Home » Cisco Manuals » Networking » Cisco 5505 » Manual Viewer

Cisco 5505 Administration Guide - Page 41

vpn-tunnel-protocol svc, default-group-policy - sale

UPC - 882658082252

Add to My Manuals
Save this manual to your list of manuals

Page 41 highlights

Chapter 4 Installing the AnyConnect Client on a Security Appliance Using CLI Enabling AnyConnect Client SSL VPN Connections Using CLI Step 5 Step 6 Step 7 Step 8 Step 9 ip local pool poolname startaddr-endaddr mask mask The following example creates the local IP address pool vpn_users: hostname(config)# ip local pool vpn_users 209.165.200.225-209.165.200.254 mask 255.255.255.224 Assign IP addresses to a tunnel group. One method you can use to do this is to assign a local IP address pool with the address-pool command from general-attributes mode: address-pool poolname To do this, first enter the tunnel-group name general-attributes command to enter general-attributes mode. Then specify the local IP address pool using the address-pool command. In the following example, the user configures the existing tunnel group telecommuters to use the address pool vpn_users created in step 3: hostname(config)# tunnel-group telecommuters general-attributes hostname(config-tunnel-general)# address-pool vpn_users Assign a default group policy to the tunnel group with the default-group-policy command from tunnel group general attributes mode: default-group-policy name In the following example, the user assigns the group policy sales to the tunnel group telecommuters: hostname(config-tunnel-general)# default-group-policy sales Create and enable a group alias that displays in the group list on the WebVPN Login page using the group-alias command from tunnel group webvpn attributes mode: group-alias name enable First exit to global configuration mode, and then enter the tunnel-group name webvpn-attributes command to enter tunnel group webvpn attributes mode. In the following example, the user enters webvpn attributes configuration mode for the tunnel group telecommuters, and creates the group alias sales_department: hostname(config)# tunnel-group telecommuters webvpn-attributes hostname(config-tunnel-webvpn)# group-alias sales_department enable Enable the display of the tunnel-group list on the WebVPN Login page from webvpn mode: tunnel-group-list enable First exit to global configuration mode, and then enter webvpn mode. In the following example, the user enters webvpn mode, and then enables the tunnel group list: hostname(config)# webvpn hostname(config-webvpn)# tunnel-group-list enable Specify SSL as a permitted VPN tunneling protocol for the group or user with the vpn-tunnel-protocol svc command in group-policy mode or username mode: vpn-tunnel-protocol svc You can also specify other protocols to permit by adding the names of those protocols to this command. For more information about the vpn-tunnel-protocol command, see the command description in Cisco Security Appliance Command Reference. OL-12950-012 Cisco AnyConnect VPN Client Administrator Guide 4-3

Section	Page
About This Guide 7	3
chapter 1	3
Introduction 1	3
chapter 2	3
Common AnyConnect VPN Client Installation and Configuration Procedures 1	3
chapter 3	4
Installing the AnyConnect Client and Configuring the Security Appliance with ASDM 1	4
chapter 4	4
Installing the AnyConnect Client on a Security Appliance Using CLI 1	4
chapter 5	4
Configuring AnyConnect Features Using ASDM 1	4
chapter 6	4
Configuring AnyConnect Features Using CLI 1	4
chapter 7	5
Configuring and Using AnyConnect Client Operating Modes and User Profiles 1	5
chapter 8	5
Customizing and Localizing the AnyConnect Client 1	5
chapter 9	5
Monitoring and Maintaining the AnyConnect Client 1	5
appendix A	5
Sample AnyConnect Profile and XML Schema 1	5
appendix B	6
Using Microsoft Active Directory to Add the Security Appliance to the List of Internet Explorer Trusted Sites for Domain Users 1	6
Index	6
About This Guide	7
Document Objectives	7
Audience	7
Related Documentation	8
Document Organization	8
Document Conventions	9
Obtaining Documentation, Obtaining Support, and Security Guidelines	10
Licensing	10
Introduction	11
AnyConnect Client Features	11
Remote User Interface	12
Getting and Installing the Files You Need	17
CSA Interoperability with the AnyConnect Client and Cisco Secure Desktop	17
Common AnyConnect VPN Client Installation and Configuration Procedures	19
Installing the AnyConnect Client	19
Before You Install the AnyConnect Client	20
Ensuring Automatic Installation of AnyConnect Clients	20
AnyConnect Client and New Windows Installations	21
Adding a Security Appliance to the List of Trusted Sites (Internet Explorer)	21
Adding a Security Certificate in Response to Browser Security Alert Windows	22
Replacing a Digital Certificate with a Trusted Certificate	25
Installing the AnyConnect Client on a User’s PC	26
Where to Find the AnyConnect Client Files to Install	26
Installing the AnyConnect Client Using the Microsoft Windows Installer on a PC Running Windows	26
Installing the AnyConnect Client on a PC Running Linux	27
Installing the AnyConnect Client on a PC Running MAC OSX	27
Installing the AnyConnect Client and Configuring the Security Appliance with ASDM	29
Installing the AnyConnect Client on a Security Appliance Using CLI	39
Enabling AnyConnect Client SSL VPN Connections Using CLI	40
Disabling Permanent Client Installation	42
Configuring AnyConnect Features Using ASDM	43
Enabling Datagram Transport Layer Security (DTLS) with AnyConnect (SSL) Connections	43
Configuring DTLS	44
Prompting Remote Users	46
Enabling IPv6 VPN Access	47
Enabling Modules for Additional AnyConnect Features	47
Configuring, Enabling, and Using Other AnyConnect Features	48
Configuring Certificate-only Authentication	48
Using Compression	51
Changing Compression Globally	52
Changing Compression for Groups and Users	52
Enabling AnyConnect Keepalives	53
Enabling AnyConnect Rekey	54
Enabling and Adjusting Dead Peer Detection	56
Configuring the Dynamic Access Policies Feature of the Security Appliance	57
Cisco Secure Desktop Support	57
Configuring AnyConnect Features Using CLI	59
Enabling Datagram Transport Layer Security (DTLS) with AnyConnect (SSL) Connections	59
Enabling DTLS Globally for a Specific Port	60
Enabling DTLS for Specific Groups or Users	60
Prompting Remote Users	60
Enabling IPv6 VPN Access	61
Enabling Modules for Additional AnyConnect Features	62
Configuring, Enabling, and Using Other AnyConnect Features	63
Configuring Certificate-only Authentication	63
Using Compression	63
Configuring the Dynamic Access Policies Feature of the Security Appliance	64
Cisco Secure Desktop Support	64
Enabling AnyConnect Rekey	64
Enabling and Adjusting Dead Peer Detection	65
Enabling AnyConnect Keepalives	66
Configuring and Using AnyConnect Client Operating Modes and User Profiles	67
AnyConnect Client Operating Modes	67
Using the AnyConnect CLI Commands to Connect (Standalone Mode)	67
Connecting Using WebLaunch	69
User Log In and Log Out	70
Logging In	70
Logging Out	70
Configuring and Using User Profiles	70
Enabling AnyConnect Client Profile Downloads	71
Configuring Profile Attributes	76
Enabling Start Before Logon (SBL) for the AnyConnect Client	77
XML Settings for Enabling SBL	77
CLI Settings for Enabling SBL	77
Configuring the ServerList Attribute	78
Configuring the Certificate Match Attribute	78
Certificate Key Usage Matching	78
Extended Certificate Key Usage Matching	79
Certificate Distinguished Name Mapping	79
Certificate Matching Example	81
Customizing and Localizing the AnyConnect Client	83
Customizing the End-user Experience	83
Language Translation (Localization) for User Messages	85
Understanding Language Translation	85
Configuring Language Localization Using ASDM	86
Creating or Modifying a Translation Table Using ASDM	88
Import/Export Language Localization	89
Creating or Modifying a Translation Table Using CLI	90
Monitoring and Maintaining the AnyConnect Client	95
Viewing AnyConnect Client and SSL VPN Sessions	95
Adjusting MTU Size Using ASDM	96
Adjusting MTU Size Using CLI	96
Logging Off AnyConnect Client Sessions	97
Updating AnyConnect Client and SSL VPN Client Images	98
Sample AnyConnect Profile and XML Schema	99
Sample AnyConnect Profile	99
Sample AnyConnect Profile Schema	101
Using Microsoft Active Directory to Add the Security Appliance to the List of Internet Explorer Trusted Sites for Domain Users	113
Index	115
A	115
C	115
D	115
E	115
F	115
G	116
I	116
K	116
L	116
M	116
N	116
O	116
P	117
R	117
S	117
T	117
U	117
V	118
W	118

Match case Limit results 1 per page

4-3

Cisco AnyConnect VPN Client Administrator Guide

OL-12950-012

Chapter 4

Installing the AnyConnect Client on a Security Appliance Using CLI

Enabling AnyConnect Client SSL VPN Connections Using CLI

ip local pool

poolname

startaddr-endaddr

mask

The following example creates the local IP address pool

vpn_users

hostname(config)#

ip local pool

vpn_users

209.165.200.225-209.165.200.254

mask 255.255.255.224

Step 5

Assign IP addresses to a tunnel group. One method you can use to do this is to assign a local IP address

pool with the

address-pool

command from general-attributes mode:

address-pool

poolname

To do this, first enter the

tunnel-group

name

general-attributes

command to enter general-attributes

mode. Then specify the local IP address pool using the

address-pool

command.

In the following example, the user configures the existing tunnel group

telecommuters

to use the address

pool

vpn_users

created in step 3

hostname(config)#

tunnel-group telecommuters general-attributes

hostname(config-tunnel-general)#

address-pool

vpn_users

Step 6

Assign a default group policy to the tunnel group with the

default-group-policy

command from tunnel

group general attributes mode:

default-group-policy

name

In the following example, the user assigns the group policy

sales

to the tunnel group

telecommuters

hostname(config-tunnel-general)#

default-group-policy sales

Step 7

Create and enable a group alias that displays in the group list on the WebVPN Login page using the

group-alias

command from tunnel group webvpn attributes mode:

group-alias

name

enable

First exit to global configuration mode, and then enter the

tunnel-group

name

webvpn-attributes

command to enter tunnel group webvpn attributes mode.

In the following example, the user enters webvpn attributes configuration mode for the tunnel group

telecommuters

, and creates the group alias

sales_department

hostname(config)#

tunnel-group telecommuters webvpn-attributes

hostname(config-tunnel-webvpn)#

group-alias sales_department enable

Step 8

Enable the display of the tunnel-group list on the WebVPN Login page from webvpn mode:

tunnel-group-list enable

First exit to global configuration mode, and then enter webvpn mode.

In the following example, the user enters webvpn mode, and then enables the tunnel group list:

hostname(config)#

webvpn

hostname(config-webvpn)#

tunnel-group-list enable

Step 9

Specify SSL as a permitted VPN tunneling protocol for the group or user with the

vpn-tunnel-protocol

svc

command in group-policy mode or username mode:

vpn-tunnel-protocol svc

You can also specify other protocols to permit by adding the names of those protocols to this command.

For more information about the vpn-tunnel-protocol command, see the command description in

Cisco

Security Appliance Command Reference