Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

IKEV2 Multiple connection profiles for Same Host address

 

Hi Everyone,

I configured two connection profiles in ASA for same host address say xyz.com

I am using Windows 7 and xml file is located under

%ProgramData%\Cisco\Cisco AnyConnect Secure Mobility Client\Profile

 

Now under Profile folder  i have two xml files say

xml 1 and xml 2 

When i connect i choose  say hostaddress and connect when i connect it always connect using xml1 file to connection profile 1.

Only way for me to connect  to connection profile 2 using xml2 is i need to delete xml 1 file from profile folder.

 

Need to know it is possible to connect any of the connection profiles without deleting other from profile folder?

Regards

Mahesh

 

 

14 REPLIES
Hall of Fame Super Silver

Yes you can have two (or more

Yes you can have two (or more) distinct connection profiles (each with associated xml profile) for a given ASA. As long as they have unique names they will both download to the end user's profile directory.

Unless you do some sort of user locking though, a person selecting one would be able to choose the other profile from the drop down list on the SSL VPN portal or AnyConnect client.

New Member

 Hi Marvin,i have 2

 

Hi Marvin,

i have 2 connection profiles and both have unique names.

When i connect using host address i always connect so say connection profile 1.

i have no locking enabled.

Also the xml file of second connection profile does not get downloaded to profile folder.

Regards

Mahesh

Hall of Fame Super Silver

You will only download the

You will only download the profile when you connect to it.

If you type the host address into AnyConnect are you then presented with the option to choose between profiles via the AnyConnect Group dropdown menu? If so, choose the group associated with the second profile and it should then download onto the client computer.

New Member

 Hi Marvin, When i connect i

 

Hi Marvin,

 

When i connect i get window Ready to connect below is host address which is same

for both connection profiles after that i get window to  put password no option there

to choose the group.

 

I am using Anyconnect IKEV2 only.

Regards

MAhesh

Hall of Fame Super Silver

Mahesh,You  need to have

Mahesh,

You  need to have "tunnel-group-list enable" in your webvpn section. Then under each connection profiles you need something like:

     tunnel-group group1 webvpn-attributes
      group-alias group1 enable

     tunnel-group group2 webvpn-attributes
      group-alias group2 enable

...that should give you a list to choose from.

New Member

 Hi Marvin,I will check that

 

Hi Marvin,

I checked that i have same config as you said in last post.

I am using IKEV2 i am notifying you late on this is it designed to  work for IKEV2?

 

Regards

MAhesh

Hall of Fame Super Silver

Mahesh,I recall in one of

Mahesh,

I recall in one of your threads about setting up IKEv2 you were attempting to make it work with completely forgoing client services over SSL and instead manually deploying profiles. If that's the setup you have for this VPN in question then of course the profiles won't automatically download - that's what you give up when disabling client services.

The group alias feature is still there with or without client services - even on IKEv2. I've set it up in a couple of customers' IPsec IKEv2 remote access VPNs..

New Member

 Hi Marvin,Under my current

 

Hi Marvin,

Under my current setup i have client services enabled so any update done on

connection profile is downloaded automatically.

Yes you are right it will now download the complete xml file for connection profile.

Group alias works for single connection profile only.

I tried under group alias on say connection profile 1 and try to add name of

connection profile 2 it says its is already  in use.

So my issue is even though i manually copy the second xml profile to profile folder in PC i do not get option to choose between 2 connection profiles?

Regards

MAhesh

 

Hall of Fame Super Silver

Mahesh,Each tunnel-group

Mahesh,

Each tunnel-group webvpn-attributes section (also known as connection profile) needs a unique group alias.

Your webvpn section should also specify both xml profiles.

I have this working on ASAs with code from 8.2 up through 9.3. Either SSL VPN or IPsec IKEv2.

New Member

 Hi Marvin,here is config for

 

Hi Marvin,

here is config for connection profiles

webvpn

anyconnect-essentials

anyconnect image disk0:/anyconnect-win-3.1.05160-k9.pkg 2

anyconnect profiles 123_client_profile disk0:/123_client_profile.xml

 

 

tunnel-group 123 webvpn-attributes

group-alias 123 enable

my webvpn specify both xml profiles.

Any other thing i can look for?

 

Regards

Mahesh

Hall of Fame Super Silver

Mahesh,It should look

Mahesh,

It should look something like:

webvpn

anyconnect-essentials

anyconnect image disk0:/anyconnect-win-3.1.05160-k9.pkg 2

anyconnect profiles 123_client_profile disk0:/123_client_profile.xml

anyconnect profiles 456_client_profile disk0:/456_client_profile.xml

 

tunnel-group 123 webvpn-attributes

group-alias 123 enable

tunnel-group 456 webvpn-attributes

group-alias 456 enable

New Member

 Hi MArvin,I have exact

 

Hi MArvin,

I have exact config as you said.

May be i need to do reboot during maintenance window to make it work?

Regards

MAhesh

Hall of Fame Super Silver

Mahesh,It should not require

Mahesh,

It should not require a reload.

Did you verify you have "tunnel-group-list enable" under the webvpn section?

New Member

 Hi MArvin, I checked under

 

Hi MArvin,

 

I checked under webvpn

i have

anyconnect enable

tunnel-group-list enable

Regards

Mahesh

78
Views
0
Helpful
14
Replies
CreatePlease to create content