Cisco Systems ASA5515K9, ASA 5500 Configuring AnyConnect VPN Client Connections

CHAPT ER
75-1
Cisco ASA 5500 Series Configuration Guide using the CLI
75
Configuring AnyConnect VPN Client Connections
This section describes how to configure AnyConnect VPN Client Connections and covers the following
topics:
•Information About AnyConnect VPN Client Connections, page75-1
•Licensing Requirements for AnyConnect Connections, page75-2
•Guidelines and Limitations, page75-5
•Configuring AnyConnect Connections, page75-5
•Configuring Advanced AnyConnect Features, page75-14
•Configuration Examples for Enabling AnyConnect Connections, page75-21
•Feature History for AnyConnect Connections, page75-21
Information About AnyConnect VPN Client Connections
The Cisco AnyConnect Secure Mobility Client provides secure SSL and IPsec/IKEv2 connections to the
ASA for remote users. Without a previously-installed client, remote users enter the IP address in their
browser of an interface configured to accept SSL or IPsec/IKEv2 VPN connections. Unless the ASA is
configured to redirect http:// requests to https://, users must enter the URL in the form https://<address>.
After entering the URL, the browser connects to that interface and displays the login screen. If the user
satisfies the login and authentication, and the ASA identifies the user as requiring the client, it
downloads the client that matches the operating system of the remote computer. After downloading, the
client installs and configures itself, establishes a secure SSL or IPsec/IKEv2 connection and either
remains or uninstalls itself (depending on the configuration) when the connection terminates.
In the case of a previously installed client, when the user authenticates, the ASA examines the revision
of the client, and upgrades the client as necessary.
When the client negotiates an SSL VPN connection with the ASA, it connects using Transport Layer
Security (TLS), and optionally, Datagram Transport Layer Security (DTLS). DTLS avoids latency and
bandwidth problems associated with some SSL connections and improves the performance of real-time
applications that are sensitive to packet delays.
The AnyConnect client can be downloaded from the ASA, or it can be installed manually on the remote
PC by the system administrator. For more information about installing the client manually, see the
Cisco AnyConnect VPN Client Administrator Guide.