SSL VPN is not supported when multiple context is configured on ASA

Learnt a lesson today.  I believe this is something new, but this is something that I have experienced today which spent me a couple of hours to troubleshoot.

What I want to do is to configure a ASA 5540 (version 8.2) as the SSL VPN headend for the VPN phones.  After I write erase the unit, I've found that basic commands like IP address cannot apply to its management and GE interface.  What I have done is to create a context and after I changeto that new context, I can apply those commands.

However the webvpn command is not available, and I have the required license installed.  After a google search, I've found when multiple context is enabled, webvpn is not supported.

Then I deleted the context and start all over again.  Finally I've found that the ASA 5540 with default "mode multiple" enabled.  It means that default it support multiple context and therefore configurations such as IP address cannot apply in the system context.  After I change it to "mode single" and reboot, all the commands including webvpn are accepted.

How to run Cisco Mobile 8.1 over SSLVPN over 3G

My environment: AnyConnect 2.4.4009 on iPhone, Cisco Mobile 8.1 on iPhone, ASA Software 8.2.3

During my test I have learnt a few tricks that want to share with you guys who want to test / play / deploy it.

1. Setup the TCT device on UCM base on the admin guide here.

2. When you setup the Cisco Mobile, no matter 8.0 or 8.1, when you configure the directory settings, you need to enter port 389 although the field is optional and you are running on default LDAP port.  Otherwise the apps will close by itself!!

3. I have encountered weird problem that my Cisco Mobile registered to UCM, but it can’t make or receive any calls.  The call is either fail to setup, without ring back tone or second call fail.  To solve it, check if you have turned on SIP inspection on ASA.  To turn it off:

policy-map global_policy
class inspection_default
no inspect sip

Good Luck!

VPN Phone for Cisco UC

My environment:  UCM 8.0.3, ASA Software 8.2.3
VPN phone is one of the alternatives to extend the UC capabilities to remote workers.  I have both 79xx and 99xx phones in my lab, however even though I upgrade the 99xx firmware to 9.1(1)SR1, the VPN feature isn’t working and seems 99xx will only work with UCM 8.5.  The 79xx phones work fine.
Configuring ASA SSL VPN with self-sign CA
1. Generate RSA key for certificate
crypto key generate rsa label sslvpnkeypair
2. Create trustpoint for self-signed cert
crypto ca trustpoint localtrust
enrollment self
fqdn sslvpn.panda.com
subject-name CN=sslvpn.panda.com
keypair sslvpnkeypair
crypto ca enroll localtrust noconfirm
ssl trust-point localtrust outside
3. Download Cisco_Manufacturing_CA.pem and CAPF.pem from UCM Certification Management.  Import it to ASA via the following command:
crypto ca trustpoint CiscoMfgCert
enrollment terminal
crl configure
crypto ca trustpoint CAPF
enrollment terminal
crl configure

crypto ca authentication CiscoMfgCert

! Enter the text content in the Cisco_Manufaturing_CA.pem cert

crypto ca authentication CAPF

! Enter the text content in the CAPF cert

4. Copy AnyConnect image to flash, then specify the image location

webvpn
svc image disk0:/anyconnect-win-2.0.0343-k9.pkg 1
5. Enable AnyConnect Access
webvpn
enable outsidesvc enable
6. Create Group Policy
ip local pool SSLClientPool 192.168.25.1-192.168.25.50 mask 255.255.255.0
group-policy SSLCLientPolicy internal
group-policy SSLCLientPolicy attributes
dns-server value 1.1.1.1
vpn-tunnel-protocol svc
default-domain value panda.com
address-pools value SSLClientPool
6. Configure ACL bypass
sysopt connection permit-vpn
7. Create a connection profile and tunnel group for client connections
tunnel-group SSLClientProfile type remote-access
tunnel-group SSLClientProfile general-attributes
default-group-policy SSLCLientPolicy
tunnel-group SSLClientProfile webvpn-attributes
group-alias SSLVPNClient enable
webvpn
tunnel-group-list enable
8. Configure NAT Exemption, say for example 192.168.50.5 is the UCM that you want the client in the pool 192.168.25.0 can access.
access-list no_nat extended permit ip host 192.168.50.5 192.168.25.0 255.255.255.0
nat (inside) 0 access-list no_nat
9. Adding remote access users
username vpnphone password pandavpn
username vpnphone attributes
service-type remote-access
10.  Encryption algorithm
ssl encryption aes128-sha1
ssl trust-point localtrust outside

More detail information about the ASA configuration, check out here.


VPN Phone Configuration
1. From ASA, export the self sign CA cert
crypto ca export localtrust identity-certificate
Copy and paste the text and name the file with extension .pem
2. Create a Group URL.  This is needed in the later steps of VPN phone configuration on UCM.
tunnel-group sslgroup webvpn-attributes
group-url https://1.2.3.4/vpnphone
3. Upload CA cert to UCM.  From UCM OS admin page, choose Security > Certificate Management.  Click Upload Certificate, and choose Phone-VPN-trust from the certificate name dropdown box.  Upload the certificate you’ve exported from ASA.
4. UCM Admin page > Advanced Features > VPN > VPN Gateway, enter the VPN Group URL.  Move the certificate from the truststore to your location.
5. Advanced Features > VPN > VPN Group, choose the VPN Gateway you’ve created in step 4.
6. Advanced Features > VPN > VPN Profile, choose the preferred authentication method.
7. Device > Device Settings > Common Phone Profile.  Create a new phone profile and assign VPN Group and VPN profile to the phone profile
8. Apply the Common Phone Profile to the phone you want to allow remote VPN access.
9. For 79xx phone, go to Security Configuration > VPN Configuration > Enabled.
10. You will be prompt for username and password.  You can now bring the phone home and test it!

Remote Access SSL VPN and DDNS setup

My environment:  IOS 15.1(3)T on ISR 892

I have been spending quite a lot of time on the road and it is much convenient if I have a way to remote access back to my home network.  In my home network I have setup the SSL VPN for remote access, as well as DDNS as I don’t have a fixed IP address for my home internet access.

1. You can register an account in dyndns.org to get your own DDNS entry

2.  Then you can configure DDNS update on the router, whenever there is an address change, it will update dyndns.org dynamically.

ip ddns update method DynDNS
HTTP
  add http://pandausername:pandapassword@members.dyndns.org/nic/update?system=dyndns&hostname=panda.dyndns.org&myip=<a>
  remove http://pandausername:pandapassword@members.dyndns.org/nic/update?system=dyndns&hostname=panda.dyndns.org&myip=<a>
interval maximum 1 0 0 0

3. Under your internet facing interface, configure the following command:

ip ddns update hostname panda.dyndns.org
ip ddns update DynDNS host members.dyndns.org

4. These are the webvpn configuration of my router, you can modify it for your own setup:

ip local pool vpn-pool 192.168.20.205 192.168.20.215

webvpn gateway panda.dyndns.org
ip address 1.2.3.4 port 443 
ssl trustpoint TP-self-signed-3650870944
logging enable
inservice
!
webvpn install svc flash:/webvpn/svc_1.pkg sequence 1
!
webvpn install svc flash:/webvpn/anyconnect-macosx-i386-2.3.2016-k9.pkg.zip sequence 2
!
webvpn context panda-context
ssl authenticate verify all
!
login-message "Welcome to Panda's home"
!
policy group panda-group
   functions svc-enabled
   banner "Login Successful"
   svc address-pool "vpn-pool"
   svc default-domain "panda.com"
   svc keep-client-installed
   svc rekey method new-tunnel
   svc split include 192.168.20.0 255.255.252.0
   svc dns-server primary 3.4.5.6
default-group-policy panda-group
gateway panda.dyndns.org
inservice

svc split is the split tunnel configuration that allows inserting a specific route to the client’s routing table.  svc split include means that only this route will be inserted to the host, other routes including default route will be based on the client’s own routing table.

5. Then you can use the AnyConnect client to remote access in full tunnel mode.