục sự cố 27850 khi cài đặt Cisco VPN Client - một công cụ mạnh mẽ để thiết lập và quản lý máy chủ VPN. Tuy nhiên, nếu bạn đang tìm kiếm một giải pháp kết nối đến máy chủ VPN, thì SoftEther VPN Server là sự lựa chọn phù hợp, dễ cài đặt và sử dụng trên Windows 10. Chúc bạn thành công! Nội dung được phát triển bởi đội ngũ Mytour với mục đích chăm sóc và tăng trải nghiệm khách hàng. The AnyConnect client provides many options for automatically connecting, reconnecting, or disconnecting VPN sessions. These options provide a convenient way for your users to connect to your VPN, and they also support your network security requirements. Starting and Restarting AnyConnect Connectionsto provide the names and addresses of the secure gateways your users will manually connect to. Choose from the following AnyConnect capabilities to provide convenient, automatic VPN connectivity: Also, consider using the following Automatic VPN Policy options to enforce greater network security or restrict network access to the VPN only: Renegotiating and Maintaining the AnyConnect ConnectionYou can limit how long the ASA keeps an AnyConnect VPN connection available to the user even with no activity. If a VPN session goes idle, you can terminate the connection or re-negotiate the connection.
Terminating an AnyConnect ConnectionTerminating an AnyConnect connection requires the user to re-authenticate their endpoint to the secure gateway and create a new VPN connection. The following connection parameters terminate the VPN session based on timeouts:
See the Specify a VPN Session Idle Timeout for a Group Policy section in the appropriate release of the Cisco ASA Series VPN Configuration Guide to set these parameters. Configure VPN Connection ServersThe AnyConnect VPN server list consists of host name and host address pairs identifying the secure gateways that your VPN users will connect to. The host name can be an alias, an FQDN, or an IP address. The hosts added to the server list display in the Connect to drop-down list in the AnyConnect GUI. The user can then select from the drop-down list to initiate a VPN connection. The host at the top of the list is the default server, and appears first in the GUI drop-down list. If the user selects an alternate server from the list, the selected server becomes the new default server. Once you add a server to the server list, you can view its details and edit or delete the server entry. To add a server to the server list, follow this procedure. ProcedureStep 1 Open the VPN Profile Editor and choose Server List from the navigation pane. Step 2 Click Add. Step 3 Configure the server’s host name and address:
Enter the server to fall back to as the backup server in the Backup Server List. Do not use "&" or "<" characters in the name. Note Conversely, the Backup Server tab on the Server menu is a global entry for all connection entries. Any entries put in that Backup Server location are overwritten with what is entered here for an individual server list entry. This setting takes precedence and is the recommended practice. Step 5 (Optional) Add load balancing servers to the Load Balancing Server List. Do not use "&" or "<" characters in the name. If the host for this server list entry specifies a load balancing cluster of security appliances, and the Always-On feature is enabled, add the load balancing devices in the cluster to this list. If you do not, Always-On blocks access to the devices in the load balancing cluster. Step 6 Specify the Primary Protocol for the client to use for this ASA:
(Optional) Configure SCEP for this server:
Click OK. Automatically Start Windows VPN Connections Before LogonAbout Start Before LogonThis feature called Start Before Logon (SBL) allows users to establish their VPN connection to the enterprise infrastructure before logging onto Windows. When using Start Before Logon (SBL) and HostScan, you must install the AnyConnect/HostScan posture predeploy module on the endpoints to achieve full HostScan functionality, since SBL is pre-login. When SBL is installed and enabled, AnyConnect starts before the Windows logon dialog box appears, ensuring users are connected to their corporate infrastructure before logging on. After VPN authentication, the Windows logon dialog appears, and the user logs in as usual. SBL also includes the Network Access Manager tile and allows connections using user configured home network profiles. Network profiles allowed in SBL mode include all media types employing non-802.1X authentication modes, such as open WEP, WPA/WPA2 Personal, and static key (WEP) networks. SBL is available on Windows systems only, and is implemented using different mechanisms depending on the version of Windows:
Reasons you might consider enabling SBL for your users include:
Limitations on Start Before Logon
Configure Start Before LogonProcedureInstall the AnyConnect Start Before Logon ModuleThe AnyConnect installer detects the underlying operating system and places the appropriate AnyConnect DLL from the AnyConnect SBL module in the system directory. On Windows 7, or the Windows 2008 server, the installer determines whether the 32-bit or 64-bit version of the operating system is in use and installs the appropriate PLAP component, vpnplap.dll or vpnplap64.dll. If you uninstall AnyConnect while leaving the VPNGINA or PLAP component installed, the VPNGINA or PLAP component is disabled and not visible to the remote user. You can predeploy the SBL module or configure the ASA to download it. When predeploying AnyConnect, the Start Before Logon module requires that the core client software is installed first. If you are predeploying AnyConnect Core and the Start Before Logon components using MSI files, you must get the order right. Procedure Step 1 In ASDM go to . Step 2 Select a group policy and click Edit or Add a new group policy. Step 3 Select in the left navigation pane. Step 4 Uncheck Inherit for the Optional Client Module for Download setting. Step 5 Select the AnyConnect SBL module in the drop-down list. Enable SBL in the AnyConnect ProfileBefore you begin
Procedure Step 1 Open the VPN Profile Editor and choose Preferences (Part 1) from the navigation pane. Step 2 Select Use Start Before Logon. Step 3 (Optional) To give the remote user control over SBL, select User Controllable. Note The user must reboot the remote computer before SBL takes effect. Troubleshoot Start Before LogonProcedureStep 1 Ensure that the AnyConnect profile is loaded on the ASA, ready to be deployed. Step 2 Delete prior profiles (search for them on the hard drive to find the location, *.xml). Step 3 Using Windows Add/Remove Programs, uninstall the SBL Components. Reboot the computer and retest. Step 4 Clear the user’s AnyConnect log in the Event Viewer and retest. Step 5 Browse back to the security appliance to install AnyConnect again. Step 6 Reboot once. On the next reboot, you should be prompted with the Start Before Logon prompt. Step 7 Collect a DART bundle and send it to your AnyConnect Administrator. Step 8 If you see the following error, delete the user’s AnyConnect profile: Step 9 Go back to the .tmpl file, save a copy as an.xml file, and use that XML file as the default profile. Automatically Start VPN Connections When AnyConnect StartsThis feature called Auto Connect On Start, automatically establishes a VPN connection with the secure gateway specified by the VPN client profile when AnyConnect starts. Auto Connect On Start is disabled by default, requiring the user to specify or select a secure gateway. ProcedureStep 1 Open the VPN Profile Editor and choose Preferences (Part 1) from the navigation pane. Step 2 Select Auto Connect On Start. Step 3 (Optional) To give the user control over Auto Connect on Start, select User Controllable. Configure Start Before Logon (PLAP) on Windows SystemsThe Start Before Logon (SBL) feature starts a VPN connection before the user logs in to Windows. This ensures that users connect to their corporate infrastructure before logging on to their computers. The SBL AnyConnect feature is known as the Pre-Login Access Provider (PLAP), which is a connectable credential provider. This feature lets programmatic network administrators perform specific tasks, such as collecting credentials or connecting to network resources before logon. PLAP provides SBL functions on all of the supported Windows operating systems. PLAP supports 32-bit and 64-bit versions of the operating system with vpnplap.dll and vpnplap64.dll, respectively. The PLAP functions supports x86 and x64. Automatically Restart VPN ConnectionsWhen Auto Reconnect is enabled (default), AnyConnect recovers from VPN session disruptions and reestablishes a session, regardless of the media used for the initial connection. For example, it can reestablish a session on wired, wireless, or 3G. When Auto Reconnect is enabled, you also specify the reconnect behavior upon system suspend or system resume. A system suspend is a low-power standby, such as Windows “hibernation” or macOS or Linux “sleep.” A system resume is a recovery following a system suspend. If you disable Auto Reconnect, the client does not attempt to reconnect regardless of the cause of the disconnection. Cisco highly recommends using the default setting (enabled) for this feature. Disabling this setting can cause interruptions in VPN connectivity over unstable connections. ProcedureStep 1 Open the VPN Profile Editor and choose Preferences (Part 1) from the navigation pane. Step 2 Select Auto Reconnect. Step 3 Choose the Auto Reconnect Behavior:
Use Trusted Network Detection to Connect and DisconnectAbout Trusted Network DetectionTrusted Network Detection (TND) gives you the ability to have AnyConnect automatically disconnect a VPN connection when the user is inside the corporate network (the trusted network) and start the VPN connection when the user is outside the corporate network (the untrusted network). TND does not interfere with the ability of the user to manually establish a VPN connection. It does not disconnect a VPN connection that the user starts manually in the trusted network. TND only disconnects the VPN session if the user first connects in an untrusted network and moves into a trusted network. For example, TND disconnects the VPN session if the user makes a VPN connection at home and then moves into the corporate office. You configure TND in the AnyConnect VPN Client profile. No changes are required to the ASA configuration. You need to specify the action or policy AnyConnect takes when recognizing it is transitioning between trusted and untrusted networks, and identify your trusted networks and servers. Guidelines for Trusted Network Detection
Configure Trusted Network DetectionProcedureStep 1 Open the VPN profile editor and choose Preferences (Part 2) from the navigation pane. Step 2 Select Automatic VPN Policy. Step 3 Choose a Trusted Network Policy. This is the action the client takes when the user is inside the corporate network (the trusted network). The options are:
Step 4 Choose an Untrusted Network Policy. This is the action the client takes when the user is outside the corporate network. The options are:
Step 5 Specify Trusted DNS Domains. Specify the DNS suffixes (a string separated by commas) that a network interface may have when the client is in the trusted network. You can assign multiple DNS suffixes if you add them to the split-dns list and specify a default domain on the ASA. The AnyConnect client builds the DNS suffix list in the following order:
Step 6 Specify Trusted DNS Servers. All DNS server addresses (a string separated by commas) that a network interface may have when the client is in the trusted network. For example: 203.0.113.1,2001:DB8::1. Wildcards (*) are supported for IPv4 and IPv6 DNS server addresses. You must have a DNS entry for the headend server that is resolvable via DNS. If your connections are by IP address, you need a DNS server that can resolve mus.cisco.com. If mus.cisco.com is not resolvable via DNS, captive portal detection will not work as expected. Note You can configure either TrustedDNSDomains, TrustedDNSServers, or both. If you configure TrustedDNSServers, be sure to enter all your DNS servers, so your site(s) will all be part of the Trusted Network. An active interface will be considered as an In-Trusted-Network if it matches all the rules in the VPN profile. Step 7 Specify a host URL that you want to add as trusted. You must have a secure web server that is accessible with a trusted certificate to be considered trusted. After you click Add, the URL is added and the certificate hash is pre-filled. If the hash is not found, an error message prompts the user to enter the certificate hash manually and clickSet. Note You can configure this parameter only when at least one of the Trusted DNS Domains or Trusted DNS Servers is defined. If Trusted DNS Domains or Trusted DNS Servers are not defined, this field is disabled. Require VPN Connections Using Always-OnAbout Always-On VPNAlways-On operation prevents access to Internet resources when the computer is not on a trusted network, unless a VPN session is active. Enforcing the VPN to always be on in this situation protects the computer from security threats. When Always-On is enabled, it establishes a VPN session automatically after the user logs in and upon detection of an untrusted network. The VPN session remains open until the user logs out of the computer, or the session timer or idle session timer (specified in the ASA group policy) expires. AnyConnect continually attempts to reestablish the connection to reactivate the session if it is still open; otherwise, it continually attempts to establish a new VPN session. When Always-On is enabled in the VPN Profile, AnyConnect protects the endpoint by deleting all the other downloaded AnyConnect profiles and ignores any public proxies configured to connect to the ASA. The following AnyConnect options also need to be considered when enabling Always-On:
Limitations of Always-On VPN
Guidelines for Always-On VPNTo enhance protection against threats, we recommend the following additional protective measures if you configure Always-On VPN:
Configure Always-On VPNProcedureConfigure Always-On in the AnyConnect VPN Client ProfileBefore you beginAlways-On VPN requires that a valid, trusted server certificate be configured on the ASA; otherwise, it fails and logs an event indicating the certificate is invalid. In addition, ensuring that the server certificate can pass Strict Certificate Trust mode prevents the download of an Always-On VPN profile that locks a VPN connection to a rogue server. ProcedureStep 1 Open the VPN Profile Editor and choose Preferences (Part 2) from the navigation pane. Step 2 Select Automatic VPN Policy. Step 3 Step 4 Select Always On. Step 5 (Optional) Select or un-select Allow VPN Disconnect. Step 6 (Optional) . Step 7 (Optional) . Add Load-Balancing Backup Cluster Members to the Server ListAlways-On VPN affects the load balancing of AnyConnect VPN sessions. With Always-On VPN disabled, when the client connects to a primary device within a load balancing cluster, the client complies with a redirection from the primary device to any of the backup cluster members. With Always-On enabled, the client does not comply with a redirection from the primary device unless the address of the backup cluster member is specified in the server list of the client profile. Therefore, be sure to add any backup cluster members to the server list. To specify the addresses of backup cluster members in the client profile, use ASDM to add a load-balancing backup server list by following these steps: ProcedureStep 1 Open the VPN Profile Editor and choose Server List from the navigation pane. Step 2 Choose a server that is a primary device of a load-balancing cluster and click Edit. Step 3 Enter an FQDN or IP address of any load-balancing cluster member. Exempt Users from Always-On VPNYou can configure exemptions to override an Always-On policy. For example, you might want to let certain individuals establish VPN sessions with other companies or exempt the Always-On policy for noncorporate assets. Exemptions set in group policies and dynamic access policies on the ASA override the Always-On policy. You specify exceptions according to the matching criteria used to assign the policy. If an AnyConnect policy enables Always-On and a dynamic access policy or group policy disables it, the client retains the disable setting for the current and future VPN sessions as long as its criteria match the dynamic access policy or group policy on the establishment of each new session. This procedure configures a dynamic access policy that uses AAA endpoint criteria to match sessions to noncorporate assets. ProcedureStep 1 Choose Configuration \> Remote Access VPN \> Network (Client) Access \> Dynamic Access Policies \> Add or Edit. Step 2 Configure criteria to exempt users from Always-On VPN. For example, use the Selection Criteria area to specify AAA attributes to match user logon IDs. Step 3 Click the AnyConnect tab on the bottom half of the Add or Edit Dynamic Access Policy window. Step 4 Click Disable next to “Always-On VPN for AnyConnect client." Set a Connect Failure Policy for Always-OnAbout the Connect Failure PolicyThe connect failure policy determines whether the computer can access the internet if Always-On VPN is enabled and AnyConnect cannot establish a VPN session. This can occur when a secure gateway is unreachable, or when AnyConnect fails to detect the presence of a captive portal hotspot. An open policy permits full network access, letting users continue to perform tasks where access to the Internet or other local network resources is needed. A closed policy disables all network connectivity until the VPN session is established. AnyConnect does this by enabling packet filters that block all traffic from the endpoint that is not bound for a secure gateway to which the computer is allowed to connect. Regardless of the connect failure policy, AnyConnect continues to try to establish the VPN connection. Guidelines for Setting the Connect Failure PolicyConsider the following when using an open policy which permits full network access:
Consider the following when using a closed policy which disables all network connectivity until the VPN session is established:
Configure a Connect Failure PolicyYou configure a Connect Failure Policy only when the Always-On feature is enabled. By default, the connect failure policy is closed, preventing Internet access if the VPN is unreachable. To allow Internet access in this situation the connect failure policy must be set to open. Procedure Step 1 Open the VPN Profile Editor and choose Preferences (Part 2) from the navigation pane. Step 2 Set the Connect Failure Policy parameter to one of the following settings:
Step 3 If you specified a closed policy:
Use Captive Portal Hotspot Detection and RemediationAbout Captive PortalsMany facilities that offer Wi-Fi and wired access, such as airports, coffee shops, and hotels, require the user to pay before obtaining access, to agree to abide by an acceptable use policy, or both. These facilities use a technique called captive portal to prevent applications from connecting until the user opens a browser and accepts the conditions for access. Captive portal detection is the recognition of this restriction, and captive portal remediation is the process of satisfying the requirements of a captive portal hotspot in order to obtain network access. Captive portals are detected automatically by AnyConnect when initiating a VPN connection requiring no additional configuration. Also, AnyConnect does not modify any browser configuration settings during captive portal detection and does not automatically remediate the captive portal. It relies on the end user to perform the remediation. AnyConnect reacts to the detection of a captive portal depending on the current configuration:
Configure Captive Portal RemediationYou configure captive portal remediation only when the Always-On feature is enabled and the Connect Failure Policy is set to closed. In this situation, configuring captive portal remediation allows AnyConnect to connect to the VPN when a captive portal is preventing it from doing so. If the Connect Failure Policy is set to open or Always-On is not enabled, your users are not restricted from network access and are capable of remediating a captive portal without any specific configuration in the AnyConnect VPN client profile. By default, captive portal remediation is disabled on platforms supporting Always on (Windows and macOS) to provide the greatest security. AnyConnect does not provide data leakage protection capabilities during the captive portal remediation phase. If data loss protection is desired, you should employ a relevant endpoint security product. ProcedureStep 1 Open the VPN Profile Editor and choose Preferences (Part 1) from the navigation pane. Step 2 Select Allow Captive Portal Remediation. This setting lifts the network access restrictions imposed by the closed connect failure policy. Step 3 Specify the Remediation Timeout. Enter the number of minutes for which AnyConnect lifts the network access restrictions. The user needs enough time to satisfy the captive portal requirements. Troubleshoot Captive Portal Detection and RemediationAnyConnect can falsely assume that it is in a captive portal in the following situations.
If users cannot access a captive portal remediation page, ask them to try the following:
Configure AnyConnect over L2TP or PPTPISPs in some countries require support of the Layer 2 Tunneling Protocol (L2TP) and Point-to-Point Tunneling Protocol (PPTP). To send traffic destined for the secure gateway over a Point-to-Point Protocol (PPP) connection, AnyConnect uses the point-to-point adapter generated by the external tunnel. When establishing a VPN tunnel over a PPP connection, the client must exclude traffic destined for the ASA from the tunneled traffic intended for destinations beyond the ASA. To specify whether and how to determine the exclusion route, use the PPP Exclusion setting in the AnyConnect profile. The exclusion route appears as a non-secured route in the Route Details display of the AnyConnect GUI. ProcedureStep 1 Open the VPN Profile Editor and choose Preferences (Part 2) from the navigation pane. Step 2 Choose a PPP Exclusion method. Also, check User Controllable for this field to let users view and change this setting:
Instruct Users to Override PPP ExclusionIf automatic detection does not work and you configured the PPP Exclusion fields as user controllable, the user can override the setting by editing the AnyConnect preferences file on the local computer. ProcedureStep 1 Use an editor such as Notepad to open the preferences XML file. This file is at one of the following paths on the user’s computer:
Step 2 Insert the PPPExclusion details under Step 3 Save the file. Step 4 Exit and restart AnyConnect. Configure AnyConnect Proxy ConnectionsAbout AnyConnect Proxy ConnectionsAnyConnect supports VPN sessions through Local, Public, and Private proxies:
Control Client Proxy with VPN Client ProfileThe VPN Client profile can block or redirect the client system's proxy connection. For Windows and Linux, you can configure, or you can allow the user to configure, the address of a public proxy server. For more information about configuring the proxy settings in the VPN client profile, see . Proxy Auto-Configuration File Generation for Clientless SupportSome versions of the ASA require AnyConnect configuration to support clientless portal access through a proxy server after establishing an AnyConnect session. AnyConnect uses a proxy auto-configuration (PAC) file to modify the client-side proxy settings to let this occur. AnyConnect generates this file only if the ASA does not specify private-side proxy settings. Requirements for AnyConnect Proxy ConnectionsOS support of proxy connections varies as shown: Proxy Connection Type Windows macOS Linux Local Proxy Yes Yes (Override) Yes Private Proxy Yes (on Internet Explorer) Yes (set as system proxy settings) No Public Proxy Yes (IE and Override) Yes (Override) Limitations on Proxy Connections
Allow a Local Proxy ConnectionProcedureStep 1 Open the VPN Profile Editor and choose Preferences (Part 2) from the navigation pane. Step 2 Select (default) or unselect Allow Local Proxy Connections. Local proxy is disabled by default. Configure a Private Proxy ConnectionProcedureConfigure the Client to Ignore Browser Proxy SettingsYou can specify a policy in the AnyConnect profile to bypass the Microsoft Internet Explorer or Safari proxy configuration settings on the user’s PC. This prevents the user from establishing a tunnel from outside the corporate network, and prevents AnyConnect from connecting through an undesirable or illegitimate proxy server. ProcedureStep 1 Open the VPN Profile Editor and choose Preferences (Part 2) from the navigation pane. Step 2 In the Proxy Settings drop-down list, choose IgnoreProxy. Ignore Proxy causes the client to ignore all proxy settings. No action is taken against proxies that are downloaded from the ASA. Lock Down the Internet Explorer Connections TabUnder certain conditions, AnyConnect hides the Internet Explorer Tools > Internet Options > Connections tab. When exposed, this tab lets the user set proxy information. Hiding this tab prevents the user from intentionally or unintentionally circumventing the tunnel. The tab lockdown is reversed on disconnect, and it is superseded by any administrator-defined policies applied to that tab. The conditions under which this lock down occurs are the following:
You can configure the ASA to allow or not allow proxy lockdown, in the group policy. To do this using ASDM, follow this procedure: ProcedureStep 1 In ASDM go to . Step 2 Select a group policy and click Edit or Add a new group policy. Step 3 In the navigation pane, go to . The Proxy Server Policy pane displays. Step 4 Click Proxy Lockdown to display more proxy settings. Step 5 Uncheck Inherit and select Yes to enable proxy lockdown and hide the Internet Explorer Connections tab for the duration of the AnyConnect session or; select No to disable proxy lockdown and expose the Internet Explorer Connections tab for the duration of the AnyConnect session. Step 6 Click OK to save the Proxy Server Policy changes. Step 7 Click Apply to save the Group Policy changes. Verify the Proxy Settings
Select and Exclude VPN TrafficConfigure IPv4 or IPv6 Traffic to Bypass the VPNYou can configure how the AnyConnect client manages IPv4 traffic when the ASA is expecting only IPv6 traffic or how AnyConnect manages IPv6 traffic when the ASA is only expecting IPv4 traffic using the Client Bypass Protocol setting. When the AnyConnect client makes a VPN connection to the ASA, the ASA can assign the client an IPv4, IPv6, or both an IPv4 and IPv6 address. If Client Bypass Protocol is enabled for an IP protocol and an address pool is not configured for that protocol (in other words, no IP address for that protocol was assigned to client by the ASA), any IP traffic using that protocol will not be sent through the VPN tunnel. It will be sent outside the tunnel. If Client Bypass Protocol is disabled, and an address pool is not configured for that protocol, the client drops all traffic for that IP protocol once the VPN tunnel is established. For example, assume that the ASA assigns only an IPv4 address to an AnyConnect connection and the endpoint is dual stacked. When the endpoint attempts to reach an IPv6 address, if Client Bypass Protocol is disabled, the IPv6 traffic is dropped. If Client Bypass Protocol is enabled, the IPv6 traffic is sent from the client in the clear. If establishing an IPsec tunnel (as opposed to an SSL connection), the ASA is not notified whether or not IPv6 is enabled on the client, so ASA always pushes down the client bypass protocol setting. You configure the Client Bypass Protocol on the ASA in the group policies. ProcedureStep 1 In ASDM go to . Step 2 Select a group policy and click Edit or Add a new group policy. Step 3 Select . Step 4 Next to Client Bypass Protocol, uncheck Inherit if this is a group policy other than the default group policy. Step 5 Choose one of these options:
Step 6 Click OK. Step 7 Click Apply. Configure a Client Firewall with Local Printer and Tethered Device SupportSee the section in the Cisco ASA Series Configuration Guide. Split DNSWhen split DNS is configured in the Network (Client) Access group policy, AnyConnect tunnels specific DNS queries to the private DNS server (also configured in the group policy). All other DNS queries go to the DNS resolver on the client operating system, in the clear, for DNS resolution. If split DNS is not configured, AnyConnect tunnels all DNS queries. If split DNS is not configured, AnyConnect tunnels all DNS queries. Requirements for Split DNSSplit DNS supports standard and update queries (including A, AAAA, NS, TXT, MX, SOA, ANY, SRV, PTR, and CNAME). PTR queries matching any of the tunneled networks are allowed through the tunnel. Split DNS is supported on Windows and macOS platforms.
For macOS, AnyConnect can use true split-DNS for a certain IP protocol only if one of the following conditions is met:
Configure Split DNS for Split Include TunnelingTo configure split DNS for split include tunneling in the group policy, do the following: ProcedureStep 1 Configure at least one DNS server. See the Configure Server Attributes for an Internal Group Policy section in the Cisco ASA Series VPN Configuration Guide. Ensure the private DNS servers specified do not overlap with the DNS servers configured for the client platform. If they do, name resolution may not function properly. Step 2 Configure split-include tunneling: On the Configuration > Remote Access VPN > Network (Client) Access > Group Policies > Advanced > Split Tunneling pane, choose theTunnel Network List Belowpolicy, and specify a Network List of addresses to be tunneled. Split-DNS does not support the Exclude Network List Below split-tunneling policy. You must use the Tunnel Network List Below split-tunneling policy to configure split-DNS. Step 3 On the Configuration > Remote Access VPN > Network (Client) Access > Group Policies > Advanced > Split Tunneling pane, uncheck Send All DNS lookups through tunnel, and specify the names of the domains whose queries will be tunneled in DNS Names. What to do nextAfter making changes to the group policy in ASDM, be sure the group policy is associated with a Connection Profile in Configuration > Remote Access VPN > Network (Client) Access > AnyConnect Connection Profiles > Add/Edit > Group Policy. Verify Split DNS Using AnyConnect LogsCheck Which Domains Use Split DNSYou can use any tool or application that relies on the operating system’s DNS resolver for domain name resolution. For example, you can use a ping or web browser to test the split DNS solution. Other tools such as nslookup or dig circumvent the OS DNS resolver. To use the client to check which domains are used for split DNS, follow these steps: ProcedureStep 1 Run ipconfig/all and record the domains listed next to DNS Suffix Search List. Step 2 Establish a VPN connection and again check the domains listed next to DNS Suffix Search List. Those extra domains added after establishing the tunnel are the domains used for split DNS. Note This process assumes that the domains pushed from the ASA do not overlap with the ones already configured on the client host. Manage VPN AuthenticationImportant Security ConsiderationsWe do not recommend using a self-signed certificate on your secure gateway
We strongly recommend that you enable Strict Certificate Trust for the AnyConnect client. To configure Strict Certificate Trust, see the Local Policy Parameters and Values section: . Configure Server Certificate HandlingServer Certificate Verification
Invalid Server Certificate HandlingIn response to the increase of targeted attacks against mobile users on untrusted networks, we have improved the security protections in the client to help prevent serious security breaches. The default client behavior has been changed to provide an extra layer of defense against Man-in-the-middle attacks. User InteractionWhen the user tries to connect to a secure gateway, and there is a certificate error (due to expired, invalid date, wrong key usage, or CN mismatch), the user sees a red-colored dialog with Change Settings and Keep Me Safe buttons. The dialogs for Linux may look different from the ones shown in this document.
If the user un-checks Block connections to untrusted servers, and the only issue with the certificate is that the CA is untrusted, then the next time the user attempts to connect to this secure gateway, the user will not see the Certificate Blocked Error Dialog dialog; they only see the following dialog: If the user checks Always trust this VPN server and import the certificate, then future connections to this secure gateway will not prompt the user to continue. If the user checks Block connections to untrusted servers in AnyConnect Advanced > VPN > Preferences, or if the user’s configuration meets one of the conditions in the list of the modes described under the guidelines and limitations section, then AnyConnect rejects invalid server certificates and connections to untrusted servers, regardless of whether the Strict Certificate Trust option in the Profile Editor is enabled. Improved Security BehaviorWhen the client accepts an invalid server certificate, that certificate is saved in the client's certificate store. Previously, only the thumbprint of the certificate was saved. Note that invalid certificates are saved only when the user has elected to always trust and import invalid server certificates. There is no administrative override to make the end user less secure automatically. To completely remove the preceding security decisions from your end users, enable Strict Certificate Trust in the user’s local policy file. When Strict Certificate Trust is enabled, the user sees an error message, and the connection fails; there is no user prompt. For information about enabling Strict Certificate Trust in the local policy file, see the AnyConnect Local Policy Parameters and Values section: . Guidelines and LimitationsInvalid server certificates are rejected when:
Configure Certificate-Only AuthenticationYou can specify whether you want users to authenticate using AAA with a username and password or using a digital certificate (or both). When you configure certificate-only authentication, users can connect with a digital certificate and are not required to provide a user ID and password. To support certificate-only authentication in an environment where multiple groups are used, you may provision more than one group-url. Each group-url would contain a different client profile with some piece of customized data that would allow for a group-specific certificate map to be created. For example, the Department_OU value of Engineering could be provisioned on the ASA to place the user in this group when the certificate from this process is presented to the ASA. The certificate used to authenticate the client to the secure gateway must be valid and trusted (signed by a CA). A self-signed client certificate will not be accepted. ProcedureStep 1 Go to . Select a connection profile and click Edit. The Edit AnyConnect Connection Profile window opens. Step 2 If it is not already, click the Basic node of the navigation tree on the left pane of the window. In the right pane of the window, in the Authentication area, enable the methodCertificate. Step 3 Click OK and apply your changes. Configure Certificate EnrollmentThe Cisco AnyConnect Secure Mobility Client uses the Simple Certificate Enrollment Protocol (SCEP) to provision and renew a certificate as part of client authentication. Certificate enrollment using SCEP is supported by AnyConnect IPsec and SSL VPN connections to the ASA in the following ways:
SCEP Proxy Enrollment and OperationThe following steps describe how a certificate is obtained and a certificate-based connection is made when AnyConnect and the ASA are configured for SCEP Proxy.
Other SCEP Proxy operational considerations:
Legacy SCEP Enrollment and OperationThe following steps describe how a certificate is obtained and a certificate-based connection is made when AnyConnect is configured for Legacy SCEP.
Other Legacy SCEP operational considerations:
Certificate Authority Requirements
Guidelines for Certificate Enrollment
Configure SCEP Proxy Certificate Enrollment Configure a VPN Client Profile for SCEP Proxy EnrollmentProcedureStep 1 Open the VPN Profile Editor and choose Certificate Enrollment from the navigation pane. Step 2 Select Certificate Enrollment. Step 3 Configure the Certificate Contents to be requested in the enrollment certificate. For definitions of the certificate fields, see . Note
Configure the ASA to Support SCEP Proxy EnrollmentFor SCEP Proxy, a single ASA connection profile supports certificate enrollment and the certificate authorized VPN connection. ProcedureStep 1 Create a group policy, for example, cert_group. Set the following fields:
Step 2 Create a connection profile for certificate enrollment and certificate authorized connection, for example, cert_tunnel.
Configure Legacy SCEP Certificate Enrollment Configure a VPN Client Profile for Legacy SCEP EnrollmentProcedureStep 1 Open the VPN Profile Editor and choose Certificate Enrollment from the navigation pane. Step 2 Select Certificate Enrollment. Step 3 Specify an Automatic SCEP Host to direct the client to retrieve the certificate. Enter the FQDN or IP address, and the alias of the connection profile (tunnel group) that is configured for SCEP certificate retrieval. For example, if asa.cisco.com is the host name of the ASA and scep_eng is the alias of the connection profile, enter asa.cisco.com/scep-eng. When the user initiates the connection, the address chosen or specified must match this value exactly for Legacy SCEP enrollment to succeed. For example, if this field is set to an FQDN, but the user specifies an IP address, SCEP enrollment will fail. Step 4 Configure the Certificate Authority attributes: Note Your CA server administrator can provide the CA URL and thumbprint. Retrieve the thumbprint directly from the server, not from a “fingerprint” or “thumbprint” attribute field in an issued certificate.
Configure which Certificate Contents to request in the enrollment certificate. For definitions of the certificate fields, see . Note If you use %machineid%, load HostScan/Posture on the client. Step 6 (Optional) Check Display Get Certificate Button to permit users to manually request provisioning or renewal of authentication certificates. The button is visible to users if the certificate authentication fails. Step 7 (Optional) Enable SCEP for a specific host in the server list. Doing this overrides the SCEP settings in the Certificate Enrollment pane described above.
Configure the ASA to Support Legacy SCEP EnrollmentFor Legacy SCEP on the ASA, you must create a connection profile and group policy for certificate enrollment and a second connection profile and group policy for the certificate authorized VPN connection. ProcedureStep 1 Create a group policy for enrollment, for example, cert_enroll_group. Set the following fields: On the Advanced > AnyConnect Client pane, uncheckInherit for Client Profiles to Download and specify the client profile configured for Legacy SCEP. For example, specify the ac_vpn_legacy_scep client profile. Step 2 Create a second group policy for authorization, for example, cert_auth_group. Step 3 Create a connection profile for enrollment, for example, cert_enroll_tunnel. Set the following fields:
Step 4 Create a connection profile for authorization, for example, cert_auth_tunnel. Set the following fields.
Step 5 (Optional) On the General pane of each group policy, setConnection Profile (Tunnel Group) Lock to the corresponding SCEP connection profile, which restricts traffic to the SCEP-configured connection profile. Set Up a Windows 2008 Server Certificate Authority for SCEPIf your Certificate Authority software is running on a Windows 2008 server, you may need to make one of the following configuration changes to the server to support SCEP with AnyConnect. Disable the SCEP Password on the Certificate AuthorityThe following steps describe how to disable the SCEP challenge password, so that clients will not need to provide an out-of-band password before SCEP enrollment. Procedure Step 1 On the Certificate Authority server, launch the Registry Editor. You can do this by selecting , typing regedit , and clicking OK. Step 2 Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MSCEP\EnforcePassword. If the EnforcePassword key does not exist, create it as a new Key. Step 3 Edit EnforcePassword, and set it to '0'. If it does not exist, create it as a REG-DWORD. Step 4 Exit regedit, and reboot the certificate authority server. Setting the SCEP Template on the Certificate AuthorityThe following steps describe how to create a certificate template, and assign it as the default SCEP template. Procedure Step 1 Launch the Server Manager. You can do this by selecting Start > Admin Tools > Server Manager. Step 2 Expand Roles > Certificate Services (or AD Certificate Services). Step 3 Navigate to CA Name > Certificate Templates. Step 4 Right-click Certificate Templates > Manage. Step 5 From the Cert Templates Console, right-click User template and choose Duplicate Step 6 Choose Windows Server 2008 version for new template, and click OK. Step 7 Change the template display name to something descriptive, such as NDES-IPSec-SSL. Step 8 Adjust the Validity Period for your site. Most sites choose three or more years to avoid expired certificates. Step 9 On the Cryptography tab, set the minimum key size for your deployment. Step 10 On the Subject Name tab, select Supply in Request. Step 11 On the Extensions tab, set the Application Policies to include at least:
These values are valid for SSL or IPsec. Step 12 Click Apply, then OK to save new template. Step 13 From Server manager > Certificate Services-CA Name, right-click Certificate Templates. Select New > Certificate Template to Issue, select the new template you created (in this example, NDES-IPSec-SSL), and click OK. Step 14 Edit the registry. You can do this by selecting Start > Run, regedit, and clicking OK. Step 15 Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MSCEP. Step 16 Set the value of the following three keys to NDES-IPSec-SSL.
Step 17 Click Save, and reboot the certificate authority server. Configure a Certificate Expiration NoticeConfigure AnyConnect to warn users that their authentication certificate is about to expire. The Certificate Expiration Threshold setting specifies the number of days before the certificate’s expiration date that AnyConnect warns users that their certificate is expiring. AnyConnect warns the user upon each connect until the certificate has actually expired or a new certificate has been acquired. The Certificate Expiration Threshold feature cannot be used with RADIUS. ProcedureStep 1 Open the VPN Profile Editor and choose Certificate Enrollment from the navigation pane. Step 2 Select Certificate Enrollment. Step 3 Specify a Certificate Expiration Threshold. This is the number of days before the certificate expiration date, that AnyConnect warns users that their certificate is going to expire. The default is 0 (no warning displayed). The range is 0 to 180 days. Step 4 Click OK. Configure Certificate SelectionThe following steps show all the places in the AnyConnect profiles where you configure how certificates are searched for and how they are selected on the client system. None of the steps are required, and if you do not specify any criteria, AnyConnect uses default key matching. AnyConnect reads the browser certificate stores on Windows. For macOS and Unix, you must create a Privacy Enhanced Mail (PEM) formatted file store. ProcedureConfigure Which Certificate Stores to UseWindows provides separate certificate stores for the local machine and for the current user. Specify which certificate stores are used by AnyConnect in the VPN client profile. By default, it searches both, but you can configure AnyConnect to use only one. Users with administrative privileges on the computer have access to both certificate stores. Users without administrative privileges only have access to the user certificate store. Usually, Windows users do not have administrative privileges. SelectingCertificate Store Override allows AnyConnect to access the machine store, even when the user does not have administrative privileges. Access-control for the machine store can vary depending on the Windows version and security settings. Because of this, the user may be unable to use certificates in the machine store even though they have administrative privileges. In this case, select Certificate Store Override to allow machine store access. The following table describes how AnyConnect searches for certificates on a client based on whatCertificate Store is searched, and whetherCertificate Store Override is checked. Certificate Store Setting Certificate Store Override Setting AnyConnect Search Strategy All (for Windows) cleared AnyConnect searches all certificate stores. AnyConnect is not allowed to access the machine store when the user does not have administrative privileges. This setting is the default. This setting is appropriate for most cases. Do not change this setting unless you have a specific reason or scenario requirement to do so. All (for Windows) checked AnyConnect searches all certificate stores. AnyConnect is allowed to access the machine store when the user does not have administrative privileges. Machine (not a multi-cert option) checked AnyConnect searches the machine certificate store. AnyConnect is allowed to search the machine store when the user does not have administrative privileges. Machine (not a multi-cert option) cleared AnyConnect searches the machine certificate store. AnyConnect is not allowed to search the machine store when the user does not have administrative privileges. Note This configuration can be used when only a limited group of users is allowed to authenticate using a certificate. User (for Windows) does not apply AnyConnect searches in the user certificate store only. The certificate store override is not applicable because users without administrative rights can have access to this certificate store. All (for Linux) does not apply AnyConnect uses client certificates from both system and user PEM file stores, as well as the user Firefox NSS store. Machine (for Linux) does not apply AnyConnect uses client certificate stores only from the system PEM file store. User (for Linux) does not apply AnyConnect uses client certificates only from the user PEM file store, as well as the user Firefox NSS store. With Basic Certificate AuthenticationProcedure Step 1 Set Certificate Store.
Step 2 Choose Certificate Store Override if you want to allow AnyConnect to search the machine certificate store when users do not have administrative privileges. Prompt Windows Users to Select Authentication CertificateYou can configure the AnyConnect to present a list of valid certificates to users and let them choose the certificate to authenticate the session. An expired certificate is not necessarily considered invalid. For example, if you are using SCEP, the server might issue a new certificate to the client. Eliminating expired certificates might keep a client from connecting at all; thus requiring manual intervention and out-of-band certificate distribution. AnyConnect only restricts the client certificate based on security-related properties, such as key usage, key type and strength, and so on, based on configured certificate matching rules. This configuration is available only for Windows. By default, user certificate selection is disabled. ProcedureStep 1 Open the VPN Profile Editor and choose Preferences (Part 2) from the navigation pane. Step 2 To enable certificate selection, uncheck Disable Certificate Selection. Step 3 Uncheck User Controllable, unless you want users to be able to turn automatic certificate selection on and off in the pane. Create a PEM Certificate Store for macOS and LinuxAnyConnect supports certificate retrieval from a Privacy Enhanced Mail (PEM) formatted file store. AnyConnect reads PEM-formatted certificate files from the file system on the remote computer, verifies, and signs them. Before you beginIn order for the client to acquire the appropriate certificates under all circumstances, ensure that your files meet the following requirements:
To create the PEM file certificate store, create the paths and folders listed below. Place the appropriate certificates in these folders: PEM File Certificate Store Folders Type of Certificates Stored ~/.cisco/certificates/ca Note .cisco/ is located in the home directory. Trusted CA and root certificates ~/.cisco/certificates/client Client certificates ~/.cisco/certificates/client/private Private keys Machine certificates are the same as PEM file certificates, except for the root directory. For machine certificates, substitute /opt/.cisco for ~/.cisco. Otherwise, the paths, folders, and types of certificates listed apply. Configure Certificate MatchingAnyConnect can limit its search of certificates to those certificates that match a specific set of keys. Certificate matchings are global criteria that are set in an AnyConnect VPN client profile, in the Certificate Matching pane. The criteria are:
Configure Key UsageSelecting the Key Usage keys limits the certificates that AnyConnect can use to those certificates that have at least one of the selected keys. The supported set is listed in the Key Usage list on the VPN client profile, and it includes:
If one or more criteria are specified, a certificate must match at least one to be considered a matching certificate. Configure Extended Key UsageSelecting the Extended Key Usage keys limits the certificates that AnyConnect can use to the certificates that have these keys. The following table lists the well-known set of constraints with their corresponding object identifiers (OIDs). Constraint OID ServerAuth 1.3.6.1.5.5.7.3.1 ClientAuth 1.3.6.1.5.5.7.3.2 CodeSign 1.3.6.1.5.5.7.3.3 EmailProtect 1.3.6.1.5.5.7.3.4 IPSecEndSystem 1.3.6.1.5.5.7.3.5 IPSecTunnel 1.3.6.1.5.5.7.3.6 IPSecUser 1.3.6.1.5.5.7.3.7 TimeStamp 1.3.6.1.5.5.7.3.8 OCSPSign 1.3.6.1.5.5.7.3.9 DVCS 1.3.6.1.5.5.7.3.10 IKE Intermediate 1.3.6.1.5.5.8.2.2 Configure Custom Extended Match KeyAll other OIDs (such as 1.3.6.1.5.5.7.3.11, used in some examples in this document) are considered “custom.” As an administrator, you can add your own OIDs if the OID that you want is not in the well-known set. Configure Certificate Distinguished NameThe Distinguished Name table contains certificate identifiers that limit the certificates that the client can use to the certificates that match the specified criteria and criteria match conditions. Click the Add button to add criteria to the list and to set a value or wildcard to match the contents of the added criteria. Identifier Description CN SubjectCommonName SN SubjectSurName GN SubjectGivenName N SubjectUnstructName I SubjectInitials GENQ SubjectGenQualifier DNQ SubjectDnQualifier C SubjectCountry L SubjectCity SP SubjectState ST SubjectState O SubjectCompany OU SubjectDept T SubjectTitle EA SubjectEmailAddr DC DomainComponent ISSUER-CN IssuerCommonName ISSUER-SN IssuerSurName ISSUER-GN IssuerGivenName ISSUER-N IssuerUnstructName ISSUER-I IssuerInitials ISSUER-GENQ IssuerGenQualifier ISSUER-DNQ IssuerDnQualifier ISSUER-C IssuerCountry ISSUER-L IssuerCity ISSUER-SP IssuerState ISSUER-ST IssuerState ISSUER-O IssuerCompany ISSUER-OU IssuerDept ISSUER-T IssuerTitle ISSUER-EA IssuerEmailAddr ISSUER-DC IssuerDomainComponent Distinguished Name can contain zero or more matching criteria. A certificate must match all specified criteria to be considered a matching certificate. Distinguished Name matching specifies that a certificate must or must not have the specified string, and whether wild carding for the string is allowed. VPN Authentication Using SDI Token (SoftID) IntegrationAnyConnect integrates support for RSA SecurID client software versions 1.1 and later running on Windows 7 x86 (32-bit) and x64 (64-bit). RSA SecurID software authenticators reduce the number of items a user has to manage for safe and secure access to corporate assets. RSA SecurID Software Tokens residing on a remote device generate a random one-time-use passcode that changes every 60 seconds. The term SDI stands for Security Dynamics, Inc. technology, which refers to this one-time password generation technology that uses hardware and software tokens. Typically, users make an AnyConnect connection by clicking the AnyConnect icon in the tools tray, selecting the connection profile with which they wish to connect, and then entering the appropriate credentials in the authentication dialog box. The login (challenge) dialog box matches the type of authentication configured for the tunnel group to which the user belongs. The input fields of the login dialog box clearly indicate what kind of input is required for authentication. For SDI authentication, the remote user enters a PIN (Personal Identification Number) into the AnyConnect software interface and receives an RSA SecurID passcode. After the user enters the passcode into the secured application, the RSA Authentication Manager validates the passcode and allows the user to gain access. Users who use RSA SecurID hardware or software tokens see input fields indicating whether the user should enter a passcode or a PIN, a PIN, or a passcode and the status line at the bottom of the dialog box provides further information about the requirements. The user enters a software token PIN or passcode directly into the AnyConnect user interface. The appearance of the initial login dialog box depends on the secure gateway settings: the user can access the secure gateway either through the main login page, the main index URL, a tunnel-group login page, or a tunnel group URL (URL/tunnel-group). To access the secure gateway via the main login page, the “Allow user to select connection” check box must be set in the Network (Client) Access AnyConnect Connection Profiles page. In either case, the secure gateway sends the client a login page. The main login page contains a drop-down list in which the user selects a tunnel group; the tunnel-group login page does not, since the tunnel-group is specified in the URL. In the case of a main login page (with a drop-down list of connection profiles or tunnel groups), the authentication type of the default tunnel group determines the initial setting for the password input field label. For example, if the default tunnel group uses SDI authentication, the field label is “Passcode;” but if the default tunnel group uses NTLM authentication, the field label is “Password.” In Release 2.1 and later, the field label is not dynamically updated with the user selection of a different tunnel group. For a tunnel-group login page, the field label matches the tunnel-group requirements. The client supports input of RSA SecurID Software Token PINs in the password input field. If the RSA SecurID Software Token software is installed and the tunnel-group authentication type is SDI, the field label is “Passcode” and the status bar states “Enter a username and passcode or software token PIN.” If a PIN is used, subsequent consecutive logins for the same tunnel group and username have the field label “PIN.” The client retrieves the passcode from the RSA SecurID Software Token DLL using the entered PIN. With each successful authentication, the client saves the tunnel group, the username, and authentication type, and the saved tunnel group becomes the new default tunnel group. AnyConnect accepts passcodes for any SDI authentication. Even when the password input label is “PIN,” the user may still enter a passcode as instructed by the status bar. The client sends the passcode to the secure gateway as is. If a passcode is used, subsequent consecutive logins for the same tunnel group and username have the field label “Passcode.” The RSASecureIDIntegration profile setting has three possible values:
AnyConnect does not support token selection from multiple tokens imported into the RSA Software Token client software. Instead, the client uses the default selected via the RSA SecurID Software Token GUI. Categories of SDI Authentication ExchangesAll SDI authentication exchanges fall into one of the following categories:
Normal SDI Authentication LoginA normal login challenge is always the first challenge. The SDI authentication user must provide a user name and token passcode (or PIN, in the case of a software token) in the username and passcode or PIN fields, respectively. The client returns the information to the secure gateway (central-site device), and the secure gateway verifies the authentication with the authentication server (SDI or SDI via RADIUS proxy). If the authentication server accepts the authentication request, the secure gateway sends a success page back to the client, and the authentication exchange is complete. If the passcode is not accepted, the authentication fails, and the secure gateway sends a new login challenge page, along with an error message. If the passcode failure threshold on the SDI server has been reached, then the SDI server places the token into next token code mode. New User, Clear PIN, and New PIN ModesThe PIN can be cleared only on the SDI server and only by the network administrator. In the New User, Clear PIN, and New PIN modes, AnyConnect caches the user-created PIN or system-assigned PIN for later use in the “next passcode” login challenge. Clear PIN mode and New User mode are identical from the point of view of the remote user and are both treated the same by the secure gateway. In both cases, the remote user either must enter a new PIN or be assigned a new PIN by the SDI server. The only difference is in the user response to the initial challenge. For New PIN mode, the existing PIN is used to generate the passcode, as it would be in any normal challenge. For Clear PIN mode, no PIN is used at all for hardware tokens, with the user entering just a token code. A PIN of eight consecutive zeros (00000000) is used to generate a passcode for RSA software tokens. In either case, the SDI server administrator must inform the user of what, if any, PIN value to use. Adding a new user to an SDI server has the same result as clearing the PIN of an existing user. In both cases, the user must either provide a new PIN or be assigned a new PIN by the SDI server. In these modes, for hardware tokens, the user enters just a token code from the RSA device. In either case, the SDI server administrator must inform the user of what, if any, PIN value to use. Creating a New PINIf there is no current PIN, the SDI server requires that one of the following conditions be met, depending on how the system is configured:
If the SDI server is configured to allow the remote user to choose whether to create a PIN or have the system assign a PIN, the login screen presents a drop-down list showing the options. The status line provides a prompt message. For a system-assigned PIN, if the SDI server accepts the passcode that the user enters on the login page, then the secure gateway sends the client the system-assigned PIN. The client sends a response back to the secure gateway, indicating that the user has seen the new PIN, and the system continues with a “next passcode’ challenge. If the user chooses to create a new PIN, AnyConnect presents a dialog box on which to enter that PIN. The PIN must be a number from 4 to 8 digits long. Because the PIN is a type of password, anything the user enters into these input fields is displayed as asterisks. With RADIUS proxy, the PIN confirmation is a separate challenge, subsequent to the original dialog box. The client sends the new PIN to the secure gateway, and the secure gateway continues with a “next passcode” challenge. “Next Passcode” and “Next Token Code” ChallengesFor a “next passcode” challenge, the client uses the PIN value cached during the creation or assignment of a new PIN to retrieve the next passcode from the RSA SecurID Software Token DLL and return it to the secure gateway without prompting the user. Similarly, in the case of a “next Token Code” challenge for a software token, the client retrieves the next Token Code from the RSA SecurID Software Token DLL. Compare Native SDI with RADIUS SDIThe network administrator can configure the secure gateway to allow SDI authentication in either of the following modes:
Native SDI and RADIUS SDI appear identical to the remote user. Because the SDI messages are configurable on the SDI server, the message text on the ASA must match the message text on the SDI server. Otherwise, the prompts displayed to the remote client user might not be appropriate for the action required during authentication. AnyConnect might fail to respond and authentication might fail. RADIUS SDI challenges, with minor exceptions, essentially mirror native SDI exchanges. Since both ultimately communicate with the SDI server, the information needed from the client and the order in which that information is requested is the same. During authentication, the RADIUS server presents access challenge messages to the ASA. Within these challenge messages are reply messages containing text from the SDI server. The message text is different when the ASA is communicating directly with an SDI server from when communicating through the RADIUS proxy. Therefore, in order to appear as a native SDI server to AnyConnect, the ASA must interpret the messages from the RADIUS server. Also, because the SDI messages are configurable on the SDI server, the message text on the ASA must match (in whole or in part) the message text on the SDI server. Otherwise, the prompts displayed to the remote client user may not be appropriate for the action required during authentication. AnyConnect might fail to respond and authentication might fail. Configure the ASA to Support RADIUS/SDI MessagesTo configure the ASA to interpret SDI-specific RADIUS reply messages and prompt the AnyConnect user for the appropriate action, you must configure a connection profile (tunnel group) to forward RADIUS reply messages in a manner that simulates direct communication with an SDI server. Users authenticating to the SDI server must connect over this connection profile. ProcedureStep 1 Go to . Step 2 Select the connection profile you want to configure to interpret SDI-specific RADIUS reply messages and click Edit. Step 3 In the Edit AnyConnect Connection Profile window, expand the Advanced node in the navigation pane on the left and select Group Alias / Group URL. Step 4 Check Enable the display of SecurID messages on the login screen. Step 5 Click OK. Step 6 Choose. Step 7 Click Add to Add a AAA Server group. Step 8 Configure the AAA server group in the Edit AAA Server Group dialog and click OK. Step 9 In the AAA Server Groups area, select the AAA server group you just created and then click Add in the Servers in the Selected Group area. Step 10 In the SDI Messages area, expand the Message Table area. Double-click a message text field to edit the message. Configure the RADIUS reply message text on the ASA to match (in whole or in part) the message text sent by the RADIUS server. The following table shows the message code, the default RADIUS reply message text, and the function of each message: Note The default message text used by the ASA is the default message text used by Cisco Secure Access Control Server (ACS). If you are using Cisco Secure ACS, and it is using the default message text, you do not need to configure the message text on the ASA. Because the security appliance searches for strings in the order in which they appear in the table, you must ensure that the string you use for the message text is not a subset of another string. For example, “new PIN” is a subset of the default message text for both new-pin-sup and next-ccode-and-reauth. If you configure new-pin-sup as “new PIN,” when the security appliance receives “new PIN with the next card code” from the RADIUS server, it will match the text to the new-pin-sup code instead of the next-ccode-and-reauth code. Message Code Default RADIUS Reply Message Text Function next-code Enter Next PASSCODE Indicates the user must enter the NEXT tokencode without the PIN. new-pin-sup Please remember your new PIN Indicates the new system PIN has been supplied and displays that PIN for the user. new-pin-meth Do you want to enter your own pin Requests from the user which new PIN method to use to create a new PIN. new-pin-req Enter your new Alpha-Numerical PIN Indicates a user-generated PIN and requests that the user enter the PIN. new-pin-reenter Reenter PIN: Used internally by the ASA for user-supplied PIN confirmation. The client confirms the PIN without prompting the user. new-pin-sys-ok New PIN Accepted Indicates the user-supplied PIN was accepted. next-ccode-and-reauth new PIN with the next card code Follows a PIN operation and indicates the user must wait for the next tokencode and to enter both the new PIN and next tokencode to authenticate. ready-for-sys- pin ACCEPT A SYSTEM GENERATED PIN Used internally by the ASA to indicate the user is ready for the system-generated PIN. |
