Cisco Anyconnect Static Ip

Introduction

This document describes how to configure the Cisco 5500 Series Adaptive Security Appliance (ASA) to provide the Static IP address to the VPN client with the Adaptive Security Device Manager (ASDM) or CLI. The ASDM delivers world-class security management and monitoring through an intuitive, easy-to-use Web-based management interface. Once the Cisco ASA configuration is complete, it can be verified with the Cisco VPN Client.

Hi Bob, I am having issues with drop out and data corruption using my companies VPN Cisco client. I have seen you managed to help others with this issue regarding a static IP address. I've tried every setting in the router to try and fix (DMZ/port forwarding/Port clamping/firewall off/etc). I have fully functional cisco Anyconnect VPN running on Cisco ASA5585-X and today i got requirement that there are some remote public sites we need to whitelist our VPN public IP to access them over VPN, so anyone over cisco anyconnect can access those remote sites. Static Exceptions—IP addresses or hostnames listed here are excluded from scanning and AnyConnect. ISE Server Requirements ISE servers must always be listed in the static exception list, which is configured on the Exceptions pane of the Web Security client profile. Jun 06, 2018 Cisco AnyConnect VPN with Shared IP Addresses Sometimes it makes sense to give VPN users an IP address from an existing range though. I ran into this last week when a manufacturer needed to add Cisco AnyConnect (Cisco’s remote access VPN client) functionality to a Cisco ASA.

Refer to PIX/ASA 7.x and Cisco VPN Client 4.x with Windows 2003 IAS RADIUS (Against Active Directory) Authentication Configuration Example in order to set up the remote access VPN connection between a Cisco VPN Client (4.x for Windows) and the PIX 500 Series Security Appliance 7.x. The remote VPN Client user authenticates against the Active Directory with a Microsoft Windows 2003 Internet Authentication Service (IAS) RADIUS server.

Refer to PIX/ASA 7.x and Cisco VPN Client 4.x for Cisco Secure ACS Authentication Configuration Example in order to set up a remote access VPN connection between a Cisco VPN Client (4.x for Windows) and the PIX 500 Series Security Appliance 7.x with a Cisco Secure Access Control Server (ACS version 3.2) for extended authentication (Xauth).

If you are looking for the Anyconnect configuration example document, please refer to 'Configure AnyConnect VPN Client on FTD: Hairpining and NAT Exemption' document. Configure Step 1. Configure DHCP Scope in the DHCP Server. In this scenario, the DHCP server is located behind the FTD's inside interface. Vlc download for mac free.

Prerequisites

Requirements

This document assumes that the ASA is fully operational and configured to allow the Cisco ASDM or CLI to make configuration changes.

Note: Refer to Allowing HTTPS Access for ASDM or PIX/ASA 7.x: SSH on the Inside and Outside Interface Configuration Example to allow the device to be remotely configured by the ASDM or Secure Shell (SSH).

Components Used

The information in this document is based on these software and hardware versions:

Cisco Adaptive Security Appliance Software Version 7.x and later
Adaptive Security Device Manager Version 5.x and later
Cisco VPN Client Version 4.x and later

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, make sure that you understand the potential impact of any command.

Related Products

This configuration can also be used with Cisco PIX Security Appliance Version 7.x and later.

Conventions

Refer to Cisco Technical Tips Conventions for more information on document conventions.

Configure

In this section, you are presented with the information to configure the features described in this document.

Note: Use the Command Lookup Tool (registered customers only) in order to obtain more information on the commands used in this section.

Network Diagram

This document uses this network setup:

Note: The IP addressing schemes used in this configuration are not legally routable on the Internet. They are RFC 1918 addresses, which were used in a lab environment.

Configure Remote Access VPN (IPSec)

ASDM Procedure

Complete these steps in order to configure the remote access VPN:

Choose Configuration > Remote Access VPN > Network (Client) Access > Advanced > IPSec > IKE Policies > Add in order to create a ISAKMP policy.
Provide the ISAKMP policy details.
Click OK and Apply.
Choose Configuration > Remote Access VPN > Network (Client) Access > Advanced > IPSec > IKE Parameters to enable the IKE on the Outside Interface.
Choose Configuration > Remote Access VPN > Network (Client) Access > Advanced > IPSec > IPSec Transform Sets > Add in order to create the ESP-DES-SHA transform set, as shown.
Click OK and Apply.
Choose Configuration > Remote Access VPN > Network (Client) Access > Advanced > IPSec > Crypto Maps > Add in order to create a crypto map with dynamic policy of priority 1, as shown.
Click OK and Apply.
Choose Configuration > Remote Access VPN > AAA Setup > Local Users > Add in order to create the user account (for example, username - cisco123 and Password - cisco123) for VPN client access.
Go to VPN Policy and add the Static/Dedicated IP Address for user 'cisco123,' as follows.
Choose Configuration > Remote Access VPN > Network (Client) Access > Address Assignment > Address Pools and click Add to add the VPN Client for VPN Client users.
Choose Configuration > Remote Access VPN > Network (Client) Access > IPSec Connection Profiles > Add in order to add a tunnel group (for example, TunnelGroup1 and the Preshared key as cisco123), as shown.
- Under the Basic tab, choose the server group as LOCAL for the User Authentication field.
- Choose vpnclient1 as the Client Address Pools for the VPN Client users.
Click OK.
Choose Advanced > Client Addressing and check the Use address pool check box to assign the IP Address to the VPN clients.
Note: Make sure to uncheck the check boxes for Use authentication server and Use DHCP.
Click OK.
Enable the Outside interface for IPSec Access. Click Apply to proceed.

Configure the ASA/PIX with CLI

Complete these steps in order to configure the DHCP server to provide IP addresses to the VPN clients from the command line. Refer to Configuring Remote Access VPNs or Cisco ASA 5500 Series Adaptive Security Appliances-Command References for more information on each command that is used.

Running Configuration on the ASA Device

Cisco VPN Client Configuration

Attempt to connect to the Cisco ASA with the Cisco VPN Client in order to verify that the ASA is successfully configured.

Choose Start > Programs > Cisco Systems VPN Client > VPN Client.
Click New to launch the Create New VPN Connection Entry window.
Fill in the details of your new connection.
Enter the name of the Connection Entry along with a description. Enter the outside IP address of the ASA in the Host box. Then enter the VPN Tunnel Group name (TunnelGroup1) and password (Pre-shared Key - cisco123) as configured in ASA. Click Save. Wireless for mac mini.
Click the connection that you want to use, and click Connect from the VPN Client main window.
When prompted, enter the Username : cisco123 and Password : cisco123 as configured in the ASA for Xauth, and click OK to connect to the remote network.
The VPN Client is connected with the ASA at the central site.
Once the connection is successfully established, choose Statistics from the Status menu to verify the details of the tunnel.

Verify

show Commands

Use this section to confirm that your configuration works properly.

Install Cisco Anyconnect Vpn

The Output Interpreter Tool (registered customers only) (OIT) supports certain show commands. Use the OIT to view an analysis of show command output.

show crypto isakmp sa—Shows all current IKE Security Associations (SAs) at a peer.
show crypto ipsec sa—Shows the settings used by current SAs. Is planetside 2 for mac.

Troubleshoot

This section provides information you can use to troubleshoot your configuration. Sample debug output is also shown.

Note: For more information on troubleshooting Remote Access IPSec VPN refer Most Common L2L and Remote Access IPSec VPN Troubleshooting Solutions.

Clear Security Associations

When you troubleshoot, make sure to clear existent Security Associations after you make a change. In the privileged mode of the PIX, use these commands: