ASA 5540 for VPN

shanahmad · ‎05-05-2009

Hi Everyone,

I need to setup a VPN solution for 3000 clients . As per my understanding ASA 5540 can support out of box 5000 VPN clients.

I know for SSL VPN cisco requires seperate lisence. My question is with ASA 5540 and install AnyConnect VPN client for 3000 users.

What is the difference in performance connecting from SSL or VPN client? My understang is using VPN client will save money.

What is the solution to Create different groups of users for access to different VLANs on DMZs. Do I need to have ACS server for that or its something that can be configured on ASA 5540.We use 2003 Active Directory.

The same ASA will also be having Site to Site VPN from 34 remote office locations.

I need your expert opinion on it. I also want to have an IPS SSM-20 to monitor the VPN traffic. I want to have CS-MARS 55 placed in for protection.

I need a complete solutions.

Much appreciated.

Shan

andrew.prince · ‎05-06-2009

read the below URLs:-

http://www.cisco.com/en/US/prod/collateral/vpndevc/ps6032/ps6094/ps6120/product_data_sheet0900aecd802930c5.html

http://www.cisco.com/en/US/prod/collateral/vpndevc/ps6032/ps6094/ps6120/prod_brochure0900aecd80402e39.html

HTH>

shanahmad · ‎05-06-2009

Hi Andrew,

Thank you for your reply. I have looked at this information. I also have the Cisco product guide .

As far as the performance is concerned between SSL VPN and AnyConnect VPN client. Which one is better ? We will be having 3000 VPN users connecting.My understanding is AnyConnect VPN client comes free for 5000 users.

We also want to give different level of access to different groups for users on seperate VLANs (DMZ). How can I achive this task on ASA 5540 . Do I need an ACS server for that,we use Windows Server 2003 Active Directory.

The IPS SSM-20 can fit into the ASA5540, can it monitor all the DMZ on the ASA?

If I need to place IPS and MARS55 what will be the best practise to place them on the network. As per my understanding MARS need to be on the Out of Band network. Then how can we make IPS talk to MARS on the Cisco ASA5540.

Please advise.

Thank you for your help.

Shan

andrew.prince · ‎05-07-2009

To be perfectly honest the only diff I know between the SSl client and the Anyconnect is the GUI, App size/running footprint and the fact that you can admin/create sepecific profiles for the AnyConnect.

You can either use an ACS or Radius Server in the form of IAS/Active Directory - see the below links:-

http://www.cisco.com/en/US/products/sw/secursw/ps2086/products_tech_note09186a0080858d3c.shtml

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a008060f261.shtml

http://www.cisco.com/en/US/products/sw/secursw/ps2086/products_configuration_example09186a00808cf897.shtml

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00808d1a7c.shtml

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a008089149d.shtml

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00806ab788.shtml

IPS Module info

http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5729/ps5713/ps4077/data_sheet_c78-459036.html

HTH>

shanahmad · ‎05-11-2009

Hi Andrew,

Thanks for all the links. They are very helpful. For the VPN users when they connect through the VPN Client. I want to have :

1. Health Validation (Antivirus,Software Updated,VNC) software check done. If the user fails to meet the requirements he is not allowed to access. If he does he is connected by checking of his group membership in the Active Directory .

2. After the Notebook Health Validation check, the user ID and password information is checked in the AD. According to his group membership (Management or Admins) Management user is given access to VLAN1,VLAN2,VLAN3. If the user is Admin given acess is VLAN1(DMZ1) only.

I want to achive this without using NAC. I know Server 2008 has NAP and Health Validation check. Has some one used Server 2008 NAP feature with a Cisco ASA 5540 .

Please advise and thanks again for the helpful links.

Shan

andrew.prince · ‎05-11-2009

I have no experiance of NAP - perhaps another NetPro will be able to assist.

craigstrait · ‎05-11-2009

Also, be aware that there is no IPSec client for a 64-bit OS.

If you're connecting 3000 clients, I'd recommend using two ASAs in Load Balance mode, this gives you the advantage of pulling an ASA offline for patching/code upgrades without dropping your users. Simply pull one ASA out of the load balance group, wait for the sessions to die off and then put it back in LB once you're done. Rinse & Repeat for the other.