Cisco FTD Deploy AnyConnect (from FDM)

KB ID 0001682

Problem

In this article I will focus on ‘Remote Access’ VPN, which for Cisco FTD means using the AnyConnect client. Ive spent years deploying this solution for ASA so it’s a product I know well. As with all things Cisco, there are a couple of things that could trip you up. Let’s get them out of the way first.

If you are used to AnyConnect then you probably have the client software. It’s the same software package that’s installed with Cisco ASA. Sometimes just getting access to the download is a trial! Anyway you will need the AnyConnect ‘Package’ files, these typically have a .pkg extension, (Cisco refer to these as Head-End packages). Theres one for macOS, one for Windows, (well another one now for ARM processors, but I’ve not needed it yet), and one for Linux. You will need to download a package for each platform your users will need to connect with.

AnyConnect Licence! After years of getting a few free with a Cisco ASA, I was unhappy to find that’s not the case with Cisco FTD. If you want to use AnyConnect you need to have a licence, and it needs to be in your Smart Licensing Account, (before you enable Remote Access VPN). 

Final Gotcha! Make sure you HAVE NOT enabled HTTPS management on the outside interface of the FTD before you start configuring AnyConnect, or you will get all the way to the end, and it will fall over and you will have to start again (thanks Cisco! How hard would it be to say, if you enable this, I will disable https outside management is this OK?) 

Solution

If you haven’t already done so enable the Remote Access VPN licence > Smart Licence > Fire Configuration > RA VPN  License > Enable > Change to licence type (mines Apex). Have a coffee and recheck everything is licensed OK.

AnyConnect 4 – Plus and Apex Licensing Explained

Remote Access VPN > Configure > Create Connection Profile.

Give the profile a name, a group alias, and group URL > I’m using the FTD as my AAA Identity source (so my username and passwords are held on the firewall) that’s fine for small deployments, but in production you should think about deploying an AAA solution (called a Special Identities Realm in FTD). Scroll down.

I typically create a new network object for my remote clients to use, you can select your internal DHCP server to send out addresses if you wish > Next.

I’m using Cisco Umbrella DNS servers, (or the DNS servers formally known as OpenDNS) > I’m setting a ‘welcome banner’ but you dont need to, (some people find them annoying!) > Scroll down.

Split tunnelling: As always Cisco assume you want to tunnel everything, in most cases that’s NOT the requirement (BUT it IS the most secure!) I setup split tunnelling by Excluding my internal networks > Next.

Client Profiles: If you have one you can set it here, if you want to create one, see the following article;

Cisco FTD (and ASA) Creating AnyConnect Profiles

Select the certificate the FTD will present (don’t choose the web one it will error!) > Select the interface your client will connect to (typically outside) > Enter the FQDN of the device > I allow bypass for VPN traffic, if you want to scan remote traffic with firepower etc DON’T select this > Enable NAT Exemption (select the internal interface) > Internal Networks: Then add in the internal network, I’ve already got an object for that, (you may need to create one.) > Scroll down.

Here you upload your .pkg files (I mentioned above) when you have finished > Next.

Review the settings > Finish.

Cisco FTD Create User (via FDM)

You will need a username and password to authenticate (skip this as you are not using the FTD’s internal user database.) Objects > Users > Add > Supply a username and password > OK

Pending Changes > Deploy Now.

Go and have a coffee again, keep clicking pending changes until it looks like this. (Quite why it takes so long, I have no idea?) It’s even more fun, if you made a mistake, because it will just error and fall over, so you have to find the error (if you can) > then remove the pending change and start all over again. Cheers Cisco!

Finally go to an external client and give it a try, if your clients don’t have the client software installed simply ‘browse’ to the FTD to get it.

Related Articles, References, Credits, or External Links

Cisco Firepower 1010 Configuration

Securing Cisco SSL VPN’s with Certificates

KB ID 0000335

Problem

It’s been a while since I wrote a walk though on the Cisco AnyConnect/SSL VPN solution, and usually I secure these with Active Directory or simply using the local user database on the firewall. But what if you wanted to use certificates instead? Perhaps your users are too “technically challenged” to remember their passwords. Or you want to enable two factor authentication with usernames/passwords AND certificates (something you know and something you have).

Solution

Step 1: Setup the ASA as a Certificate Authority

After version 8 Cisco included a complete CA solution in the firewall with a web front end. to use it we need to a) turn it on, b) give it an email address, c) provide a subject name, and finally d) create a unique pass phrase to generate the root certificate from.

Connect to the firewall and carry out the following,

[box]

PetesASA>
PetesASA> en
Password: ********
PetesASA# conf t
PetesASA(config)# crypto ca server
PetesASA(config-ca-server)# smtp from-address pnlCA@petenetlive.com
PetesASA(config-ca-server)# subject-name-default cn=pnlCA, o=petenetlive, c=GB
PetesASA(config-ca-server)# no shutdown

% Some server settings cannot be changed after CA certificate generation.
% Please enter a passphrase to protect the private key
% or press return to exit
Passphrase: ********

Re-enter passphrase: ********

Keypair generation process begin. Please wait...

Completed generation of the certificate and keypair...

Archiving certificate and keypair to storage... Complete
INFO:
Certificate Server enabled.
PetesASA(config-ca-server

[/box]

To do the same via ASDM connect to the ASDM > Navigate to Configuration > Remote Access VPN > Certificate Management > Local Certificate Authority > CA Server > Fill in the details > Apply.

To check that the CA Server is up and running issue a “show crypto ca server” command.

[box]


PetesASA# show crypto ca server

Certificate Server LOCAL-CA-SERVER:
Status: enabled <--Good!
State: enabled <--Good!
Server's configuration is locked (enter "shutdown" to unlock it)
Issuer name: CN=PetesASA.petenetlive.com
CA certificate fingerprint/thumbprint: (MD5)
774e1fe0 27495b35 019a9874 7507d8a9
CA certificate fingerprint/thumbprint: (SHA1)
93414d52 5f23e510 0f7f8fc2 857e3c86 d5687286
Last certificate issued serial number: 0x1
CA certificate expiration timer: 12:33:29 UTC Sep 30 2013
CRL NextUpdate timer: 18:33:29 UTC Oct 1 2010
Current primary storage dir: flash:/LOCAL-CA-SERVER/

Auto-Rollover configured, overlap period 30 days
Autorollover timer: 12:33:29 UTC Aug 31 2013
PetesASA#

[/box]

Step 2: Obtain a Client Certificate

If you have a LOT of these you can set them up and send them by email directly, I’m just going to do this one manually, By default your webvpn probably isn’t enabled on the “inside” so lets turn that on.

[box]

PetesASA#
PetesASA# conf t
PetesASA(config)# webvpn
PetesASA(config-webvpn)# enable inside
INFO: WebVPN and DTLS are enabled on 'inside'.
PetesASA(config-webvpn)# exit
PetesASA(config)#

[/box]

To do the same via ASDM connect to the ASDM > Navigate to Configuration > Remote Access VPN > Network (Client) Access > AnyConnect Connection Profiles > Tick both the inside options > Apply.

Now I’m going to create a user, and a “One Time Password”.

[box]


PetesASA(config)#
PetesASA(config)# crypto ca server user-db add petelong
INFO: User added as 'petelong'
PetesASA(config)# crypto ca server user-db allow petelong display-otp
Username: petelong
OTP: 010B3B9F500F7142 <--your user will need this!
Enrollment Allowed Until: 12:43:23 UTC Mon Oct 4 2010

PetesASA(config)#

[/box]

Via ADSM it’s a little more convoluted, you need to add the user then view/re-generate the OTP.

Open a web browser and got to https://{ip or name of firewall}/+CSCOCA+/enroll log in with the details you created above.

When prompted download the certificate and put it on the machine that requires secure access. Simply double click it and import it (it should import into the “Personal Certificates” folder.) – if you are prompted for a password you enter the OTP from above.

Step 3: Change the VPN authentication to Certificate.

First lets check that enrolment was successfully with a “show ca server user-db” command.

[box]


PetesASA(config)# show crypto ca server user-db
username: petelong
email: <None>
dn: <None>
allowed: 12:43:23 UTC Mon Oct 4 2010
notified: 1 times
enrollment status: Enrolled, Certificate valid until 12:47:25 UTC Sat Oct 1 2011,<--Good!
Renewal: Allowed

PetesASA(config)#

[/box]

Change the webvpn authenticate to certificate. Note your SSL tunnel group WILL have different name.

[box]

PetesASA# conf t
PetesASA(config)# tunnel-group SSL-VPN-POLICY webvpn-attributes
PetesASA(config-tunnel-webvpn)# authentication certificate
PetesASA(config-tunnel-webvpn)# exit
PetesASA(config)#

[/box]

To use usernames AND certificates use “both” instead of “cert”, to Revert back to usernames enter “aaa”

Via ASDM

Step 4: Test

Connect to the VPN portal and you should now be prompted for certificate authentication.

 

Related Articles, References, Credits, or External Links

AnyConnect VPN

Cisco ASA 5500 – Using a Third Party Digital Certificate (For Identification, AnyConnect, and SSL VPN)

Cisco AnyConnect Error “The VPN client driver has encountered an error”

KB ID 0000347

Problem

I rolled out AnyConnect for a client this week, and saw this error on one of the clients.

Error Reads:
The VPN client driver has received an error.

Solution

A quick search of web forums etc, sent me all over the place, the most promising link  told me to do the following,

Repair

This issue is due to Cisco bug ID CSCsm54689 (registered customers only) . In order to resolve this issue, make sure that Routing and Remote Access Service is disabled before you start AnyConnect. If this does not resolve the issue, complete these steps:

  1. Open a command prompt as an Administrator on the PC (elevated prompt on Vista).

  2. Run net stop CryptSvc.

  3. Run esentutl /p %systemroot%System32catroot2{F750E6C3-38EE-11D1-85E5-00C04FC295EE}catdb.

  4. When prompted, choose OK to attempt the repair.

  5. Exit the command prompt.

  6. Reboot.

If Repair fails

If the repair fails, complete these steps:

  1. Open a command prompt as an Administrator on the PC (elevated prompt on Vista).

  2. Run net stop CryptSvc.

  3. Rename the %WINDIR%system32catroot2 to catroot2_old directory.

  4. Exit the command prompt.

  5. Reboot.

However this procedure DID NOT WORK FOR ME

How I repaired it.

1. Click Start > Run > appwiz.cpl {enter}

2. The Add or Remove Programs window should open, locate and uninstall the Cisco AnyConnect VPN client.

In XP

In Windows 7

3. Once uninstalled Navigate to,

XP or older C:Documents and SettingsAll UsersApplication Data
Vista or Newer C:UsersAll Users


4. Delete the “Cisco” folder.

5. Navigate to,

XP or older C:Documents and Settings{username}Local settingsApplication Data
Vista or Newer C:Users{username}AppDataLocal


6. Delete the folder named “Cisco”.

7. This was all I had to do, but it would be prudent to have a good search round your hard drive to make sure its not lurking anywhere else.

8. Once done, reboot the client then either install the AnyConnect client from the .msi installer package, or connect to the SSL/AnyConnect Portal to reinstall the client automatically (Local admin rights required on the remote machine).

 

Related Articles, References, Credits, or External Links

NA

iPhone and iPad – Configure the Cisco VPN Client

KB ID 0000360

Problem

You have already configured a Cisco ASA / PIX device to provide Client VPN connectivity, and you now wish to configure the iPhone/iPad Device.

Solution

Note: The screen shots are taken from an iPhone running (4.2.1) the process for iPad is the same.

1. Select Settings.

2. Select General.

3. Select Network.

4. Scroll to the bottom of the page and select VPN.

5. Add VPN Configuration.

6. Select IPSec.

7. Description = the connection a simple name > Server = Either the IP address or public name of the firewall > Account > Your username.

8. Group Name = Is the VPN group configured on the firewall > Secret = Is the shared secret for this Group Name.

Where do you get this information from? Basically from your IT department, they can find out by issuing a “more system:running-config” command on the firewall

code?

9. Flick the VPN switch to “On”.

10. Enter your username and password > OK.

11. It may say “Starting” for a while.

12. “Connected” is what we are looking for.

14. For the duration of the connection you will see the “VPN” icon on the phones information bar.

 

Related Articles, References, Credits, or External Links

NA