CẤU HÌNH ASA VPN SSL ANYCONNECT

CẤU HÌNH ASA VPN SSL ANYCONNECT

Link video: />TASK 1:
Đặt IP cho interface ASA
interface GigabitEthernet0/0
nameif inside
security-level 100
ip address 192.168.1.1 255.255.255.0
no shutdown

!
interface GigabitEthernet0/1
nameif outside
security-level 0
ip address 200.200.200.1 255.255.255.252
no shutdown

#######Route ra ngoài#########
route outside 0.0.0.0 0.0.0.0 200.200.200.2


TASK 2: ENABLE SSL VPN

###Bật tính năng vpn ssl####
webvpn

#####Chỉ ra Gói nào sẽ được down về client khi họ connect#####
anyconnect image flash:/anyconnect-win-4.1.08005-k9.pkg ****lấy từ lệnh show flash: trên firewall
ra*******

#####cho phép gọi đến IP outside để VPN######

enable outside

####mở tính năng anyconnect kết nối#####
anyconnect enable

#####cho phép traffic VPN đi từ ngoài vào####
sysopt connection permit-vpn

#######Tạo POOL IP gán cho user VPN##########
ip local pool VPN_POOL 192.168.10.100-192.168.10.200 mask 255.255.255.0

#######Chỉ ra dải mạng LAN mà user VPN được gọi vào##########
access-list ALLOW-ACCESS-LAN standard permit 192.168.1.0 255.255.255.0

#######Tạo policy áp đặt cho những người kết nối VPN########
group-policy ANYCONNECT_POLICY internal
group-policy ANYCONNECT_POLICY attributes


vpn-tunnel-protocol ssl-client ssl-clientless

split-tunnel-policy tunnelspecified
split-tunnel-network-list value ALLOW-ACCESS-LAN
dns-server value 8.8.8.8
exit

#######Tạo tunnel vpn và gắn với policy vừa tạo##########
tunnel-group MY_TUNNEL type remote-access
tunnel-group MY_TUNNEL general-attributes
default-group-policy ANYCONNECT_POLICY

address-pool VPN_POOL
exit

tunnel-group MY_TUNNEL webvpn-attributes
group-alias ONLINE_STAFF enable

webvpn
tunnel-group-list enable

#######Tạo account#########
username hainm password hainm
username hainm attributes
service-type remote-access

####Verify trên ASA######
ciscoasa# show vpn-sessiondb anyconnect
Session Type: AnyConnect


Username

: hainm

Index

Assigned IP : 192.168.10.100

: 11

Public IP : 100.100.100.2

Protocol

: Clientless SSL-Tunnel DTLS-Tunnel

License

: AnyConnect Premium

Encryption : Clientless: (1)AES256 SSL-Tunnel: (1)AES-GCM-256 DTLS-Tunnel: (1)AES256
Hashing

: Clientless: (1)SHA1 SSL-Tunnel: (1)SHA384 DTLS-Tunnel: (1)SHA1

Bytes Tx

: 865255

Bytes Rx

Group Policy : ANYCONNECT_POLICY

: 532441
Tunnel Group : MY_TUNNEL

Login Time : 02:50:58 UTC Thu Oct 7 2021
Duration

: 0h:52m:50s

Inactivity : 0h:00m:00s
VLAN Mapping : N/A

VLAN

: none

Audt Sess ID : c0a801010000b000615e6092
Security Grp : none