Home » Cisco Manuals » Networking » Cisco 5505 » Manual Viewer

Cisco 5505 Administration Guide - Page 97

Logging Off AnyConnect Client Sessions - router

UPC - 882658082252

Add to My Manuals
Save this manual to your list of manuals

Page 97 highlights

Chapter 9 Monitoring and Maintaining the AnyConnect Client Viewing AnyConnect Client and SSL VPN Sessions This command affects only the AnyConnect Client. The Cisco SSL VPN Client (SVC) is not capable of adjusting to different MTU sizes. The default size for this command in the default group policy is 1406. The MTU size is adjusted automatically based on the MTU of the interface that the connection uses, minus the IP/UDP/DTLS overhead. This command affects AnyConnect Client connections established in SSL and those established in SSL with DTLS. The following example configures the MTU size to 1200 bytes for the group policy telecommuters: hostname(config)# group-policy telecommuters attributes hostname(config-group-policy)# webvpn hostname(config-group-webvpn)# svc mtu 1200 Many consumer-grade end user terminating devices (for example, a home router) do not properly handle the creation or assembly of IP fragments. This is particularly true of UDP. Since DTLS is a UDP-based protocol, it is sometimes necessary to reduce the MTU to prevent fragmentation. The MTU parameter is used by both the client and the security appliance to set the maximum size of the packet to be transmitted over the tunnel. If an end user is experiencing a significant amount of lost packets, or if an application such as Microsoft Outlook is not functioning over the tunnel, it might indicate a fragmentation issue. Lowering the MTU for that user or group of users may address the problem. The client proposes an MTU value that is 94 bytes less than the MTU of the physical adapter used for the SSL and DTLS connection to the security appliance. The security appliance accepts the lesser of the configured MTU or the value proposed by the client. Both the client and the security appliance use the value selected by the security appliance. For example, if the physical adapter on the PC has been changed to use an MTU of 1300, then the client proposes an MTU of 1206 to the security appliance. If the security appliance is set for a value lower than 1206, both the client and the security appliance use the lower value that was set using the MTU configuration command. Logging Off AnyConnect Client Sessions To log off all AnyConnect Client and SSL VPN sessions, use the vpn-sessiondb logoff svc command in global configuration mode: vpn-sessiondb logoff svc In response, the system asks you to confirm that you want to log off the VPN sessions. To confirm press Enter or type y. Entering any other key cancels the logging off. The following example logs off all SSL VPN sessions: hostname# vpn-sessiondb logoff svc INFO: Number of sessions of type "svc" logged off : 1 Do you want to logoff the VPN session(s)? [confirm] INFO: Number of sessions logged off : 6 hostname# You can log off individual sessions using either the name option, or the index option: vpn-sessiondb logoff name name vpn-sessiondb logoff index index For example, to log off the user named tester, enter the following command: hostname# vpn-sessiondb logoff name tester Do you want to logoff the VPN session(s)? [confirm] OL-12950-012 Cisco AnyConnect VPN Client Administrator Guide 9-3

Section	Page
About This Guide 7	3
chapter 1	3
Introduction 1	3
chapter 2	3
Common AnyConnect VPN Client Installation and Configuration Procedures 1	3
chapter 3	4
Installing the AnyConnect Client and Configuring the Security Appliance with ASDM 1	4
chapter 4	4
Installing the AnyConnect Client on a Security Appliance Using CLI 1	4
chapter 5	4
Configuring AnyConnect Features Using ASDM 1	4
chapter 6	4
Configuring AnyConnect Features Using CLI 1	4
chapter 7	5
Configuring and Using AnyConnect Client Operating Modes and User Profiles 1	5
chapter 8	5
Customizing and Localizing the AnyConnect Client 1	5
chapter 9	5
Monitoring and Maintaining the AnyConnect Client 1	5
appendix A	5
Sample AnyConnect Profile and XML Schema 1	5
appendix B	6
Using Microsoft Active Directory to Add the Security Appliance to the List of Internet Explorer Trusted Sites for Domain Users 1	6
Index	6
About This Guide	7
Document Objectives	7
Audience	7
Related Documentation	8
Document Organization	8
Document Conventions	9
Obtaining Documentation, Obtaining Support, and Security Guidelines	10
Licensing	10
Introduction	11
AnyConnect Client Features	11
Remote User Interface	12
Getting and Installing the Files You Need	17
CSA Interoperability with the AnyConnect Client and Cisco Secure Desktop	17
Common AnyConnect VPN Client Installation and Configuration Procedures	19
Installing the AnyConnect Client	19
Before You Install the AnyConnect Client	20
Ensuring Automatic Installation of AnyConnect Clients	20
AnyConnect Client and New Windows Installations	21
Adding a Security Appliance to the List of Trusted Sites (Internet Explorer)	21
Adding a Security Certificate in Response to Browser Security Alert Windows	22
Replacing a Digital Certificate with a Trusted Certificate	25
Installing the AnyConnect Client on a User’s PC	26
Where to Find the AnyConnect Client Files to Install	26
Installing the AnyConnect Client Using the Microsoft Windows Installer on a PC Running Windows	26
Installing the AnyConnect Client on a PC Running Linux	27
Installing the AnyConnect Client on a PC Running MAC OSX	27
Installing the AnyConnect Client and Configuring the Security Appliance with ASDM	29
Installing the AnyConnect Client on a Security Appliance Using CLI	39
Enabling AnyConnect Client SSL VPN Connections Using CLI	40
Disabling Permanent Client Installation	42
Configuring AnyConnect Features Using ASDM	43
Enabling Datagram Transport Layer Security (DTLS) with AnyConnect (SSL) Connections	43
Configuring DTLS	44
Prompting Remote Users	46
Enabling IPv6 VPN Access	47
Enabling Modules for Additional AnyConnect Features	47
Configuring, Enabling, and Using Other AnyConnect Features	48
Configuring Certificate-only Authentication	48
Using Compression	51
Changing Compression Globally	52
Changing Compression for Groups and Users	52
Enabling AnyConnect Keepalives	53
Enabling AnyConnect Rekey	54
Enabling and Adjusting Dead Peer Detection	56
Configuring the Dynamic Access Policies Feature of the Security Appliance	57
Cisco Secure Desktop Support	57
Configuring AnyConnect Features Using CLI	59
Enabling Datagram Transport Layer Security (DTLS) with AnyConnect (SSL) Connections	59
Enabling DTLS Globally for a Specific Port	60
Enabling DTLS for Specific Groups or Users	60
Prompting Remote Users	60
Enabling IPv6 VPN Access	61
Enabling Modules for Additional AnyConnect Features	62
Configuring, Enabling, and Using Other AnyConnect Features	63
Configuring Certificate-only Authentication	63
Using Compression	63
Configuring the Dynamic Access Policies Feature of the Security Appliance	64
Cisco Secure Desktop Support	64
Enabling AnyConnect Rekey	64
Enabling and Adjusting Dead Peer Detection	65
Enabling AnyConnect Keepalives	66
Configuring and Using AnyConnect Client Operating Modes and User Profiles	67
AnyConnect Client Operating Modes	67
Using the AnyConnect CLI Commands to Connect (Standalone Mode)	67
Connecting Using WebLaunch	69
User Log In and Log Out	70
Logging In	70
Logging Out	70
Configuring and Using User Profiles	70
Enabling AnyConnect Client Profile Downloads	71
Configuring Profile Attributes	76
Enabling Start Before Logon (SBL) for the AnyConnect Client	77
XML Settings for Enabling SBL	77
CLI Settings for Enabling SBL	77
Configuring the ServerList Attribute	78
Configuring the Certificate Match Attribute	78
Certificate Key Usage Matching	78
Extended Certificate Key Usage Matching	79
Certificate Distinguished Name Mapping	79
Certificate Matching Example	81
Customizing and Localizing the AnyConnect Client	83
Customizing the End-user Experience	83
Language Translation (Localization) for User Messages	85
Understanding Language Translation	85
Configuring Language Localization Using ASDM	86
Creating or Modifying a Translation Table Using ASDM	88
Import/Export Language Localization	89
Creating or Modifying a Translation Table Using CLI	90
Monitoring and Maintaining the AnyConnect Client	95
Viewing AnyConnect Client and SSL VPN Sessions	95
Adjusting MTU Size Using ASDM	96
Adjusting MTU Size Using CLI	96
Logging Off AnyConnect Client Sessions	97
Updating AnyConnect Client and SSL VPN Client Images	98
Sample AnyConnect Profile and XML Schema	99
Sample AnyConnect Profile	99
Sample AnyConnect Profile Schema	101
Using Microsoft Active Directory to Add the Security Appliance to the List of Internet Explorer Trusted Sites for Domain Users	113
Index	115
A	115
C	115
D	115
E	115
F	115
G	116
I	116
K	116
L	116
M	116
N	116
O	116
P	117
R	117
S	117
T	117
U	117
V	118
W	118

Match case Limit results 1 per page

9-3

Cisco AnyConnect VPN Client Administrator Guide

OL-12950-012

Chapter 9

Monitoring and Maintaining the AnyConnect Client

Viewing AnyConnect Client and SSL VPN Sessions

This command affects only the AnyConnect Client. The Cisco SSL VPN Client (SVC) is not capable of

adjusting to different MTU sizes.

The default size for this command in the default group policy is 1406. The MTU size is adjusted

automatically based on the MTU of the interface that the connection uses, minus the IP/UDP/DTLS

overhead.

This command affects AnyConnect Client connections established in SSL and those established in SSL

with DTLS.

The following example configures the MTU size to 1200 bytes for the group policy

telecommuters

hostname(config)#

group-policy telecommuters attributes

hostname(config-group-policy)#

webvpn

hostname(config-group-webvpn)#

svc mtu 1200

Many consumer-grade end user terminating devices (for example, a home router) do not properly handle

the creation or assembly of IP fragments. This is particularly true of UDP. Since DTLS is a UDP-based

protocol, it is sometimes necessary to reduce the MTU to prevent fragmentation. The MTU parameter is

used by both the client and the security appliance to set the maximum size of the packet to be transmitted

over the tunnel. If an end user is experiencing a significant amount of lost packets, or if an application

such as Microsoft Outlook is not functioning over the tunnel, it might indicate a fragmentation issue.

Lowering the MTU for that user or group of users may address the problem.

The client proposes an MTU value that is 94 bytes less than the MTU of the physical adapter used for

the SSL and DTLS connection to the security appliance. The security appliance accepts the lesser of the

configured MTU or the value proposed by the client. Both the client and the security appliance use the

value selected by the security appliance.

For example, if the physical adapter on the PC has been changed to use an MTU of 1300, then the client

proposes an MTU of 1206 to the security appliance. If the security appliance is set for a value lower than

1206, both the client and the security appliance use the lower value that was set using the MTU

configuration command.

Logging Off AnyConnect Client Sessions

To log off all AnyConnect Client and SSL VPN sessions, use the

vpn-sessiondb logoff svc

command in

global configuration mode:

vpn-sessiondb logoff svc

In response, the system asks you to confirm that you want to log off the VPN sessions. To confirm press

Enter or type y. Entering any other key cancels the logging off.

The following example logs off all SSL VPN sessions:

hostname#

vpn-sessiondb logoff svc

INFO: Number of sessions of type "svc" logged off : 1

Do you want to logoff the VPN session(s)? [confirm]

INFO: Number of sessions logged off : 6

hostname#

You can log off individual sessions using either the

name

option, or the

index

option:

vpn-sessiondb logoff name

name

vpn-sessiondb logoff index

index

For example, to log off the user named tester, enter the following command:

hostname# vpn-sessiondb logoff name tester

Do you want to logoff the VPN session(s)? [confirm]