AnyConnect 4 – Plus and Apex Licensing Explained
KB ID 0001013 Problem (Updated 11/05/21) Before version 4 we simply had AnyConnect Essentials and Premium licensing, now we have Plus and Apex licensing. AnyConnect Plus and Apex There are in fact three licensing options; Cisco AnyConnect Plus Subscription Licenses Cisco AnyConnect Plus Perpetual Licenses Cisco AnyConnect Apex Subscription Licenses NEW VPN Only perpetual Licences Plus and Apex Contain; AnyConnect PLUS (Cisco pitch...
Cisco ASA to Fortigate VPN (Properly!)
KB ID 0001721 Problem A while ago I did a run through on site to site VPNs from Cisco ASA to Fortigate firewalls. Back then I said that the default settings were a bit ‘shoddy’ and that I’d revisit it once I had more time. What do you mean shoddy? Well, Cisco and Fortinet are both guilty of enabling ‘Everything’ to make the tunnel come up, so people can just use a wizard and not put to much thought into...
Fortigate to Cisco ASA Site to Site VPN
KB ID 0001717 Problem Continuing with my ‘Learn some Fortigate’ theme’. One of the basic requirements of any edge firewall is site to site VPN. As the bulk of my knowledge is Cisco ASA it seems sensible for me to work out how to VPN both those firewalls together, like so; Well that’s the pretty picture, I’m building this EVE-NG so here’s what my workbench topology looks like; Disclaimer (Read First!...
AnyConnect: ‘Quick and Dirty’ Duo 2FA
KB ID 0001701 Problem Normally if I were deploying Duo 2FA with AnyConnect I’d deploy a Cisco RADIUS VPN on my LAN, (usually on my Duo Authentication Proxy). See the following article; AnyConnect: Enable Duo 2Factor Authentication However, last time I set this up, a colleague said ‘Oh by the way, you don’t need to do that, you can just point the firewall directly at Duo’. I was initially skeptical but I tried...
Cisco ASA VPN Static to Dynamic IP (DHCP)
KB ID 0001683 Problem I had a call with a client last week, they are in one of my employer’s DCs, and their servers are behind a vASA. They had purchased some Meraki MX devices for their IT team who were working remotely (during the Covid-19 lockdown), and were struggling. Normally we would just suggest AnyConnect, but these guys were building new machines for their clients, and needed access directly to the domain from their...