Typically, the default group policy is where you will set up the global values common to most users.Ĭorpasa (config)#group-policy DfltGrpPolicy attributesĬorpasa (config-group-policy)# wins-server value 192.168.80.205Ĭorpasa (config-group-policy)# dns-server value 172.20.100.1Ĭorpasa (config-group-policy)# dns-server value 192.168.80.Choose Configuration > Remote Access VPN > Network (Client) Access > Anyconnect Client Software > Add in order to add the Cisco An圜onnect VPN client image from the flash memory of ASA as shown. Next, I've made some modifications to the default group policy for items such as the dns-servers, the default domain, etc. The remote access clients will need to be assigned an IP address during login so we'll set up an address pool for them, but you could also use a DHCP server if you have one.Ĭorpasa(config)#ip local pool VPN 192.168.100.1-192.168.100.50 mask 255.255.255.0 Group Policies are used to specify the parameters that are applied to clients when they connect. Ĭorpasa(config-ca-trustpoint)#subject-name CN=Ĭorpasa(config-ca-trustpoint)#keypair sslvpnkeyĬorpasa(config-ca-trustpoint)#crypto ca enroll localtrust noconfirmĬorpasa(config)# ssl trust-point localtrust outside Figure AĬlick to enlarge. You can purchase a certificate through a vendor such as Verisign, etc., if you choose.Ĭorpasa(config)#crypto key generate rsa label sslvpnkeyĬorpasa(config)#crypto ca trustpoint localtrustĬorpasa(config-ca-trustpoint)#enrollment selfĬorpasa(config-ca-trustpoint)#fqdn sslvpn. Here, I am creating a general purpose, self-signed, identity certificate named sslvpnkey and applying that certificate to the 'outside' interface. I've supplied most of the command-line work here as well as the ASDM equivalent. In the following steps, I'll set up the basics of Clientless SSL VPN access. The ASA does not permit communication with sites that have invalid certificates.Īs always, refer to for more detailed information and specific configuration variations. This certificate is never seen by the end user. When accessing resources, the ASA establishes a secure connection and validates the server SSL certificate. In a clientless SSL session, the Cisco ASA acts as a proxy between the remote user and the internal resources. Keep in mind that the SSL VPN remote access solution does have some limitations. This will be a two-part article with the first part covering the initial setup and the second part going into more depth on the customization of the remote user interface. However, with a bit of patience, you'll find it's actually quite flexible and provides a way to offer users access to needed resources in a very controlled environment, without having to manage a client install.

I've found it to be more complicated to set up and customize than remote access using the VPN client.

Clientless SSL VPN remote access has its pluses and minuses.

Configuring ssl vpn on asa asdm