69-43
Cisco ASA 5500 Series Configuration Guide using ASDM
Chapter69 General VPN Setup
Configuring AnyConnect VPN Client Connections
Without a previously-installed client, remote users enter the IP address in their browser of an interface
configured to accept SSL VPN connections. Unless the ASA is configured to redirect http:// requests to
https://, users must enter the URL in the form https://<address>.
After entering the URL, the browser connects to that interface and displays the login screen. If the user
satisfies the login and authentication, and the ASA identifies the user as requiring the client, it
downloads the client that matches the operating system of the remote computer. After downloading, the
client installs and configures itself, establishes a VPN connection and either remains or uninstalls itself
(depending on the ASA configuration) when the connection terminates.
In the case of a previously installed client, when the user authenticates, the ASA examines the revision
of the client, and upgrades the client as necessary.
The AnyConnect client can be downloaded from the ASA, or it can be installed manually on the remote
PC by the system administrator. For more information about installing the client manually, see the
AnyConnect Administrators Guide.
The ASA downloads the client based on the group policy or username attributes of the user establishing
the connection. You can configure the ASA to automatically download the client, or you can configure
it to prompt the remote user about whether to download the client. In the latter case, if the user does not
respond, you can configure the ASA to either download the client after a timeout period or present the
login page.
Fields
•Keep Installer on Client System—Enable to allow permanent client installation on the remote
computer. Enabling disables the automatic uninstalling feature of the client. The client remains
installed on the remote computer for subsequent connections, reducing the connection time for the
remote user.
Note AnyConnect versions 3.0 and later do no support permanent client installation. The CLI is still
available to support older versions of AnyConnect.
•Compression—Compression increases the communications performance between the security
appliance and the client by reducing the size of the packets being transferred.
•Datagram TLS—Datagram Transport Layer Security avoids latency and bandwidth problems
associated with some SSL connections and improves the performance of real-time applications that
are sensitive to packet delays.
•Ignore Don’t Defrag (DF) Bit—This feature allows the force fragmentation of packets that have the
DF bit set, allowing them to pass through the tunnel. An example use case is for servers in your
network that do not respond correctly to TCP MSS negotiations.
•Keepalive Messages—Enter a number, from 15 to 600 seconds, in the Interval field to enable and
adjust the interval of keepalive messages to ensure that an connection through a proxy, firewall, or
NAT device remains open, even if the device limits the time that the connection can be idle.
Adjusting the interval also ensures that the client does not disconnect and reconnect when the remote
user is not actively running a socket-based application, such as Microsoft Outlook or Microsoft
Internet Explorer.
•MTU—Adjusts the MTU size for SSL connections. Enter a value in bytes, from 256 to 1410 bytes.
By default, the MTU size is adjusted automatically based on the MTU of the interface that the
connection uses, minus the IP/UDP/DTLS overhead.