Anyconnect, SCEP for Windows

Cisco Adaptive Security Appliance Software Version 9.0(2)
Device Manager Version 7.1(2)
I need to set up AnyConnect so that remote users using Windows PCs can easily download/provision the AnyConnect client, enroll using SCEP to get their certificate and then connect to the VPN using the certificate for authentication.
So far I have the first part set up and working; users are able to connect to https://company.com and install the AnyConnect client and then proceed through the enrollment process by using an AnyConnect Client Profile that uses SCEP to take care of the certifiacte work.
After the enrollment is complete, however, when clients attempt to connect they have to enter their username and password. It doesn't use the certificate as I thought it would. Do I need to create another tunnel group for clients to use that only uses certificate authentication? If so, do I need to specify that tunnel group in the AnyConnect Client Profile so that clients, after enrollment, are automatically directed to that tunnel group? If so, how do I do that.
I'm a bit overwhelmed with the amount of documentation so I apologize if I'm using the wrong words and terminology. And at this time I'm only concerned about Windows PCs, no iOS or Android.
ASA Code:
group-policy certgroup internal
group-policy certgroup attributes
wins-server none
dns-server value 10.x.y.z
vpn-tunnel-protocol ikev2 ssl-client ssl-clientless
split-tunnel-network-list value Jabber_Split_Tunnel
default-domain value company.local
scep-forwarding-url value http://10.x.y.a/certsrv/mscep/mscep.dll
webvpn
anyconnect profiles value ac_scep type user
tunnel-group certtunnel type remote-access
tunnel-group certtunnel general-attributes
address-pool Jabber_VPN_Pool
authentication-server-group RADIUS
default-group-policy certgroup
scep-enrollment enable
tunnel-group certtunnel webvpn-attributes
authentication aaa certificate
group-alias certtunnel enable
group-url https://remote.company.com/certgroup enable

I should also mention that we'll have multilple tunnel groups set up on this ASA. So we'll need a way to automatically select the proper tunnel group based on something, perhaps an item in the certificate. I think I remember reading about that being a possibility.

Similar Messages

SCEP for Windows 2008

Hello,
customer is using a cisco-router to terminate VPN-Connections. The connections are verified using a CA-Server running Windows 2003 via SCEP.
Now customer is upgrading his server environment to Windows 2008. In a white-paper from Microsoft I found that SCEP is supported only withe Enterprise or DATA-Center Edition of Windows 2008.
Is it true, that customer needs an enterprise edition just to be able to communicate with his cisco-router?
Is there another implemenation, other than SCEP?
Any help and comments are welcome!
regards
Hubert

Unfortunately, the NDES service (SCEP) is only supported on Enterprise or Datacenter versions of WS 2008 or 2008 R2. There is an Open Source package called OpenCA which supports SCEP. It could be installed as an intermediate CA to the Microsoft Root CA to handle the SCEP enrollment requests.
http://www.openca.org/projects/openca/
Jim

No Audio on either end Cisco Jabber for Windows over Cisco AnyConnect

Our telephony staff is replacing our aging/unsupported VoIP system with a Cisco system and as the network tech, I'm trying to get Jabber for Windows to work over our AnyConnect VPN client. Jabber to Cisco phone and Jabber to Jabber calls work fine within our LAN.
However, when I take a laptop to a separate internet connection and connect to the network via the VPN, I can't get any audio to pass across the system, in either direction. If I call a phone on our LAN using the Jabber client (via AnyConnect), the phone rings and when I answer it, it's just dead air on both ends. If I reverse the process, calling from the phone to the Jabber client, the same thing, Jabber client rings, but dead air both ways once I answer.
Things I can do from the laptop over the VPN connection:
I'm able to get to the phone's web interface using that same laptop.
I can ping the phone as well. In fact, the VPN profile I'm using has full access to the entire VoIP Vlan including all IP traffic (all ~65,000 ports).
Searching the address book also works fine. I can search for staff and it's pulling directly from our Active Directory environment.
Is there any special settings on the firewall that I need to setup to allow the voice traffic (which I assume is RTP traffic)? I tried to add a service policy for RTP traffic, but that didn't seem to work...unless I built it wrong.
Jabber for Windows - 10.6.0
Cisco Anyconnect - 3.1.06079
Cisco 5515-x ASA - 9.2

I was able to resolve this on my own. I thought that SIP traffic needed to be inspected via the global inspection policy in order for it to pass through the firewall. I ran into the same issue with ICMP traffic from an Anyconnect client to LAN devices. I had to enable ICMP in that policy for us to be able to ping LAN devices over the VPN tunnel. So when I saw that SIP was already being inspected by this policy, I moved on looking for other solutions. Then I stumbled deep within a Google search (almost hit the end of the Internet doing so) where someone mentioned that SIP shouldn’t be inspected by that policy. So I unchecked it and bam! Voice is now working over the anyconnect client to phones on the LAN.

Cisco anyconnect 3.1 download for windows 8.1

I am trying to download and install anyconnect 3.1 for windows 8.1 but all I see is a pkg file for windows. windows does not recognize this pkg file
how do I install anyconnect on 8.1?

You need to download the .iso-file:

Is Cisco VPN posible for Windows Phone 8.1

Hello,
Microsoft released Windows Phone 8.1 on April and it supports VPN connections.
So I would like to ask:
Is Cisco going to release Anyconnect Secure Mobility Client for Windows Phone 8.1?
Maybe someone managed to make clientless connection with ASA 9.1( for example IKEv2 or SSL-VPN) ?
Or should I abandon idea of connecting WP 8.1 with ASA?
Thanks.

Hi aurimas88 ,
Looks like AnyConnect Secure Mobility Client 2.5 is supported for windows phone , however W 8.1 mobile has not been tested by Cisco , We cannot guarantee compatibility.
AnyConnect Secure Mobility Client 3.0 Windows Mobile Devices Not Supported
AnyConnect version 3.0 and later do not support Microsoft Windows Mobile or Windows Phone. However, you can continue to use the ASA to deploy the AnyConnect 2.5 or earlier client for Windows Mobile even after loading the AnyConnect 3.0 package files to the ASA for web deployment.
AnyConnect Secure Mobility Client 2.5 Windows Mobile Devices Supported
We designed AnyConnect 2.5 for compatibility with Windows Mobile 6.5, 6.1, 6.0 and 5.0 Professional and Classic for touch-screens only. Users have reported success with most touch-screens running these versions of Windows Mobile. However, to ensure interoperability, we guarantee compatibility only with the devices we test, as follows:
HTC Imagio running Windows Mobile 6.5
HTC Tilt 2 running Windows Mobile 6.5
HTC Touch running Windows Mobile 6.0
HTC TyTN running Windows Mobile 5.0
Samsung Epix running Windows Mobile 6.1
Samsung Omnia Pro 4 running Windows Mobile 6.5
Samsung Omnia running Windows Mobile 6.1
Samsung Saga running Windows Mobile 6.1
Source:
http://www.cisco.com/c/en/us/td/docs/security/asa/compatibility/asa-vpn-compatibility.html#pgfId-181897
Hope this helps

CSA for windows vista?

Has the CSA for windows vista been released yet? I heard 3rd Q..

If your remote users have Cisco Security Agent (CSA) installed, you must import new CSA policies to the remote users to enable the AnyConnect VPN Client and Cisco Secure Desktop to interoperate with the security appliance.
To do this, follow the steps given in
http://www.cisco.com/en/US/docs/security/vpn_client/anyconnect/anyconnect20/administrative/guide/admin1.html

CSSC for Windows 7

I want to imlement EAP-FAST with WLC and Cisco ACS. But Cisco Secure Services Client (CSSC) is not available for Windows 7 yet. Most of the client machines have Windows 7 in our case. What options are available to implement EAP-FAST with windows 7 on client machines? We want to avoid PEAP due to certificates management issues.

Hi,
Yes, indeed CSSC is not available yet for Win 7, however CSSC will be merged into a new supplicant (AnyConnect) and will be supportd in Win 7.
This is on the pipelin and should be out there in couple months.
Regarding other options, you can manually install the EAP-FAST component on Win 7 machines.
Here is an example:
http://social.answers.microsoft.com/Forums/en-US/w7hardware/thread/383f4832-b453-4a9e-b3fd-ec777445014b.
HTH,
Tiago
If this helps you and/or answers your question please mark the question as "answered" and/or rate it, so other users can easily find it.

User profile creation problem for windows 7 clients with eap-fast

Hi All,
In our clients locations we implemented eap-fast authentication with domain integration in ACS for wlan users.Every thing working fine.We are facing problem with windows 7 laptops, in which client utility is not available to configure the user profiles.
In xp laptops client utility softwares are available with all makes, but with win 7 utilitys are not coming by default......
So what are options and available sourses for creating user profile with EAP-FAST in windows 7 laptops.
Any free univarsal client utility is available for windows 7 laptop.
Please guide me..............
-Subhash

Windows 7 should be able to do EAP-fast by default. If not you could download the latest Anyconnect client that also has the Cisco wireless supplicant in it.
HTH,
Steve
Sent from Cisco Technical Support iPad App

Failure to install Creative Cloud Master for Windows

Hi all,
I am using an Enterprise Creative Cloud and have packaged the Adobe CC Master for Windows.
I have followed the rules of installation by installing Acrobat XI first.
Upon installation of Acrobat, I proceeded to install Creative Cloud by going to the Build folder and install the Setup.exe by running as an Administrator. I have also disabled my anti-virus scanner as well. It starts to scan my harddisk and there is a progress bar that displays. Mid-way down the installation process, it just stops installing and it immediately uninstalls by displaying the progress-bar back to the start.
Why is this so? I understandthat by having an Entreprise account does not need you to go by the normal way of going to the Creative Cloud Manager to download and have a password to type in right?
Can anyone help me?
Thanks!

Hi Romit Sinha,
Thanks for your prompt response.
For some strange reasons, after I restarted my computer, disabled my anti-virus again and run the setup.exe using the administrator rights, it manages to install the CC apps within the build folder.
However, may I know how do I install both Edge Reflow and Edge Code? As I am using an enterprise edition, I don't see these 2 products within the Build or Exclusions folder. Must I log in to the Creative Cloud (using my Adobe ID and password) to download them?
If I log-in using my adobe account, will Adobe start charging me which will be ludicrous as I already have an enterprise edition.
What gives?
Thanks and Regards

HP officejet 6500 drivers for windows phone

IHello,
I have officejet 6500 with ethernet card. I use with wireless. I have Nokia 1020, Win8.1 mobil phone. I want print text on my phone. I installed HP Aio Remote Beta program. Aio found my printer but it said that this printer isn't supported. How can I print my text using my mobil phone on the officejet 6500? Is there any driver for mobil phone or any different program? or is that an upgrade for Aio (it must include my printer's driver ofcourse)
Thanks...

Hi,
I afraid the printer is not compatible with Windows Phone.
Only the models listed within the "What printers support printing features for the HP AiO Remote app for Windows 8 Phones?" below can be used for printing from Windows 8 Phone devices:
http://h10025.www1.hp.com/ewfrf/wc/document?cc=us&lc=en&docname=c04387822#N573
Regards,
Shlomi
Say thanks by clicking the Kudos thumb up in the post.
If my post resolve your problem please mark it as an Accepted Solution

Jabber for Windows- VM issue

I had configured Jabber for windows in windows 7, the problem is after logging into jabber client iam not able to get the "phone accounts" under options.
Iam able to call , and recieve calls but no voice mail. In the Jabber cleint diagnostic it shows username and password is wrong for voice mail.
If i have 'phone acounts' option in jabber client i could set username and password for voice mail. Iam able to telnet the unity server.
Any clue?
We have IM&Presence 9.0, CUCM 9.0
Jabber - 9.2
Tnx
Bobby

HI,
As Aron states - you can configure your client to use same login and password ID as other UC services. This will then mask the fields you see in your jabber client. This is great when you don't want your users to have to populate the fields. The less they have to do the better.
Check your Unity Connection system - is it AXL ot AD or neither ?
If you can, your better to use only one username / password across your UC environment. For now just check your setting for the VM service is not set .

Open and read from text file into a text box for Windows Store

I wish to open and read from a text file into a text box in C# for the Windows Store using VS Express 2012 for Windows 8.
Can anyone point me to sample code and tutorials specifically for Windows Store using C#.
Is it possible to add a Text file in Windows Store. This option only seems to be available in Visual C#.
Thanks
Wendel

This is a simple sample for Read/Load Text file from IsolateStorage and Read file from InstalledLocation (this folder only can be read)
using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
using Windows.Storage;
using System.IO;
namespace TextFileDemo
public class TextFileHelper
async public static Task<bool> SaveTextFileToIsolateStorageAsync(string filename, string data)
byte[] fileBytes = System.Text.Encoding.UTF8.GetBytes(data);
StorageFolder local = Windows.Storage.ApplicationData.Current.LocalFolder;
var file = await local.CreateFileAsync(filename, CreationCollisionOption.ReplaceExisting);
try
using (var s = await file.OpenStreamForWriteAsync())
s.Write(fileBytes, 0, fileBytes.Length);
return true;
catch
return false;
async public static Task<string> LoadTextFileFormIsolateStorageAsync(string filename)
StorageFolder local = Windows.Storage.ApplicationData.Current.LocalFolder;
string returnvalue = string.Empty;
try
var file = await local.OpenStreamForReadAsync(filename);
using (StreamReader streamReader = new StreamReader(file))
returnvalue = streamReader.ReadToEnd();
catch (Exception ex)
// do somthing when exception
return returnvalue;
async public static Task<string> LoadTextFileFormInstalledLocationAsync(string filename)
StorageFolder local = Windows.ApplicationModel.Package.Current.InstalledLocation;
string returnvalue = string.Empty;
try
var file = await local.OpenStreamForReadAsync(filename);
using (StreamReader streamReader = new StreamReader(file))
returnvalue = streamReader.ReadToEnd();
catch (Exception ex)
// do somthing when exception
return returnvalue;
show how to use it as below
async private void Button_Click(object sender, RoutedEventArgs e)
string txt =await TextFileHelper.LoadTextFileFormInstalledLocationAsync("TextFile1.txt");
Debug.WriteLine(txt);
在現實生活中，你和誰在一起的確很重要，甚至能改變你的成長軌跡，決定你的人生成敗。和什麼樣的人在一起，就會有什麼樣的人生。和勤奮的人在一起，你不會懶惰；和積極的人在一起，你不會消沈；與智者同行，你會不同凡響；與高人為伍，你能登上巔峰。

ITunes for Windows freezes when importing a library. I have a large but not huge library of mostly iTunes purchased music on two authorized computers and would like to sync the files, export the library as a playlist, and import it on the other computer.

I am running iTunes for Windows 10.2.2 on Windows 7 Home. I have my iTunes library on both this computer and another authorized machine running Windows 7 Professional. I have a large but not enormous library, as I'm one of those people who doesn't pirate, use torrents, borrow from a dozen friends, or whatever other shades of gray you might imagine. It's mostly iTunes purchases with my old CD collection imported. I have started using the following technique to sync my libraries between my two authorized computers, an ability which you can probably all agree should one day be added to iTunes -- that would be different from Home Sharing, because the music would be stored locally and thus available on the road. With the added benefit of the entire library being backed up on the other machine in real-time. Anyway, when I switch from my desktop to laptop and vice versa, I use the following technique:
Connect both machines to the home network. One machine is the "Active" machine, which has most recently been used for iTunes media, purchases, ratings, etc.
On the "Active" machine, File-->Library-->Export. Save the file as "Library.xml" on the shared drive of the other machine.
Right-click "Library.xml" where it's been saved, and open another file that has two lines in it: The root path of the iTunes library on one machine and the root path of the iTunes library on the other machine.
Do a find/replace all in Notepad to make the library XML file point to where the files will be saved on the "Inactive" machine.
Run Microsoft SyncToy to synchronize the files between both music libraries; the most recent files win. This avoids copying the entire multi-gigabyte library over the network.
Open iTunes on the "Inactive" machine.
Go to Music, Select All, Delete. Keep files.
Do the same for Movies, Music Videos.
Go down to Playlists, select the top one, hold down the delete button until they're all gone.
File-->Library-->Import Playlist. Choose the "Library.xml" file you saved.
First a status bar comes up that says, "Importing library." It has the continually-scrolling progress bar, not the one that starts on the left and steadily creeps right. Then after about 30 seconds, that clears out. Wait. Typically a few minutes. Eventually a status bar will pop up saying something like, "Evaluating gapless playback information," or something like that.
The "Inactive" computer is now the "Active" computer. I can now play my library, it has all my playlists and metadata from the other machine.
Delete all the duplicate playlists named "Music," "Genius," "Purchased," and "iTunes DJ."
Well, I just upgraded to iTunes 10.2.2 a few days ago and tried to do this again like I've done it dozens of times before. Now, iTunes just goes unresponsive after the library import. It got through the "Importing library" bar to the long wait and stopped. I can still multiprocess and use other programs, but iTunes is hovering back there not responding to clicks. Task Manager doesn't seem to think iTunes is using my CPU, and I don't see my hard drive rattling. Any thoughts on why iTunes might hang up when importing a large library?
... Also, please help lobby Apple to come up with a network sync tool built into iTunes for a user with multiple authorized computers. Something different than Home Sharing so I can pull my laptop off the network and still have the synced library with me. And all my metadata changes will sync. The technique I use seems a little kludgey, don't you think?

iTunes isn't an editor. You need an app that's intended for editing audio files, like Adobe Audition (http://www.adobe.com/products/audition.html) or Audacity (free in the App Store).

I can not upgrade to quicktime 7.7.3 for windows vista. Error message says there is a problem with the program installer. Any clue as to how to get around this.

I can not download quicktime 7.7.3 for windows vista. The error message says that there is a problem with the windows installer. Any clues?

The error message says that there is a problem with the windows installer.
What's the precise text of the message, please? (There's a few different ones I can think of that you might be getting.)

TS1369 iPod Touch is not recognized in 'My Computer' but works fine in iTunes for Windows

Just upgraded to iso 6, I can connect to itunes fine, but my ipod never comes up in My Computer.
I have the latest verson of itunes.
Thanks!

Try:
Removing and Reinstalling iTunes, QuickTime, and other software components for Windows XP

Anyconnect, SCEP for Windows

Similar Messages

Maybe you are looking for