#ASA 9.2 SETUP ANYCONNECT VPN HOW TO#

In order for everything to work correctly the certificate must match the ASA hostname/IP address. An ASA identity certificate is the certificate that the ASA will hand out to the sslvpn clients that connect to it. It is important that you use an identity certificate from a trusted CA source for your ASA. However it can be done manually as I'll describe later.ДҐ)Дљdd a 'from address' and an email subject lineД¬onfigure a trusted identity certificate on your ASA. Email is the preferred method for obtaining user certficates.

#ASA 9.2 SETUP ANYCONNECT VPN HOW TO#

It provides them with instructions on how to obtain their new identity certificate. This will be used to send enrollment emails to new users. Fill out the form.ДЎ)Дњheck 'create certificate authority server'Дў) Type in a strong passphrase to protect your new root certificateДЈ) Leave the rest of the top part of the form at the defaultsД¤) Under 'SMTP Server' enter the IP address of your corporate smtp mail server. In ASDM, go to Configuration > Remote Access VPN > Certificate Management > Local Certificate Authority. Next, we need to configure up our ASA CA server. Be sure you set up NTP and check that it is working with the show ntp status command. I cannot stress enough the importance of having a reliable clock when using certificate based authentication. You only have to configure up the NAT exemptions if you are using NAT control or the pools fall inside of an existing NAT rule. Configure up your interfaces, routing, clock, timezone, NTP server, domain-name and NAT exemptions for sslvpn anyconnect client address pools. And off we go!ДЇirst things first, be sure you setup the basics on the ASA. I recommend using microsofts CA server you can find configuration examples for how to use the ASA and MSFT CA together on.

Of course you can always use (and probably should use) an external CA server in production. Along the way, I'll show you how to configure the ASA's built-in Certificate Authority (CA) Server. This tech tip will run you through how to quickly setup the ASA for two-factor authentication using certificates. The Cisco ASA has supported certificates for a long time now, but it is only this past year that I see mainstream companies starting to take advantage of the feature in mass. Sure tokens are still the market share leader for this function but certificates are gaining due to their inexpensive cost and advancements in ease of management and deployment. I have seen a big shift over the past year towards using digital certificates for 2-factor authentication.

Asa 9.2 setup anyconnect vpn