This document describes how to configure the Cisco AnyConnect Secure Mobility Client via the Cisco Adaptive Security Device Manager (ASDM) on a Cisco Adaptive Security Appliance (ASA) that runs software Version 9.3(2).
The Cisco AnyConnect Secure Mobility Client web deployment package should be downloaded to the local desktop from which the ASDM access to the ASA is present. In order to download the client package, refer to the Cisco AnyConnect Secure Mobility Client web page. The web deployment packages for various Operating Systems (OSs) can be uploaded to the ASA at the same time.
This document provides step-by-step details about how to use the Cisco AnyConnect Configuration Wizard via the ASDM in order to configure the AnyConnect Client and enable split tunneling.
Split-tunneling is used in scenarios where only specific traffic must be tunneled, opposed to scenarios where all of the client machine-generated traffic flows across the VPN when connected. Use of the AnyConnect Configuration Wizard will by default result in a tunnel-all configuration on the ASA. Split tunnelling must be configured separately, which is explained in further detail in the Split Tunnel section of this document.
In this configuration example, the intention is to send traffic for the 10.10.10.0/24 subnet, which is the LAN subnet behind the ASA, over the VPN tunnel and all other traffic from the client machine is forwarded via its own Internet circuit.
Refer to the AnyConnect Secure Mobility Client Features, Licenses, and OSs, Release 3.1 document in order to determine the licenses that are required for AnyConnect Secure Mobility Client and the related features.
Refer to the Cisco AnyConnect Ordering Guide for information about AnyConnect Apex and Plus licenses.
Refer to the What ASA License Is Needed for IP Phone and Mobile VPN Connections? document for information about the additional license requirements for IP phone and mobile connections.
This section describes how to configure the Cisco AnyConnect Secure Mobility Client on the ASA.
Note: Use the Command Lookup Tool (registered customers only) in order to obtain more information on the commands that are used in this section.
The AnyConnect Configuration Wizard can be used in order to configure the AnyConnect Secure Mobility Client. Ensure that an AnyConnect client package has been uploaded to the flash/disk of the ASA Firewall before you proceed.
Check the SSL check box in order to enable Secure Sockets Layer (SSL). The Device Certificate can be a trusted third party Certificate Authority (CA) issued certificate (such as Verisign, or Entrust), or a self-signed certificate. If the certificate is already installed on the ASA, then it can be chosen via the drop down menu.
Note: This certificate is the server-side certificate that will be provided. If there are no certificates currently installed on the ASA, and a self-signed certificate must be generated, then click Manage.
In order to install a third-party certificate, complete the steps that are described in the ASA 8.x Manually Install 3rd Party Vendor Certificates for use with WebVPN Configuration Example Cisco document.
The user authentication can be completed via the Authentication, Authorization, and Accounting (AAA) server groups. If the users are already configured, then choose LOCAL and click Next.
Note: In this example, LOCAL authentication is configured, which means that the local user database on the ASA will be used for authentication.
In this scenario, the objective is to restrict access over the VPN to the 10.10.10.0/24 network that is configured as the Inside (or LAN) subnet behind the ASA. The traffic between the client and the inside subnet must be exempt from any dynamic Network Address Translation (NAT).
Click Next, Next, and then Finish.
The AnyConnect Client configuration is now complete. However, when you configure AnyConnect via the Configuration Wizard, it configures the Split Tunnel policy as Tunnelall by default. In order to tunnel specific traffic only, split-tunneling must be implemented.
Note: If split-tunnelling is not configured, the Split Tunnel policy will be inherited from the default group-policy (DfltGrpPolicy), which is by default set to Tunnelall. This means that once the client is connected over VPN, all of the traffic (to include the traffic to the web) is sent over the tunnel.
Only the traffic that is destined to the ASA WAN (or Outside) IP address will bypass the tunneling on the client machine. This can be seen in the output of the route print command on Microsoft Windows machines.
Split tunnelling is a feature that you can use in order to define the traffic for the subnets or hosts that must be encrypted. This involves the configuration of an Access Control List (ACL) that will be associated with this feature. The traffic for the subnets or hosts that is defined on this ACL will be encrypted over the tunnel from the client-end, and the routes for these subnets are installed on the PC routing table.
!! This is the split tunnel route.
!! This is the route for the ASA Public IP Address.
Both of these methods are explained in greater detail in the sections that follow.
In order to use the web deployment method, enter the https://<ASA FQDN>or<ASA IP> URL into a browser on the client machine, which brings you to the WebVPN portal page.
Note: If Internet Explorer (IE) is used, the installation is completed mostly via ActiveX, unless you are forced to use Java. All other browsers use Java.
Once logged into the page, the installation should begin on the client machine, and the client should connect to the ASA after the installation is complete.
Note: You might be prompted for permission to run ActiveX or Java. This must be allowed in order to proceed with the installation.
Download the AnyConnect Client image from the Cisco website. In order to choose the correct image for download, refer to the Cisco AnyConnect Secure Mobility Client web page. A download link is provided on this page. Navigate to the download page and select the appropriate version. Perform a search for Full installation package - Window / Standalone installer (ISO).
Note: An ISO installer image is then downloaded (such as anyconnect-win-3.1.06073-pre-deploy-k9.iso).
Once the contents are extracted, run the Setup.exe file and choose the modules that must be installed along with Cisco AnyConnect Secure Mobility Client.
Tip: In order to configure additional settings for the VPN, refer the Configuring AnyConnect VPN Client Connections section of the Cisco ASA 5500 Series Configuration Guide using the CLI, 8.4 and 8.6.
This section provides the CLI configuration for the Cisco AnyConnect Secure Mobility Client for reference purposes.
!Remote LAN(s) from getting NATted on any dynamic NAT rule.
!ACL, etc. can be configured.
You can use the Filter By option in order to filter the type of VPN. Select AnyConnect Client from the drop down menu and all of the AnyConnect Client sessions.
Tip: The sessions can be further filtered with the other criteria, such as Username and IP address.
You can use the AnyConnect Diagnostics and Reporting Tool (DART) in order to collect the data that is useful for troubleshooting AnyConnect installation and connection problems. The DART Wizard is used on the computer that runs AnyConnect. The DART assembles the logs, status, and diagnostic information for the Cisco Technical Assistance Center (TAC) analysis and does not require administrator privileges to run on the client machine.
Browse to the folder to which the contents were extracted.
The issue must be recreated at least once before you run the DART.
The date and time on the user machine must be noted when the issue is recreated.
Either Default or Custom mode can be selected. Cisco recommends that you run the DART in the Default mode so that all of the information can be captured in a single shot.
Once completed, the tool saves the DART bundle .zip file to the client desktop. The bundle can then be emailed to the TAC (after you open a TAC case) for further analysis.