Automatic Anyconnect VPN connection on untrusted networks

Often it is needed for the remote workers to have automatic VPN connection when they are outside of the company. You can use ASA and Anyconnect client to deploy such solution. In this blog post I will show you have to configure Cisco ASA to support Anyconnect for such deployment. Certificates will be used for authentication.

The first thing is to configure SSL VPN server on the Cisco ASA to use certificates for the authentication. I will skip certificate issuing procedure. Bellow you will find basic configuration for SSL VPN on the ASA.

webvpn
 enable outside
 anyconnect image disk0:/anyconnect-win-3.1.04072-k9.pkg 1
 anyconnect enable

ssl trust-point SSLVPN_CERT outside

group-policy SSLVPN_GP attributes
 dns-server value 192.168.1.10 192.168.1.11
 vpn-filter value SSLVPN_FW
 vpn-tunnel-protocol ssl-client
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value SSLVPN_SPLIT
 default-domain value example.com
 address-pools value SSLVPN_POOL

tunnel-group SSLVPN_TG type remote-access
tunnel-group SSLVPN_TG general-attributes
 default-group-policy SSLVPN_GP
tunnel-group SSLVPN_TG webvpn-attributes
 authentication certificate
 group-url https://vpn.example.com/auto enable

This is basic SSLVPN configuration and you can try to connect on the outside interface. The next step is to configure Anyconnect profile which will create policy for automatic VPN connection on untrusted networks. You can create Anyconnect profile via ASDM.

When you are connected to ASA with ASDM, click Configuration -> Remote Access VPN -> Network(Client) Access -> AnyConnect Client Profile. In this configuration mode you can add new Anyconnect profile. Click Add button and choose Profile Name and Profile Location. You can also apply this profile to Group Policy you have created in the previous step. But this could be also added later with the command. Click OK and Apply.

group-policy SSLVPN_GP attributes
 webvpn
  anyconnect profiles value AUTO type user

 

Now double click on the profile that has been created and configure profile.

Preference (Part 1)

• Select User as certificate store.

 

Preference (Part 2)

• Uncheck Disable Automatic Certificate Selection which will configure Anyconnect to automatically select correct certificate.
• Check Automatic VPN Policy and select Disconnect on Trusted Network Policy and Connect on Untrusted Network Policy. You must also enter DNS domain name for your trusted network and you should also add DNS servers.

 

Certificate Matching

• In this tab you can configure which certificate to use when connecting to the SSL VPN server. I have selected the ISSUER-CN.

Server List

• You must add at least one server otherwise Certificate Matching will be ignored. Configure the same display name and host address as used in the tunnel-group.

 

After all this has been configured you are ready to test your connection. First you need to connect with Anyconnect manually, so that Anyconnect client download profile. After that you can connect to the Untrusted network and test if your Anyconnect client will connect automatically.

Using SCP to copy files on Cisco router

Often you have to copy for example new IOS image or configuration to some remote Cisco devices. If you only have ssh access you can use SCP to copy files.

If SSH is already configured on the remote Cisco device, all you need is to enable SCP server.

ip scp server enable

After that you can use any linux box to transfer files between router and this linux box.

To copy files from linux box to Cisco device use the following syntax:

scp filename username@ip_address:remote_filename

This command will copy file from file system on linux box to remote Cisco device on the root location on the flash.

To copy files from Cisco flash to linux box use the following syntax:

scp username@ip_address:remote_filename filename

Parse Cisco ASA logs with python to create security policy

When you are implementing new firewall in the network segment where there was no firewall before, you often wondering what access rules to implement. You can interview administrators of the other systems but usually you will not get detailed feedback about which ports and IP addresses should be permitted.

Therefore one of the method to implement firewall between segment is to permit all traffic at the beginning and log all traffic that was permitted. This learning period should be implemented for some time to get baseline traffic. After sufficient time, logs should be analyzed to found out which ports and IP addresses to permit. 

The downside of this method is that you will not catch ports and IP addresses that were not used during learning period. Before implementing blocking policy you should always check with administrators of the other systems if anything else is needed. 

If you are using Cisco ASA as your firewall you can enable logging on the access-list with the log command.

access-list FW permit ip any any log

In this way Cisco ASA will generate log %ASA-6-106100 when new connection is matched on the access-list entry. You can export this logs to syslog server and store these logs to text file. To export only these messages to log server you can use the following configuration.

logging enable
logging timestamp
logging list acl_permit_list message 106100
logging trap acl_permit_list
logging host inside 192.168.1.100

After logs are collected you can use some tool to parse information that you need. You will find simple python script bellow to extract protocol, source interface, source IP address, destination interface, destination IP address and destination port from the logs. You need to put file location in the first line of the script. 




file_location = 'PUT YOUR LOG FILE LOCATION HERE'
f = open(file_location,'r')

ports = []

for line in f:
    temp = []
    temp.append(line.split(" ")[9])
    temp.append(line.split(" ")[10].split("/")[0])
    temp.append(line.split(" ")[10].split("/")[1].split("(")[0])
    temp.append(line.split(" ")[12].split("/")[0])
    temp.append(line.split(" ")[12].split("/")[1].split("(")[0])
    temp.append(line.split(" ")[12].split("/")[1].split("(")[1][:-1])
    ports.append("_".join(temp))

ports_final = list(set(ports))

print len(ports_final)

for i in ports_final:
    print i.split("_")


f.close()