ASA (9.x) SSL AnyConnect Configuration via ASDM

Introduction

Configuration

Pre-requisite configration on ASA

  1. Ensure all interfaces are configured
  2. Ensure necessary routing (static or dynamic) is in place
  3. Setup Management (SSH, HTTP) as required

Steps Needed

  1. Save AnyConnect package to ASA flash
  2. Set hostname and domain name
  3. Generate Encryption Keys
  4. Enable WebVPN
  5. Setup local users or external authentication
  6. Setup IP Local Pool (Optional if using DHCP)
  7. Define filter policy (Optional)
  8. Define Split Tunnel Policy (Optional)
  9. Define Group Policy
  10. Define Connection Profile

Note

The above steps can be completed manually as documented below or via the SSL VPN Wizard

Save AnyConnect Package to ASA Flash

Todo

Document methods of uploading to flash

Set hostname and domain name

In ASDM Navigate to:

Configuration ‣ Device Setup

On the CLI this can be setup as follow:

hostname <hostname>
domain-name <domain>

Generate encryption key

crypto key generate rsa modulus <bit-size>

Enable AnyConnect on the appropriate interfaces

webvpn
  enable <ifname>
  anyconnect image <pkg-path>
  anyconnect enable

Setup Local Users (Optional)

Setup external authentication server (Optional)

Define IP Address Pool

ip local pool <name> <start-ip>-<end-ip>

Define Group Policies

group-policy <gp-name> internal
group-policy <gp-name> attributes
  vpn-tunnel-protocol ssl-clientless ssl-client
  webvpn
    anyconnect ask enable
    anyconnect keep-installer installed

Define Connection Profile

tunnel-group <name> type webvpn
!
tunnel-group <name> general-attributes
  default-group-policy <gp-name>
  address-pool <ip-pool-name>
!
tunnel-group <name> webvpn-attributes
  group-alias <alias-name>