The AnyConnect Essentials license lets you use the AnyConnect client to connect to the adaptive security appliance, while supporting the platform limit for SSL VPN sessions. For example, you can use 25 sessions for the ASA 5505. Cisco Secure Desktop and clientless SSL VPN are not supported. INSTALLING CISCO ANYCONNECT 11 10. Select Cisco AnyConnect. When AnyConnect opens in the box, type vpn01.cu.edu and click connect. Enter your network credentials (the same username and password you use to log into your computer). Install the Cisco AnyConnect Secure Mobility Client. Initially, AnyConnect was an SSL-only VPN client. Starting with Version 3.0, AnyConnect became a modular client with additional features (including IPsec IKEv2 VPN terminations on Cisco ASA), but it requires a minimum of ASA 8.4(1) and ASDM 6.4(1). Related posts in this blog. The default security settings in the version of Safari that comes with OS X 10.9 (Mavericks) prevents AnyConnect Weblaunch from working. To configure Safari to allow Weblaunch, edit the URL of the ASA to Unsafe Mode, as described below. Open Safari Preferences Security Manage Website Settings. Click on the ASA and select run in Unsafe Mode. There is a problem with this Windows Installer package. A program run as part of the setup did not finish as expected. Contact your support personnel or package vendor. Action VACon64ndis6Install, location: C: Program Files (x86) Cisco Cisco AnyConnect Secure Mobility Client VACon64.exe, command: -install 'C: Program Files (x86) Cisco Cisco.
Oh, to be a Cisco IPsec VPN user these days… Now I know that we should get with the program and move to AnyConnect, since Cisco is EOL-ing the venerable Cisco VPN Client in 2014, but we have a large installed base, and since Cisco stopped making IPsec clients for Mac and Linux back in the 4.x days, we have been using the integrated VPN client on Mac OS X and the “vpnc” client on Linux on those respective platforms. When we cut over from our old VPN3000 concentrators to ASA 5500 units a few years ago, all these IPsec clients continued to work, and all was well (and, importantly, the user base did not have to do or learn anything new to continue to be able to VPN.) Yes, we did also investigate AnyConnect when we cut over to the ASAs, but we found that Linux support was lacking, especially in the posture support we wanted to use, so the AnyConnect rollout was deferred.
The first bump in the road came with the advent of Windows 8. We have been successfully deploying the 64-bit Cisco VPN Client 5.0.07.0440 software to our Windows 7 64-bit, and now Windows 8 (which only comes in 64-bit) OS machines. However, we found an odd problem on the Windows 8 OS — when the Cisco VPN Client was connected, only the desktop (“classic”) applications had network connectivity, and not the new Modern (nee “Metro”) apps. When I first found this problem when using the Cisco VPN Client on my new Surface Pro tablet, I then tried two other regular laptops running Windows 8, and they too had the same problem. A support call to Microsoft on this issue got lost in the shuffle (too many internal transfers on their side, I guess) and I never pursued it, because all the desktop apps that we had to support were working fine over VPN. (It does leave me wondering how Microsoft has changed the Windows IP stack for the Modern apps, but that’s a black box to me since it’s a closed-source system.)
Then came the free upgrade to Windows 8.1, which not only comes with the return of the Start button, but also the shiny new Internet Explorer 11. Between the lure of getting a Windows 8 that actually is usable on a regular desktop machine, and the upgrade price (free!), I took the early plunge and upgraded my Windows 8 machines (the aforementioned Surface Pro, and a regular laptop.) I was hoping that the VPN connection issue with the Metro Modern apps would be fixed (sadly, no) but imagine my horror when the new IE11 desktop browser also had connectivity issues! This is pretty much a deal-killer for us, as we are switching over to using SaaS for some LOB apps. So, for now, we are officially not deploying or supporting either Windows 8, or 8.1, on our business machines (sorry, MSFT!) due to these VPN connection problems.
At least they let us buy Apple products as well here. We’ve always had a good experience with the Apple MacBook line (both Pro and Air) and more and more of our staff is electing to use an Apple notebook running Mac OS X. We have a variety of machines out there running OS X 10.7 (Lion) and 10.8 (Mountain Lion), and the built-in “Cisco IPsec” VPN Client has always worked well for us.
However, last week Apple did the free OS upgrade thing too (OS X 10.9 “Mavericks”) and like little kids running after candy (it is Halloween, after all…) I and a bunch of other co-workers jumped right on it, and upgraded our machines. All was well, until I got the first call about “my VPN session disconnects after 60 minutes”… Then the next day, another one. Upon testing it out and verifying the problem on my own MacBook, and then looking into the reason for this, I see the following entries in the OS X system log:
(“Racoon” being the IPsec client codebase Apple incorporates into OS X via Darwin‘s use of FreeBSD sources, in this case originally from the KAME IPv6/IPsec network stack project.) So, great, now we have a problem on two platforms… Although it seems it’s not an across-the-board problem; on some underlying networks it does work, and stays connected, but on others (sadly, our corporate wireless network) it does not.
I guess it’s about time to look at AnyConnect again, which I’m sure works much better on these platforms… Oh, wait.
If anyone out there has any ideas or fixes to try, I’d love to hear from you in the comments below… Smug Cisco Guy was no help at all…
Cisco AnyConnect VPN
Authorized employees of the university can use Cisco AnyConnect to access restricted campus resources, such as Banner, when using an Adams State University computer from off campus.
Contactaxis and ohs. To request VPN access please submit a ticket at https://helpdesk.adams.edu. Please note, VPN access may need approval from a supervisor, CIO, and/or HR where applicable. Computing Services technicians will assist with client installation and configuration.
Connect with the Cisco AnyConnect Client
You will need to authenticate using your ASU username and password as well as a certificate to connect using the Cisco AnyConnect Client. If you have not yet imported your certificate please see certificate import instructions below.
- Click Start > All Programs
- Click the Cisco Folder.
- Click the Cisco Anyconnect Secure Mobility Client program.
- You may also have an icon in your system tray for the Cisco Anyconnect client. You can also launch the client by double clicking the icon in the system tray.
- Enter vpn1.adams.edu in the text box and click Connect
- You will be prompted to select your certificate. Select the certificate with the name cn=yourusername issuer of vpn1.adams.edu.
- Enter your ASU username and password
- The icon in the system tray will show a lock when connected to the vpn.
Disconnect from the Cisco Anyconnect VPN client
- Right Click the Cisco Anyconnect VPN client icon in your system tray
- Select Disconnect
Please be sure to disconnect from the VPN client when you no longer need access to restricted internal resources.
Import Certificate for Multifactor Authentication
- After you successfully enter your username and password the certificate will be downloaded to your computer. Right click on the certificate and select Install PFX
- The Certificate Import Wizard will start. Select Current User as the store location, then click next.
- Verify file location, then click next
- Enter the password for the certificate that you received in the email from Computing Services.
(“Racoon” being the IPsec client codebase Apple incorporates into OS X via Darwin‘s use of FreeBSD sources, in this case originally from the KAME IPv6/IPsec network stack project.) So, great, now we have a problem on two platforms… Although it seems it’s not an across-the-board problem; on some underlying networks it does work, and stays connected, but on others (sadly, our corporate wireless network) it does not.
I guess it’s about time to look at AnyConnect again, which I’m sure works much better on these platforms… Oh, wait.
If anyone out there has any ideas or fixes to try, I’d love to hear from you in the comments below… Smug Cisco Guy was no help at all…
Cisco AnyConnect VPN
Authorized employees of the university can use Cisco AnyConnect to access restricted campus resources, such as Banner, when using an Adams State University computer from off campus.
Contactaxis and ohs. To request VPN access please submit a ticket at https://helpdesk.adams.edu. Please note, VPN access may need approval from a supervisor, CIO, and/or HR where applicable. Computing Services technicians will assist with client installation and configuration.
Connect with the Cisco AnyConnect Client
You will need to authenticate using your ASU username and password as well as a certificate to connect using the Cisco AnyConnect Client. If you have not yet imported your certificate please see certificate import instructions below.
- Click Start > All Programs
- Click the Cisco Folder.
- Click the Cisco Anyconnect Secure Mobility Client program.
- You may also have an icon in your system tray for the Cisco Anyconnect client. You can also launch the client by double clicking the icon in the system tray.
- Enter vpn1.adams.edu in the text box and click Connect
- You will be prompted to select your certificate. Select the certificate with the name cn=yourusername issuer of vpn1.adams.edu.
- Enter your ASU username and password
- The icon in the system tray will show a lock when connected to the vpn.
Disconnect from the Cisco Anyconnect VPN client
- Right Click the Cisco Anyconnect VPN client icon in your system tray
- Select Disconnect
Please be sure to disconnect from the VPN client when you no longer need access to restricted internal resources.
Import Certificate for Multifactor Authentication
- After you successfully enter your username and password the certificate will be downloaded to your computer. Right click on the certificate and select Install PFX
- The Certificate Import Wizard will start. Select Current User as the store location, then click next.
- Verify file location, then click next
- Enter the password for the certificate that you received in the email from Computing Services.
- Select the 'Place all certificates in the following store' option and click Browse. Select 'Personal' as the certificate store location.
- Click next, then Finish to complete the Certificate Import Wizard. You will see The import was successful on completion of certificate import.
Downloading AnyConnect VPN Client for Windows / MAC / Linux
After you have installed the VPN Certificate on your system you can open up your web browser and navigate to https://vpn1.adams.edu
- Login with your ASU Domain Username and Password
Cisco Anyconnect
- Click on 'AnyConnect'
Cisco Anyconnect Vpn Client 10.9 Login
- Click on 'Start AnyConnect'
- Click on 'Download for XYZ' the 'XYZ' will be replaced by either Windows / MAC or Linux depending from what system you are logging in from.
