Eight easy steps to Cisco ASA remote access setup

There are eight basic steps in setting up remote access for users with the Cisco ASA.

• Step 1. Configure an Identity Certificate
• Step 2. Upload the SSL VPN Client Image to the ASA
• Step 3. Enable AnyConnect VPN Access
• Step 4. Create a Group Policy
• Step 5. Configure Access List Bypass
• Step 6. Create a Connection Profile and Tunnel Group
• Step 7. Configure NAT Exemption
• Step 8. Configure User Accounts

Step 1. Configure an Identity Certificate

Here I am creating a general purpose, self-signed, identity certificate named sslvpnkey and applying that certificate to the “outside” interface. You can purchase a certificate through a vendor such as Verisign, if you choose.

corpasa(config)#crypto key generate rsa label sslvpnkey

corpasa(config)#crypto ca trustpoint localtrust

corpasa(config-ca-trustpoint)#enrollment self

corpasa(config-ca-trustpoint)#fqdn sslvpn. mycompany.com

corpasa(config-ca-trustpoint)#subject-name CN=sslvpn.mycompany.com

corpasa(config-ca-trustpoint)#keypair sslvpnkey

corpasa(config-ca-trustpoint)#crypto ca enroll localtrust noconfirm

corpasa(config)# ssl trust-point localtrust outside

Step 2. Upload the SSL VPN Client Image to the ASA

You can obtain the client image at Cisco.com. As you choose which image to download to your tftp server, remember that you will need a separate image for each OS that your users have. After you select and download your client software, you can tftp it to your ASA.

asa(config)#copy tftp: flash:

Address or name of remote host [192.168.1.25]?

Source filename [anyconnect-win-2.3.2016-k9.pkg]?


Destination filename [anyconnect-win-2.3.2016-k9.pkg]?

Accessing tftp://192.168.1.25/anyconnect-win-2.3.2016-k9.pkg...!!!!!!!!

After the file has been uploaded to the ASA, configure this file to be used for webvpn sessions. Note that if you have more than one client, configure the most commonly used client to have the highest priority. In this case, we’re using only one client and giving it a priority of 1.

corpasa(config)#webvpn

corpasa(config-webvpn)#svc image disk0:/anyconnect-win-2.3.0254-k9.pkg 1

Step 3. Enable AnyConnect VPN Access

corpasa(config)#webvpn

corpasa(config-webvpn)#enable outside

corpasa(config-webvpn)#svc enable

Step 4. Create a Group Policy

Group Policies are used to specify the parameters that are applied to clients when they connect. In this case, we’ll create a group policy named SSLClient. The remote access clients will need to be assigned an IP address during login, so we’ll also set up a DHCP pool for them, but you could also use a DHCP server if you have one.

corpasa(config)#ip local pool SSLClientPool 192.168.100.1-192.168.100.50 mask 255.255.255.0

corpasa(config)#group-policy SSLCLient internal

corpasa(config)#group-policy SSLCLient attributes

corpasa(config-group-policy)#dns-server value 192.168.200.5

corpasa(config-group-policy)#vpn-tunnel-protocol svc

corpasa(config-group-policy)#default-domain value mysite.com

corpasa(config-group-policy)#address-pools value SSLClientPool

Step 5. Configure Access List ByPass

By using the sysopt connect command we tell the ASA to allow the SSL/IPsec clients to bypass the interface access lists.

corpasa(config)#sysopt connection permit-vpn

Step 6. Create a Connection Profile and Tunnel Group

As remote access clients connect to the ASA, they connect to a connection profile, which is also known as a tunnel group. We’ll use this tunnel group to define the specific connection parameters we want them to use. In our case, we’re configuring these remote access clients to use the Cisco AnyConnect SSL client, but you can also configure the tunnel groups to use IPsec, L2L, etc.

First, let’s create the tunnel group SSL Client:

corpasa(config)#tunnel-group SSLClient type remote-access

Next, we’ll assign the specific attributes:

corpasa(config)#tunnel-group SSLClient general-attributes

corpasa(config-tunnel-general)#default-group-policy SSLCLient

corpasa(config-tunnel-general)#tunnel-group SSLClient webvpn-attributes

corpasa(config-tunnel-webvpn)#group-alias MY_RA enable

corpasa(config-tunnel-webvpn)#webvpn

corpasa(config-webvpn)#tunnel-group-list enable

Note that the alias MY_RA is the group that your users will see when they are prompted for login authentication.

Step 7. Configure NAT Exemption

Now we need to tell the ASA not to NAT the traffic between the remote access clients and the internal network they will be accessing. First we’ll create an access list that defines the traffic, and then we’ll apply this list to the nat statement for our interface.

corpasa(config)#access-list no_nat extended permit

ip 192.168.200.0 255.255.255.0 192.168.100.0 255.255.255.0

corpasa(config)#nat (inside) 0 access-list no_nat

Step 8. Configure User Accounts

Now we’re ready for some user accounts. Here we’ll create a user and assign this user to our remote access vpn.

corpasa(config)#username hyde password l3tm3in

corpasa(config)#username hyde attributes

corpasa(config-username)#service-type remote-access

Finishing up

Don’t forget to save your configuration to memory.

corpasa#write memory

Verify your configuration by establishing a remote access session and use the following show command to view session details.

corpasa #show vpn-sessiondb svc

This guide should help you to get your remote access users up and running in no time. If you run into any difficulties, use the debug webvpn commands to diagnose the problem.

How to Configure ASA 5505 with ATT DSL

Make sure that you connect the ethernet cable from your ATT router to the E0/0 port of the ASA 5505.

Get into global configuration mode and enter the following:

1. vpdn group ATT request dialout pppoe
2. vpdn group ATT localname xyz@att.net
3. vpdn group ATT ppp authentication pap
4. vpdn username xyz@att.net password *******
5. interface Vlan1
6. nameif inside
7. ip address x.x.x.x 255.255.255.0 >>> this is your clients ip default gateway to the internet
8. interface Vlan2
9. nameif outside
10. pppoe client vpdn group ATT
11. ip address pppoe setroute
12. interface Ethernet0/0
13. switchport access vlan 2
14. no shutdown
15. interface Ethernet0/1
16. no shutdown
    
17. interface Ethernet0/2
    no shutdown
    
18. interface Ethernet0/3
    no shutdown
    
19. interface Ethernet0/4
    no shutdown
    
20. interface Ethernet0/5
    no shutdown
    
21. interface Ethernet0/6
    no shutdown
    
22. interface Ethernet0/7
    no shutdown
    
23. exit
    
24. nat (inside) 1 0.0.0.0 0.0.0.0
    
25. global (outside) 1 interface
    
26. end
    
27. write
    

How to change the Remote Desktop listening port on Windows Vista!

This will work with Sever 2003 and XP.

1.Open up the Windows Registry Editor and browse to this Registry path:


HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp2.Locate the PortNumber Registry key on the right-pane, double-click to open, click the Decimal option in the Base section, enter 443 in the text box and click OK (change 443 to the port number of your need).

Take note that:

The new TCP port for Remote Desktop service must not currently in used. To confirm the TCP port 443 is free or unused, type

netstat -an
find "443"

At the Command Prompt window. If there is no output from the netstat command, meaning that the TCP 443 port number is not in used (and thus available for new RDP listening port).

If you’re not comfortable with Windows Registry Editor, you can simply copy and paste the following Console Registry Tool command (Reg.exe) to an elevated Command Prompt window in Windows Vista:

You might need to download Reg.exe from Microsoft if it’s not currently in your Windows.
REG ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 443 /f
To change back to the default, simply replace the PortNumber Registry key (in this case, TCP 443) to TCP port 3389.
How to restart Windows Remote Desktop service after changing its listening port?
There are at least two ways to enable/disable or restart Remote Desktop service – Group Policies or System Properties:
Using Group Policies (i.e. gpedit.msc)
1.Click the Vista Orb, type gpedit.msc in the Start Search text box (Vista Instant Search) and double-click the “gpedit” in the Program list
2.For Windows XP SP2:

In Computer Configuration, Administrative Templates, Windows Components, Terminal Services, double-click the Allows users to connect remotely using Terminal Services setting.
For Windows Vista Ultimate:
In Computer Configuration, Administrative Templates, Windows Components, Terminal Services, Terminal Server, Connections, double-click the Allows users to connect remotely using Terminal Services setting.
3.Click Disable to deactivate Remote Desktop and then click Enable to reactivate the service again.
Using System Properties dialog box

If the “Allows users to connect remotely using Terminal Services” Group Policy setting is set to “Not Configured”, the “Enable Remote Desktop on this computer” setting (on the Remote tab of the System Properties dialog box) takes precedence. Otherwise, the “Allows users to connect remotely using Terminal Services” Group Policy setting takes precedence.

Unable to Launch ASDM Connection Timed Out Error!

This is a very simple problem to fix.  Simply log on to the ASA with via the console cable and follow the steps below.

1. 
   
   Log into the ASA device via the console cable and go to global configuration mode
   
   
   
2. 
   
   Type in "http server enable" - this turns on management.
   
   
   
3. 
   
   Type in "http 192.168.1.0 255.255.255.0 inside" - subnet that you will allow management from.