Cisco Cisco AnyConnect Secure Mobility Client v2.x Technical Manual

Page of 15
This technote is a configuration example using AnyConnect NVM with Splunk.
Prerequisites
Requirements
Cisco recommends that you have knowledge of these topics:
  
AnyConnect 4.2.01022 or higher with NVM
AnyConnect APEX license
ASDM 7.5.1 or higher
Components Used
The information in this document is based on these software and hardware versions:
  
Cisco AnyConnect Security Mobility Client 4.2 or later
Cisco AnyConnect Profile Editor
Cisco Adaptive Security Appliance (ASA), version 9.5.2
Cisco Adaptive Security Device Manager (ASDM), version 7.5.1
Splunk Enterprise 6.3
Ubuntu 14.04.3 LTS as a collector device
The information in this document was created from the devices in a specific lab environment. All of
the devices used in this document started with a cleared (default) configuration. If your network is
live, make sure that you understand the potential impact of any command.
Background Information
Cisco Anyconnect Secure Mobility Client
Cisco Anyconnect is a unified agent that delivers multiple security services to protect the
enterprise. Anyconnect is most commonly used as an enterprise VPN client, but it also supports
additional modules that cater to different aspects of enterprise security. The additional modules
enable security features like posture assessment, web security, malware protection, network
visibility and more.
This technote is about Network Visibility Module (NVM), which integrates with Cisco Anyconnect to
provide administrators the ability to monitor endpoint application usage.
For more information regarding Cisco Anyconnect, refer to:
Internet Protocol Flow Information Export (IPFIX)