WIXLIB

ASDM Book 3: Cisco ASA Series VPN ASDM Configuration Guide, 7.16Americas HeadquartersCisco Systems, Inc.170 West Tasman DriveSan Jose, CA 95134-1706USAhttp://www.cisco.comTel: 408 526-4000800 553-NETS (6387)Fax: 408 527-0883

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS,INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND,EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITHTHE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY,CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB's public domain version ofthe UNIX operating system. All rights reserved. Copyright 1981, Regents of the University of California.NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS" WITH ALL FAULTS.CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OFMERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUTLIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERSHAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, networktopology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentionaland coincidental.All printed copies and duplicate soft copies of this document are considered uncontrolled. See the current online version for the latest version.Cisco has more than 200 offices worldwide. Addresses and phone numbers are listed on the Cisco website at www.cisco.com/go/offices.Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this emarks.html. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply apartnership relationship between Cisco and any other company. (1721R) 2021Cisco Systems, Inc. All rights reserved.

CONTENTSPREFACEAbout This GuidexviiDocument Objectives xviiRelated Documentation xviiDocument Conventions xviiCommunications, Services, and Additional Information xviiiPART ISite-to-Site and Client VPN 21CHAPTER 1VPN Wizards1VPN Overview 1IPsec Site-to-Site VPN Wizard 2AnyConnect VPN Wizard 4Clientless SSL VPN Wizard 6IPsec IKEv1 Remote Access Wizard 8IPsec IKEv2 Remote Access Wizard 12CHAPTER 2IKE15Configure IKE 15Enable IKE 15IKE Parameters for Site-to-Site VPN 16About IKEv2 Multi-Peer Crypto Map 19Guidelines for IKEv2 Multi-Peer 21IKE Policies 21Add or Edit an IKEv1 Policy 23Add or Edit an IKEv2 Policy 24Configure IPsec 26ASDM Book 3: Cisco ASA Series VPN ASDM Configuration Guide, 7.16iii

ContentsCrypto Maps 27Create or Edit an IPsec Rule Tunnel Policy (Crypto Map) - Basic Tab 29Create or Edit IPsec Rule Tunnel Policy (Crypto Map) - Advanced Tab 31Create or Edit IPsec Rule Traffic Selection Tab 32IPsec Pre-Fragmentation Policies 35Configure IKEv2 Fragmentation Options 36IPsec Proposals (Transform Sets) 37CHAPTER 3High Availability Options39High Availability Options 39VPN and Clustering on the FXOS Chassis 39VPN Load Balancing 40Failover 40VPN Load Balancing 40About VPN Load Balancing 40VPN Load-Balancing Algorithm 41VPN Load-Balancing Group Configurations 41Frequently Asked Questions About VPN Load Balancing 42Licensing for VPN Load Balancing 43Prerequisites for VPN Load Balancing 44Guidelines and Limitations for VPN Load Balancing 44Configuring VPN Load Balancing 45Configure VPN Load Balancing with the High Availability and Scalability Wizard 46Configure VPN Load Balancing (Without the Wizard) 47CHAPTER 4General VPN Setup 51System Options 51Configure Maximum VPN Sessions 53Configure DTLS 53Configure DNS Server Groups 54Configure the Pool of Cryptographic Cores 55Client Addressing for SSL VPN Connections 55Group Policies 56External Group Policies 58ASDM Book 3: Cisco ASA Series VPN ASDM Configuration Guide, 7.16iv

ContentsPassword Management with AAA Servers 59Internal Group Policies 60Internal Group Policy, General Attributes 60Configure Internal Group Policy, Server Attributes 63Internal Group Policy, Browser Proxy 64AnyConnect Client Internal Group Policies 65Internal Group Policy, Advanced, AnyConnect Client 65Configure Split-Tunneling for AnyConnect Traffic 68Configure Dynamic Split Tunneling 71Configure Dynamic Split Exclude Tunneling 71Configure Dynamic Split Include Tunneling 72Configure the Management VPN Tunnel 73Configure Linux to Support Excluded Subnets 74Internal Group Policy, AnyConnect Client Attributes 74Internal Group Policy, AnyConnect Login Settings 77Using Client Firewall to Enable Local Device Support for VPN 77Internal Group Policy, AnyConnect Client Key Regeneration 81Internal Group Policy, AnyConnect Client, Dead Peer Detection 81Internal Group Policy, AnyConnect Customization of Clientless Portal 82Configure AnyConnect Client Custom Attributes in an Internal Group Policy 83IPsec (IKEv1) Client Internal Group Policies 84Internal Group Policy, General Attributes for IPsec (IKEv1) Client 84About Access Rules for IPsec (IKEv1) Client in an Internal Group Policy 85Internal Group Policy, Client Firewall for IPsec (IKEv1) Client 85Internal Group Policy, Hardware Client Attributes for IPsec (IKEv1) 87Clientless SSL VPN Internal Group Policies 89Internal Group Policy, Clientless SSL VPN General Attributes 89Internal Group Policy, Clientless SSL VPN Access Portal 91Configure Internal Group Policy, Portal Customization for a Clientless SSL VPN 93Internal Group Policy, Login Settings for a Clientless SSL VPN 93Internal Group Policy, Single Signon and Auto Signon Servers for Clientless SSL VPN Access93Site-to-Site Internal Group Policies 93Configure VPN Policy Attributes for a Local User 95ASDM Book 3: Cisco ASA Series VPN ASDM Configuration Guide, 7.16v

ContentsConnection Profiles 97AnyConnect Connection Profile, Main Pane 97Specify a Device Certificate 98Connection Profiles, Port Settings 99AnyConnect Connection Profile, Basic Attributes 99Connection Profile, Advanced Attributes 100AnyConnect Connection Profile, General Attributes 101Connection Profile, Client Addressing 102Connection Profile, Client Addressing, Add or Edit 103Connection Profile, Address Pools 103Connection Profile, Advanced, Add or Edit IP Pool 103AnyConnect Connection Profile, Authentication Attributes 103Connection Profile, Secondary Authentication Attributes 105AnyConnect Connection Profile, Authorization Attributes 108AnyConnect Connection Profile, Authorization, Add Script Content to Select Username 109Clientless SSL VPN Connection Profile, Assign Authorization Server Group to Interface 112Connection Profiles, Accounting 112Connection Profile, Group Alias and Group URL 112Connection Profiles, Clientless SSL VPN 113Clientless SSL VPN Connection Profile, Basic Attributes 114Clientless SSL VPN Connection Profile, General Attributes 115Clientless SSL VPN Connection Profile, Authentication 115Clientless SSL VPN Connection Profile, Authentication, Add a Server Group 115Clientless SSL VPN Connection Profile, Secondary Authentication 116Clientless SSL VPN Connection Profile, Authorization 116Clientless SSL VPN Connection Profile, NetBIOS Servers 116Clientless SSL VPN Connection Profile, Clientless SSL VPN 117IKEv1 Connection Profiles 117IPsec Remote Access Connection Profile, Basic Tab 117Add/Edit Remote Access Connections, Advanced, General 118IKEv1 Client Addressing 120IKEv1 Connection Profile, Authentication 120IKEv1 Connection Profile, Authorization 120IKEv1 Connection Profile, Accounting 120ASDM Book 3: Cisco ASA Series VPN ASDM Configuration Guide, 7.16vi

ContentsIKEv1 Connection Profile, IPsec 120IKEv1 Connection Profile, IPsec, IKE Authentication 121IKEv1 Connection Profile, IPsec, Client Software Update 121IKEv1 Connection Profile, PPP 121IKEv2 Connection Profiles 122IPsec IKEv2 Connection Profile, Basic Tab 122IPsec Remote Access Connection Profile, Advanced, IPsec Tab 123Mapping Certificates to IPsec or SSL VPN Connection Profiles 124Certificate to Connection Profile Maps, Policy 124Certificate to Connection Profile Maps Rules 125Certificate to Connection Profile Maps, add Certificate Matching Rule Criterion 125Add/Edit Certificate Matching Rule Criterion 125Site-to-Site Connection Profiles 127Site-to-Site Connection Profile, Add, or Edit128Site-to-Site Tunnel Groups 130Site-to-Site Connection Profile, Crypto Map Entry 132Managing CA Certificates 133Site-to-Site Connection Profile, Install Certificate 133AnyConnect VPN Client Image 134Configure AnyConnect VPN Client Connections 135Configure AnyConnect Client Profiles 135Exempt AnyConnect Traffic from Network Address Translation 136AnyConnect HostScan 142Prerequisites for HostScan 142Licensing for AnyConnect HostScan 142HostScan Packaging 142Install or Upgrade HostScan 142Uninstall HostScan 143Assign AnyConnect Feature Modules to Group Policies 144HostScan Related Documentation 145AnyConnect Secure Mobility Solution 145Add or Edit MUS Access Control 147AnyConnect Customization and Localization 147AnyConnect Customization and Localization, Resources 148ASDM Book 3: Cisco ASA Series VPN ASDM Configuration Guide, 7.16vii

ContentsAnyConnect Customization and Localization, Binary and Script 148AnyConnect Customization and Localization, GUI Text and Messages 149AnyConnect Customization and Localization, Customized Installer Transforms 149AnyConnect Customization and Localization, Localized Installer Transforms 149AnyConnect Custom Attributes 150IPsec VPN Client Software151Zone Labs Integrity Server 152ISE Policy Enforcement 153Configure ISE Change of Authorization 153CHAPTER 5IP Addresses for VPNs157Configure an IP Address Assignment Policy 157Configure IP Address Assignment Options 158View Address Assignment Methods 158Configure Local IP Address Pools 158Configure Local IPv4 Address Pools 159Configure Local IPv6 Address Pools 159Assign Internal Address Pools to Group Policies 160Configure DHCP Addressing 161Assign IP Addresses to Local Users 162CHAPTER 6Dynamic Access Policies163About Dynamic Access Policies 163DAP Support of Remote Access Protocols and Posture Assessment Tools 164Remote Access Connection Sequence with DAPs 164Licensing for Dynamic Access Policies 165Configure Dynamic Access Policies 165Add or Edit a Dynamic Access Policy 167Test Dynamic Access Policies 168Configure AAA Attribute Selection Criteria in a DAP 168Retrieve Active Directory Groups 170AAA Attribute Definitions 171Configure Endpoint Attribute Selection Criteria in a DAP 171Add an Anti-Malware Endpoint Attribute to a DAP 172ASDM Book 3: Cisco ASA Series VPN ASDM Configuration Guide, 7.16viii