{"id":203,"date":"2016-02-25T16:56:31","date_gmt":"2016-02-25T16:56:31","guid":{"rendered":"https:\/\/thecligeek.com\/?p=203"},"modified":"2016-05-20T11:19:31","modified_gmt":"2016-05-20T11:19:31","slug":"full-tinnel-anyconnect-ssl-vpn","status":"publish","type":"post","link":"https:\/\/thecligeek.com\/?p=203","title":{"rendered":"Full-Tunnel AnyConnect SSL VPN"},"content":{"rendered":"<p>In this article, I&#8217;d like to show you my simple way to configure the full tunnel SSL VPN through the CLI (command-line interface). You may be wondering why I don&#8217;t simply use the graphical user interface like an ASDM. Yes, you can do that, but in my opinion if you want to be a professional, you should be able <!--more-->to configure the network devices through the CLI.<\/p>\n<p>Let me say couple of words about benefits of using the full tunnel SSL VPN. It supports low-latency forwarding of delay-sensitive applications, such as IP voice, because of DTLS (Datagram Transport Layer Security) encapsulation. DTLS is a standard SSL protocol defined in RFC 4347. It improves the application performance because UDP transport does not trigger packet retransmission at the VPN layer. The UDP header is simpler than TCP, creates less overhead, and consumes fewer resources. It makes VPN connection much more quicker.<\/p>\n<p><iframe loading=\"lazy\" src=\"https:\/\/www.youtube.com\/embed\/B9pE3ut63Es?enablejsapi=1\" width=\"600\" height=\"299\" frameborder=\"0\" allowfullscreen=\"allowfullscreen\"><\/iframe><\/p>\n<p>Our plan is to connect the client from the Internet to internal network. We have the Cisco ASA Firewall (software version 9) and AnyConnect VPN client (version 4).<\/p>\n<p><code><font color=\"black\">object network inside_net<br \/>\nsubnet 192.168.9.0 255.255.255.0<br \/>\nobject network AnyConnect<br \/>\nsubnet 192.168.50.0 255.255.255.0<br \/>\nnat (inside,outside) source static inside_net inside_net destination static AnyConnect AnyConnect<br \/>\naccess-list AnyConnect-ACL standard permit 192.168.9.0 255.255.255.0<br \/>\nip local pool AnyConnect-Pool 192.168.50.1-192.168.50.10 mask 255.255.255.0<br \/>\ngroup-policy AnyConnect-GP internal<br \/>\ngroup-policy AnyConnect-GP attributes<br \/>\nvpn-tunnel-protocol ssl-client<br \/>\nsplit-tunnel-policy tunnelspecified<br \/>\nsplit-tunnel-network-list value AnyConnect-ACL<br \/>\ntunnel-group AnyConnect-TG type remote-access<br \/>\ntunnel-group AnyConnect-TG general-attributes<br \/>\naddress-pool AnyConnect-Pool<br \/>\ndefault-group-policy AnyConnect-GP<br \/>\ntunnel-group AnyConnect-TG webvpn-attributes<br \/>\ngroup-alias \"IT staff\" enable<br \/>\nusername john password Cisco123 privilege 0<br \/>\nusername john attributes<br \/>\nservice-type remote-access<br \/>\ngroup-lock value AnyConnect-TG<br \/>\nexit<br \/>\nwebvpn<br \/>\nno anyconnect-essentials<br \/>\nanyconnect image disk0:\/anyconnect.pkg<br \/>\nenable outside<br \/>\nanyconnect enable<br \/>\ntunnel-group-list enable<br \/>\nwrite memory<br \/>\nend<\/font><\/code><\/p>\n<p>Session and configuration information:<br \/>\n<code><font color=\"black\">show vpn-sessiondb anyconnect<br \/>\nshow running-config username john<br \/>\nshow running-config tunnel-group AnyConnect-TG<br \/>\nshow running-config group-policy AnyConnect-GP<br \/>\nshow running-config webvpn<\/font><\/code><\/p>\n<p>Troubleshooting:<br \/>\n<code><font color=\"black\">(config)# logging enable<br \/>\n(config)# logging timestamp<br \/>\n(config)# logging buffered debugging<br \/>\n(config)# logging class auth buffered debugging<br \/>\n(config)# logging class webvpn buffered debugging<br \/>\n(config)# logging class ssl buffered debugging<br \/>\n(config)# logging class svc buffered debugging<\/font><\/code><\/p>\n<p>OK, that may seem like a lot. So let&#8217;s break down these commands to see what these commands are actually doing.<\/p>\n<p>The network objects we are going to use in NAT exception and the traffic between VPN clients and the internal network will be exempted from the normal NAT rules.<br \/>\n<code><font color=\"black\">object network inside_net<br \/>\nsubnet 192.168.9.0 255.255.255.0<br \/>\nobject network AnyConnect<br \/>\nsubnet 192.168.50.0 255.255.255.0<br \/>\nnat (inside,outside) source static inside_net inside_net destination static AnyConnect AnyConnect<\/font><\/code><\/p>\n<p>ACL is going to be used in split tunnel. I should mention that by default, everything goes through the tunnel, and if you want to change this behavior you have to use split tunneling. Split tunneling provides a way to control access through a VPN connection by allowing you to specify destination networks, subnets, or host a remote user must access through the VPN tunnel.<br \/>\n<code><font color=\"black\">access-list AnyConnect-ACL standard permit 192.168.9.0 255.255.255.0<\/font><\/code><\/p>\n<p>To assign an IP addresses to remote clients we are going to use an address pool. I prefer to keep remote clients in different network, but if you want you can use the IP addresses from the internal network space. Just don&#8217;t forget to create an exclusion range in DHCP.<br \/>\n<code><font color=\"black\">ip local pool AnyConnect-Pool 192.168.50.1-192.168.50.20 mask 255.255.255.0<\/font><\/code><\/p>\n<p>For our group-policy we want to specify which VPN protocol it&#8217;s going to support and its SSL client (<code><font color=\"black\">vpn-tunnel-protocol ssl-client<\/font><\/code>), and here we need to configure the split tunnel.<br \/>\n<code><font color=\"black\">group-policy AnyConnect-GP internal<br \/>\ngroup-policy AnyConnect-GP attributes<br \/>\nvpn-tunnel-protocol ssl-client<br \/>\nsplit-tunnel-policy tunnelspecified<br \/>\nsplit-tunnel-network-list value AnyConnect-ACL<\/font><\/code><\/p>\n<p>After a group-policy we are ready to create a connection profile to allow remote users to connect into our internal network. When you work with tunnel group at the CLI, tunnel group is nothing more than connection profile.<\/p>\n<p>I suggest you create a connection profile for each user group (for example, IT group, sales group and so on). If you don&#8217;t create connection profiles, the incoming connections are going to use the default connection profile, which is not a good idea. This tunnel group is tied to group-policy (<code><font color=\"black\">default-group-policy AnyConnect-GP<\/font><\/code>) and has the alias &#8216;IT staff&#8217; (<code><font color=\"black\">group-alias \"IT staff\" enable<\/font><\/code>).<br \/>\n<code><font color=\"black\">tunnel-group AnyConnect-TG type remote-access<br \/>\ntunnel-group AnyConnect-TG general-attributes<br \/>\naddress-pool AnyConnect-Pool<br \/>\ndefault-group-policy AnyConnect-GP<br \/>\ntunnel-group AnyConnect-TG webvpn-attributes<br \/>\ngroup-alias \"IT staff\" enable<\/font><\/code><\/p>\n<p>And last but not least we need to create a user account, because in this case we are going to use the simplest authentication method to authenticate users and it&#8217;s a local database. We also want to specify for this user that we are going to lock him into using a specific connection profile (<code><font color=\"black\">group-lock value AnyConnect-TG<\/font><\/code>).<br \/>\n<code><font color=\"black\">username john password Cisco123 privilege 0<br \/>\nusername john attributes<br \/>\nservice-type remote-access<br \/>\ngroup-lock value AnyConnect-TG<\/font><\/code><\/p>\n<p>When everything is ready we can enable SSL on the outside interface. Additionally, we want clients to be able to receive the drop down box of aliases (<code><font color=\"black\">tunnel-group-list enable<\/font><\/code>) for the connection profile.<br \/>\n<code><font color=\"black\">webvpn<br \/>\nno anyconnect-essentials<br \/>\nanyconnect image disk0:\/anyconnect.pkg<br \/>\nenable outside<br \/>\nanyconnect enable<br \/>\ntunnel-group-list enable<\/font><\/code><br \/>\nNow, you&#8217;re able to download the VPN client. For that you need to go to https:\/\/Public-IP.<\/p>\n<p>As you noticed I&#8217;m using a simple order of rules. We created our group-policy first, we then created a tunnel group (or connection profile, if you like), we then created the user and we linked them together.<\/p>\n<p>One more thing, guys. If you&#8217;re using the IKEv1 or IKEv2 for site-to-site or remote access you definitely should check this information about <a href=\"https:\/\/tools.cisco.com\/security\/center\/content\/CiscoSecurityAdvisory\/cisco-sa-20160210-asa-ike\" target=\"_blank\">critical vulnerability<\/a>.<\/p>\n<p>That&#8217;s it. Enjoy.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In this article, I&#8217;d like to show you my simple way to configure the full tunnel SSL VPN through the CLI (command-line interface). You may be wondering why I don&#8217;t simply use the graphical user interface like an ASDM. Yes, you can do that, but in my opinion if you want to be a professional, &hellip; <a href=\"https:\/\/thecligeek.com\/?p=203\" class=\"more-link\">Continue reading<span class=\"screen-reader-text\"> &#8220;Full-Tunnel AnyConnect SSL VPN&#8221;<\/span><\/a><\/p>\n","protected":false},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[25,32,26],"tags":[30,27,31,29,28],"class_list":["post-203","post","type-post","status-publish","format-standard","hentry","category-cisco","category-ssl","category-vpn","tag-anyconnect","tag-cisco","tag-full-tunnel","tag-ssl","tag-vpn"],"_links":{"self":[{"href":"https:\/\/thecligeek.com\/index.php?rest_route=\/wp\/v2\/posts\/203","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thecligeek.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thecligeek.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thecligeek.com\/index.php?rest_route=\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/thecligeek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=203"}],"version-history":[{"count":60,"href":"https:\/\/thecligeek.com\/index.php?rest_route=\/wp\/v2\/posts\/203\/revisions"}],"predecessor-version":[{"id":378,"href":"https:\/\/thecligeek.com\/index.php?rest_route=\/wp\/v2\/posts\/203\/revisions\/378"}],"wp:attachment":[{"href":"https:\/\/thecligeek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=203"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thecligeek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=203"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thecligeek.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=203"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}