Lately I’m busy with installing Cisco ASA’s and in particular 5510 ASA’s now I’m configuring also ssl vpn clients ( anyconnect ) on these Cisco ASA’s. Below I wanted to share an easy setup and working methode of a SSL VPN situation.
Example of below is based on ASA software 8.3 and asdm 6.3
Step 1: ( create names for networks )
names
name < network address > wpn_<name>
Step 2: ( ensure you can circulate traffic between networks )
same-security-traffic permit inter-interfacesame-security-traffic permit intra-interface
Step 3: ( ensure a Split Tunnel Access-list )
access-list remote_splitTunnelAcl standard permit < network address > < subnet address >
Step 4: ( create a network group )
object network WPN_<name>subnet < network address > < subnet address >
Step 5: ( ensure a No Nat access-list )
access-list acl_NONAT_out extended permit ip object <Local network object group > object < wpn object group>
Step 6: ( create a ip local pool for the sslvpn )
ip local pool WebVPNPool <network address.100-<network address>.200 mask <subnet address>
Step 7: ( create a nat entry )
nat (inside,any) source static Local-LAN Local-LAN destination static WPN_<name> WPN_<name>
Step 8: ( create a radius connection if you use radius )
aaa-server <servername> protocol radiusaaa-server <servername> (inside) host < ip address server >timeout 5key <keyname>
Step 9: ( Webvpn configuration ( ensure you upload the correct/latest anyconnect software ) )
webvpnenable outsidesvc image disk0:/anyconnect-win-2.5.0217-k9.pkg 3svc image disk0:/anyconnect-macosx-i386-2.5.0217-k9.pkg 4svc enabletunnel-group-list enablegroup-policy WebVPNPolicy internalgroup-policy WebVPNPolicy attributesdns-server value <dns server >vpn-tunnel-protocol svcgroup-lock value WebVPNAccessProfilesplit-tunnel-policy tunnelspecifiedsplit-tunnel-network-list value remote_splitTunnelAcldefault-domain value <domainname>.localaddress-pools value WebVPNPoolwebvpnsvc ask none default svchidden-shares nonefile-entry disablefile-browsing disableurl-entry disable
Step 10: ( create tunnel-groups )
tunnel-group WebVPNAccessProfile type remote-accesstunnel-group WebVPNAccessProfile general-attributesauthentication-server-group <radius groupname > LOCALdefault-group-policy WebVPNPolicytunnel-group WebVPNAccessProfile webvpn-attributesgroup-alias WebVPN enable
Pingback: Configuring SSL VPN on a Cisco ASA 5510 « Glazenbakjes Weblog « Chicago Mac/PC Support
This is great information , thank you, I am new to ASA5510 configuration and i will appreciated if you can provide me with sample congiuration of the ASA5510,
if you accept iw ill send my my ASA5510 congiuration, i need two cleints coputers from out side to access only two servers from the insdie, can this be doneon the firewall ASA5510. Thank you