Apr 14

implementing AnyConnect SSL VPN client

Categories:

Cisco

by

Today I would like to discuss quick way of implementing AnyConnect SSL VPN client using ASDM . Before that let’s go through why need VPN and it’s type in briefly .

Why we need / use VPNS

it is simple because of C I A (Confidentiality , Integrity of the data, Availability)

Types of VPN

01) Remote Access VPNs (RA)

i) SSL no client software (clientless SSL VPN)

* Client-less SSL VPN requires a browser that support SSL/TLS, and uses the public PKI (Public Key Infrastructure)

ii) SSL FUll Tunnel with AnyConnect client software

*Client is assigned a ip address from ip address pool
* Client computer should have admin rights to install Anyconnect software
* Anyconnect software ask groups  when connecting and it is referin to  ASA’s connection profiles ( tunnel-groups )

iii) IPsec RA Full Tunnel VPN Client or AnyConnect

* VPN Client only support IPsec but AnyConnect support both IPsec and SSL

2) Site to site VPNs

IPsec Site to Site VPN – peer to peer Gateways

 

SSL Tunnel Types

* Full tunnel :– Client machine sends all traffic to vpn tunnel even internet traffic. (can’t browse internet or can’t access LAN )
* Split tunnel :- Client machine only sends vpn traffic to the tunnel while internet traffic physical interface. (can browse internet or can access LAN )

Below is most essential components of AnyConnect SSL VPN. Let’s look at how join these pieces together and configure the VPN
i ) Connection Profiles
ii ) group
iii) users
iv) Address pool
v ) tunnel only (Full or split )

01) Create group policy

“Configuration” –> “Group Policies” click on “+ add”

vpn group ploicy

 

 

 

 

 

 

 

 

 

 

 

 

then set ‘group Name‘ and ‘Address pool‘ which is going to assign to vpn clients

02) Split tunnel

On the “Add Internal Group Policy” window which use on step 01 , click on Advanced to expand “split Tunneling”
untick “Policy” Inherit and choose “Tunnel Network List Below” from drop down.

You need to define (by clicking manage) vpn pool ip address range from “Network List“, then only split tunnel starts to work

split tunnel

 

 

 

 

 

 

 

 

 

 

Click “ok” and apply it to ASA

03) Create Connection Profiles

Go to “configuration” –> “AnyConnect Connection Profiles”

 

connection profile

 

 

 

 

 

 

 

 

 

 

 

 

i) define connection profile name
ii) Select “Client Address Pools”
iii) Choose “Group Policy” Which is created on previous step

Click “ok” and apply it to ASA as previously did

04) Add new User

Go to “configuration” –> “AAA/Local Users” then select “Local Users”

Set Username and password for new user and Privilege level as you need

Then select “VPN Policy” and left hand within same window. select correct previously created “Group Policy” from drop down

 

new user

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

05) Enable Anyconnect connection to ASA

Go to “configuration” –> “AnyConnect Connection Profiles”
tick “Enable Cisco AnyConnect VPN client access on the interface selected in the table below”
make sure your correct interfaces are ticked
bonus :- this will ask to Add AnyConnect Client image, if you have you can configure this as well

 

 

enable anyconnect connection

 

 

 

 

 

 

 

 

 

06) Connecting AnyConnect SSL VPN

Launch AnyConnect Software, enter ASA vpn gateway ip address then select correct Group and enter username and password

07) Verify VPN

Go to “Monitoring” –> select “VPN” from bottom then select “sessions” , it will display all vpn session and you can filter AnyConnect VPN session from there.

Leave comment

Mar 28

Enable built-in Administrator account on Windows 8

Categories:

Windows

by

I saw that most of tutorials available on web does not properly guide how to enable built-in Administrator account on Windows 8 . So I thought to write this tutorial to fill the gap of it. So let’s look at how to do it.

1) Add “This PC” shortcut on Desktop

this is optional, if your desktop has “This PC” shortcut you jump into step 2

i) Right click on Desktop select  “Personalize”

ii) Then click on “Change desktop icons” –> and tick “Computer”.

 

enable 'This PC' shortcut

 

 

 

 

 

 

 

 

 

2) Open  “Computer Management”

Right Click on “This PC” shortcut –> then select “Manage”

3) Enable built-in Administrator user

Expand “Local Users and Groups” then you can see Administrator user which has following description
“Built-in account for administering the computer/domain”

 

computer management

 

 

 

 

 

 

 

 

 

By right clicking Administrator user, you can reset the password . Also “properties”  provides extra options of the user such as Enable / Disable user , assign to groups etc. So Congratulation you enable built-in Administrator account on Windows 8  🙂

4) Add new Administrator user

i) Add new user by right clicking the “Users”

ii) Select “Groups” the right click on “Administrators” choose “Properties”
then add existing user to this Administrator group.

Leave comment

Feb 13

Configuring NTP on Cisco device

Categories:

Cisco

by

Network Time Protocol also know as NTP is very essential component on networking devices. When devices are growing on the data center, it is not possible to set time manually on each devices. NTP protocol play major role here while setting the time automatically. There are few benefits of having same time on each devices. It is helpful to troubleshoot device issues such as hardware failures, devices up / down  and also identifying the application levels issues by reading the logs file. Here I’m going to show you how to configure time of Cisco router using NTP protocol but remember if you have different Cisco devices running IOS , then the process is same as below. So let’s go through configuring NTP on Cisco .

1) Peering with NTP server

2) Set NTP to update / sync hardware clock

3) Cisco Set the time zone

That’s all , so how to verify whether NTP is working properly.

i) Check ntp status

This will show local clock is synced with the remote NTP server.

ii) Check ntp associations

if the the sync is successful, there will be “*” symbol infornt of address entry like below.

 

 

iii) NTP associations in detail

 

 

iv) Check the time

 

Troubleshooting the Cisco NTP.

Read official Cisco documention for NTP troubleshooting here

1 comment

Older posts «

» Newer posts

Fetch more items