Cisco Systems CL-28826-01 Understanding Devices Supported by Each Remote Access VPN Technology

29-8

User Guide for Cisco Security Manager 4.4

OL-28826-01

Chapter 29 Managing Remote Access VPNs: The Basics

Understanding Devices Supported by Each Remote Access VPN Technology

•SSL VPN license information cannot be imported into Security Manager. As a result, certain

command parameters, such as vpn sessiondb and max-webvpn-session-limit, cannot be validated.

•You must configure DNS on each device in the topology in order to use clientless SSL VPN. Without

DNS, the device cannot retrieve named URLs, but only URLs with IP addresses.

•If you share your Connection Profiles policy among multiple ASA devices, bear in mind that all

devices share the same address pool unless you use device-level object overrides to replace the

global definition with a unique address pool for each device. Unique address pools are required to

avoid overlapping addresses in cases where the devices are not using NAT.

•If the device configuration contains an address pool for SSL VPN with a name that begins CSM_

(the naming convention used by Security Manager), Security Manager cannot detect whether the

addresses in that pool overlap with the pool configured in your SSL VPN policy. (This can occur,

for example, when the pool was configured by a user on a different installation of Security Manager.)

This can lead to errors during deployment. Therefore, we recommend that you configure the same

IP address pool as a network/host object in Security Manager and define it as part of the SSL VPN

policy. This enables the proper validation to take place.

•The same IP address and port number cannot be shared by multiple SSL VPN gateways on the same

IOS device. As a result, deployment errors can occur if a duplicate gateway exists in the device

configuration but was not redefined using the Security Manager interface. If such an error occurs,

you must choose a different IP address and port number and redeploy.

•If you define AAA authentication or accounting as part of an SSL VPN policy, the aaa new-model

command is deployed to enable AAA services. Bear in mind that this command is not re moved if

you later delete the SSL VPN policy, as there might be other parts of the device configuration that

require the aaa new-model command for AAA services.

Note In addition, we recommend that you define at least one local user on the device with a

privilege level of 15. This ensures that you will not be locked out of the device if the aaa

new-model command is configured without an associated AAA server.