Cisco Cisco ASA 5555-X Adaptive Security Appliance

Cisco

© 2012 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public Information.

Page 2 of 16

Contents

Introduction .............................................................................................................................................................. 3

Cisco ASA 5500 Series SSL/IPsec VPN Edition ................................................................................................... 3

Cisco AnyConnect Secure Mobility Client ............................................................................................................. 3

........................................................................................................................................................ 4

Solution Topology ................................................................................................................................................. 4

VPN Initiation on iOS ........................................................................................................................................ 4

VPN Initiation on Windows, Mac OS X, and Android

....................................................................................... 5

Connection Flow After Establishing VPN on All Devices .................................................................................. 5

Recommended Licensing and Software Versions ................................................................................................. 5

Configuration Best Practices .................................................................................................................................. 5

Installing the Applications...................................................................................................................................... 6

iOS and Android Devices ................................................................................................................................. 6

Windows and Mac OS X .................................................................................................................................. 6

Provisioning the AnyConnect VPN Profiles ........................................................................................................... 6

Provision VPN Profiles on ASA - Preferred Method ......................................................................................... 6

iOS Devices Using Apple Configuration Profiles - Alternative Method ............................................................. 6

Simplifying Connection Establishment .................................................................................................................. 7

Connect on Demand VPN for iOS Devices ...................................................................................................... 7

Trusted Network Detection for Windows, Mac OS X, and Android ................................................................... 9

Certificate-Based Authentication ...................................................................................................................... 9

Enhancing the Usability of the VPN Connection ................................................................................................. 10

Datagram Transport Layer Security (DTLS) ................................................................................................... 10

Session Persistence (Auto-Reconnect) .......................................................................................................... 11

Idle Timeout ................................................................................................................................................... 11

Dead Peer Detection (DPD) ........................................................................................................................... 12

Split-Tunnel Policy .............................................................................................................................................. 12

Full-Tunnel Policy ........................................................................................................................................... 12

Split-Include Policy with Network Access Control List (ACL) .......................................................................... 12

Split-Exclude Policy ........................................................................................................................................ 14

Troubleshooting Common Errors ........................................................................................................................ 14

Certificate Authentication Failures ...................................................................................................................... 14

SCEP Enrollment Failures .................................................................................................................................. 14

Jabber Doesn’t Auto-Launch the AnyConnect App on iOS Devices ................................................................... 15

Diagnostic AnyConnect Reporting Tool (DART) ................................................................................................. 15

Conclusion ............................................................................................................................................................. 15

Appendix A1: Configure On-Demand VPN URL in Cisco Unified Communications Manager ........................ 16