Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

AnyConnect using ASA for product evaluation

Hello Security folks,

I am evaluating Cisco Anyconnect VPN solution using ASA. I have few questions needs to be answered asap.

1st-

Can we combine business partners and employee client connections on a single ASA in a secure manner?

2nd-

How the Anyconnect functions for selecting the nearest gateway (optimized gateway selection) to a user works? - I have below link which has a very good explanation but I am looking for the best response.

(https://supportforums.cisco.com/docs/DOC-15326)

3rd-

Can you please highlight the important features which are not supported in other vendors SSL solutions?

Thanks & Regards,

Deepak A.

Everyone's tags (4)
1 ACCEPTED SOLUTION

Accepted Solutions
VIP Purple

AnyConnect using ASA for product evaluation

Not the contexts, they can't be used when you need VPN.

You can configure different Tunnel-groups that you assign to your different user-groups. So the authentication will be based on the right AAA-server (if you have different servers for users and partners). Based on that you assign the right group-policies where the rights and restrictions are configured. So it's like the different ipsec-profiles. For AnyConnect the same tools (tunnel-groups and group-policies) are used as for the old VPN-Client.

-- 
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni


--
Don't stop after you've improved your network! Improve the world by lending money to the working poor: http://www.kiva.org/invitedby/karsteni
8 REPLIES
VIP Purple

AnyConnect using ASA for product evaluation

Can we combine business partners and employee client connections on a single ASA in a secure manner?

Yes, that can be done with specific VPN-configs for partners and different configs for employee. That's a common scenario.

but I am looking for the best response

???

Can you please highlight the important features which are not supported in other vendors SSL solutions?

It's going to marketing now? Hmmmm, the most important is that others vensors don't have a little bridge on their devices ... But perhaps you find a better answer in the partner-area where these competitive datasheets are available.

-- 
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni


--
Don't stop after you've improved your network! Improve the world by lending money to the working poor: http://www.kiva.org/invitedby/karsteni
New Member

AnyConnect using ASA for product evaluation

Hi Karsten,

Thank you very much for the reply.

Could you please explain what do you mean by -> "specific VPN-configs"? Do you mean configuring contexts or just different VPN profiles like we use different crypto ipsec profiles for different customers on single device?

Thanks,

Deepak A.

VIP Purple

AnyConnect using ASA for product evaluation

Not the contexts, they can't be used when you need VPN.

You can configure different Tunnel-groups that you assign to your different user-groups. So the authentication will be based on the right AAA-server (if you have different servers for users and partners). Based on that you assign the right group-policies where the rights and restrictions are configured. So it's like the different ipsec-profiles. For AnyConnect the same tools (tunnel-groups and group-policies) are used as for the old VPN-Client.

-- 
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni


--
Don't stop after you've improved your network! Improve the world by lending money to the working poor: http://www.kiva.org/invitedby/karsteni
New Member

AnyConnect using ASA for product evaluation

Karsten,

Thanks a lot. Thats all i needed to know.

Regards,

Deepak

New Member

AnyConnect using ASA for product evaluation

Hi Karsten,

I have one more small question. When I use my ASA for terminating multiple customer Anyconnect VPN's on a single device, in that case there might be overlapping IP addresses so how will the ASA determine or separate the traffic for different customers since we will not be using contexts here. Also can we use context and terminate Anyconnect VPN related to the specific customers into them?

This might sound stupid however I have never worked on scenario like this before so please clariy.

Thanks,

Deepak A.

VIP Purple

AnyConnect using ASA for product evaluation

You can't have overlapping addresses on the ASA without running into a NAT-nightmare. Overlapping networks for different customers are possible with the security-contexts, but with theese no VPN is supported. You probably need more then one ASA in that scenario.


--
Don't stop after you've improved your network! Improve the world by lending money to the working poor: http://www.kiva.org/invitedby/karsteni
New Member

AnyConnect using ASA for product evaluation

Karsten,

That helps me. I think I can try to use Cisco IOS router where I can implement Anyconnect at the same time I can have VRF features too. But there are some limitations with the Cisco IOS as below, I will decide the best product satisfying my needs.

Q. Is AnyConnect supported on Cisco IOS® devices?

    A. Yes.

    As of Cisco IOS Software Release 12.4(15)T in browser-initiated mode only as per the Release 12.4T New Security Features Notes.

    As of Cisco IOS Software Release 12.4(20)T, standalone mode is also supported.

    For more information, refer to SSL VPN Remote User Guide.

    Notes:

        Support for DTLS is introduced from Cisco IOS version 15.1(2)T. Refer to the svc dtls command for more information.

        Client keepalives are not supported on Cisco IOS devices until the 12.4(20)T release.

        Updates to the hardware crypto that can cause disconnects have been resolved with 12.4(T2) for 87x platforms.

       Start Before Logon is currently not supported by Cisco IOS.

Q. Is it possible to connect the iPad, iPod, or iPhone AnyConnect VPN Client to a Cisco IOS router?

    A. No. It is not possible to connect the iPad, iPod, or iPhone AnyConnect VPN Client to a Cisco IOS router. AnyConnect on iPad/iPhone can connect only to an ASA that runs version 8.0(3).1 or later. Cisco IOS is not supported by the AnyConnect VPN Client for Apple iOS.

VIP Purple

AnyConnect using ASA for product evaluation

But keep in mind that there is no AnyConnect Essentials license for the router. If you need many simultanious connections, multiple ASAs could be cheaper then the licensing on the router.

-- 
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni


--
Don't stop after you've improved your network! Improve the world by lending money to the working poor: http://www.kiva.org/invitedby/karsteni
566
Views
0
Helpful
8
Replies