Anyconnect using IKEV2 allowing access to Vendor

Hi Everyone,
We have configured Anyconnect using IKEv2 for our internal users and it is working fine.
Recently i got Request from our management to allow our vendor to access our network but they dont need full access to our internal network.
This vendor is also using the anyconnect IKEv2 to access their own internal network.
What i have done is asked our Vendor IT guy to update their xml profile with below info
<ServerList>
  <HostEntry>
   <HostName>xyz.com</HostName>
   <HostAddress>xyz.com</HostAddress>
where xyz.com is our VPN ASA hostname.
Need to know do i need to config new anyconnect profile and group policy to make this work or can i only create new group policy for this vendor?
Regards
Mahesh

To configure the vpn filter you would do something like the following:
access-list VPN-FILTER permit ip 192.168.1.0 255.255.255.0 host 10.1.1.10
access-list VPN-FILTER deny ip 192.168.1.0 255.255.255.0 10.1.1.0 255.255.255.0
access-list VPN-FILTER permit ip any any
group-policy VPN internal
group-policy VPN attributes
vpn-filter value VPN-FILTER
Please remember to select a correct answer and rate helpful posts

Similar Messages

HT5945 Java has updated again today, i use a jave plug in to run my virtual software to access my work from home, today i have an error message saying security will not allow access to my website that i use to log in to work from, this is a JREdetection e

Java has updated again today,
i use a java plug in to run my virtual software to access my work from home,
today i have an error message saying that security will not allow access to my website
i use to log in to work from, this is a JREdetection error,
my system runs off java and citrix, i tried chrome,firefox and safari - same issue, if my system cannot detect java it wont run, it runs on plug ins.
How to i change my sec settings to allow access to this website, as i can only see that i can add apps not web addresses?

If you get an error that says can't backup, try moving the existing backup file to a safe location and thry again. again. You can find the location of the backup file here:
iPhone and iPod touch: About backups

Public parts not allowed to be used by the access control list

hi,
I have 2 DCs. DC1 and DC2. I want to use public parts of DC2 in DC1. When I try to do so in in the dependencies tab, I get the following error.
some public parts are not allowed to be used by the access control list.
how to resolve this error ?
Thanks !

Hi,
Sorry for the delayed response ....Both ends static routes are added for the connected test interfaces.....
Regards,
Mahesh

What app do you use on an iPad to allow access to programs that require flash, such as Math XL?

What app do you use on an iPad to allow access to programs that require flash, such as Math XL?

Adobe has not made a version of Flash for the iPad.
Kappy explains why. https://discussions.apple.com/message/19446567#19446567
5 Flash Player Alternatives http://www.techshout.com/features/2011/01/flash-player-for-ipad-apps/
Top 4 browsers supports flash player on iPad and iPhone
http://mashtips.com/flash-player-ios/
 Cheers, Tom

Can we run AnyConnect using self signed certificates?

I have a lab that I want to build a laptop-to-ASA remote access tunnel, using AnyConnect.
I understand AnyConnect requires IKEV2, and certificates.
It does not allow for pre-shared passwords, like VPN-client.
Is there a way I can build the lab without getting a certificate?

AnyConnect does not require certificates if you use SSL VPN (vs. IKEv2 IPsec VPN). On an SSL VPN you can use local authentication on the ASA or external authentication to AD, LDAP, RADIUS, etc. (in addition to or instead of certificates).
If you want to use IKEv2 and certificate authentication you can use either the ASA itself the CA server or proxy (via SCEP) to an internal CA (e.g. a Windows servers with Certificate Services). There are some other possible methods (such as the way you asked about) but in my experience they are not commonly used as few users have the knowledge or desire to go that route. Most organizations using client certificates deploy them from an internal root CA.

How to let SAP user use SSO to access Application in DMZ?

Hi All,
Our J2EE application is running on a system in DMZ which can not be connected with LDAP. So I am wondering if it's possible to let SAP user use SSO to access our application.
After talking with my colleague I think the only way is to import SSO public key to our WebAS and create user in UME and then assign user to the corresponding public key, but anybody know where to download SSP verification file or is it allowed to download and import into another system at all?
Regards,
Bin

Hi,
Take a look at this example, it uses property nodes to select tha
active plot and then changes the color of that plot.
If you want to make the number of plots dynamic you could use a for
loop and an array of color boxes.
I hope this helps.
Regards,
Juan Carlos
N.I.
Attachments:
Changing_plot_color.vi ‏38 KB

How to allow access only from certain IPs?

I have Portal Server 6.0 on Sun ONE Web Server and want to allow access to it only from certain IPs, i.e. if my IP differs from predefined, then access is denied (no page is opened).
How can I implement this with minimal efforts?
Thanks in advance!

Where did you set the ACLs?
When webclients connect direct to the portal/ids this is pretty straight forward using htttpacl files. When SRAP GW's are used for Internet portal access the web or app-server never sees the client IP thus those ACLs don't get applied.
Am I missing something (won't be the first time... or the last:-)
Cheers,
-psr

HT4061 iphone is disabled and won't allow access with itunes, i can't get it to open up so i can restore it. Help please

can someone please help me. my grandson accidently locked his iphone. i have try to reconnect it with itunes in order to restore it. But it won't do anything except have screen showing ipphone disable connect to itunes when i do itunes says please allow access to iphone. what do i need to do it when i try to open it shows emergencey calls only nothing else will open up. please help me reset his iphone please.

You have to put the phone into recovery mode before you can restore it. First, turn the phone off. Second, while holding down the home button, connect the phone to the computer, and keep holding down the home button until you see the iTunes logo on the face of the phone (this is recovery mode). Next you should see a message on iTunes on your computer say something like "in order to use this phone you have to restore it from recovery mode.." This will allow you to access your phone! Hope this helps.

Using VPN to access remote servers; copying files to desktop since "upgrading" to Mavericks no longer works. Can anyone help please?

Hi everyone,
I work remotely using Cisco AnyConnect (company provided) to access the company servers. Until "upgrading" to Mavericks I was able to copy files directly to my desktop – from either the servers themselves, from within Bridge, and/or by using the finder - you get the idea. Now I can only copy the files by opening them while still on the server using the native app (in my case mainly InDesign/Photoshop/Illustrator files) and saving them to my desktop that way.
I'm a designer, I use a lot of files for my specific job every day and these files are often pretty large and doing it this way is time-consuming and really frustrating seeing as I had no such issues with the previous OS. It's not a total nightmare (yet) like some of things some of you are dealing with but I've spent more time restarting, freezing and trying to fix issues than I have actually using my darned machine. I have no choice but to access my work this way; I'm part of a much larger team and we all work on these files off and on during the day so I'm constantly needing to copy files and make sure I'm working on the most current version. Working off the server isn't an option as the speed decreases considerably... making the slightest task cringingly slow. As in 25 minutes for a PDF to be created slow.
I've been used to my system running smoothly, without issues and fast so this upgrade is turning into a bit of a nightmare. Before I throw in the towel and try and downgrade, does anyone have any ideas? My technical knowledge where these things are concerned isn't beginner but I'm no expert and I'm stumped. I just don't know where to start and I'm afraid of screwing something else up during the process of trying to fix this (so far) one issue and creating a snowball effect.
I'm using a 27" iMac (late model 2012 purchased in March 2013) with a second Viewsonic monitor attached. I have a Cintiq 22HD hooked up (but not on all the time) and a Wacom tablet in use. I currently use both CS5 (work hasn't upgraded to CC yet) and Adobe CC (for personal use) on my system.
Any help/ideas would be greatly appreciated!
Thanks!
G.

Hi,
By default, the Remote Desktop (RD) Gateway component that encapsulates RDP in HTTPS packets listens on port 443 (for TCP) and port 3391 (for UDP). After you changed the ports in Transport Settings tab, please make sure that you have opened the custom ports
you selected in Windows Firewall.
In addition, since you have mentioned the registry key, would you please share the entire path?
It seems that you need to manually update the gateway in the RDP file with the port. Have you created an .rdp file? You can also refer to the link below:
Create an .rdp file
Best regards,
Susie

Our accountant is no longer allowed access to the QuickBooks file

My main server is Small Business Server 2008 Standard (i.e. pre-R2). I have another box running Server 2012 that's just acting as a Hyper-V host. On that server I have three relevant VMs, all Windows 7 Professional and joined to the domain. One
is acting as a host for our QuickBooks file and running some other QuickBooks-related tasks. The other two are for two people who have to access QuickBooks remotely via RDP (we don't have a Terminal Server license).
Our accountant has been accessing the QuickBooks file for several weeks from an in-office domain-joined Windows 7 Pro computer at the shared resource "\\Quickbooks-host\QuickBooks Data". Today she's told that she's not allowed to access Quickbooks-host.
In the SBS console she is set for local administrator access to that computer. On Quickbooks-host the "Quickbooks Data" folder is shared with her having explicit full control as <domain>\<user>, both in Properties | Sharing | Share...
and Properties | Sharing | Advanced Sharing ... | Permissions. On Quickbooks-host she is listed in Control Panel | User Accounts | Give other users access to this computer under her user name and my domain as an administrator. What more could Microsoft
possibly want?
(BTW, I despise Microsoft's networking permissions management. Why must I give permission in two places for the same resource, and still have it not work?)
So I tried to get her going for the day by letting her RDP into one of the other two VMs, since the person that regularly uses that is in the office today. She's a member of Remote Desktop Users and Mobile Users and a few others. But I can't
connect using her account, with or without a domain and using the real domain name or "quickbooks-host" as the domain name. SOmetims I just get "login failed", sometimes I get a pop-up "The connection was denied because the user
account is not authorized for remote login". I can't find any more places to add authorization.
Did I mention how much I despise Windows' control of networking permissions?
So is there any way to convince Windows 7 that our accountant is allowed access?

Hi,
Glad to see your problem resolved, hope your experience is helpful with others.
Roger Lu
TechNet Community Support

IOS 5 used to allow Airplay between iPad (WiFi) and Apple TV (Ethernet) as long as they were on the same network. In iOS 6, now both the iPad and the Apple TV have to be on the same network and both have to be connected using WiFi ? Why did they change ?

iOS 5 used to allow Airplay between iPad (WiFi) and Apple TV (Ethernet) as long as they were on the same network, i.e. connected to the same wired/wireless router. In iOS 6, now both the iPad and the Apple TV have to be on the same network and both have to be connected using WiFi ? Why did they change this ? Means that the iPad and the Apple TV box both have to be in range of the wireless router when this wasn't a restriction before. Apple TV could be anywhere as long as it was connected to the same wireless router via ethernet cable. Seems like an unnecessary thing to restrict.

I have found with AppleTV that it is the IPV6 on the computer you want to access is the problem. The issue is that Homegroup on Win 7 or Win 8 requires IPV6 to work, but AppleTV won't work with IPV6. (So maybe double check you have IPV6 turned off)
So you have to make a choice - Homegroup or AppleTV.... but you can't have both, until Apple brings ATV up to date. (crazy that it does not recognise IPV6 - c'mon Apple!)
You can set up sharing individually in Win 7 or 8 and have the ATV access files that way.
Having said that, there is always the exception.. I have an old HP home server running Win8 and it services ATV - but is part of the Homegroup... have no idea why it works on both, but no other machine on the home network will talk to both ATV and Homegroup at the same time!

HT5306 I do not want to give remote access to anyone but myself as privacy is my friend. Can this remote desktop software still be for me personally unless I allow access and for my MAC lap top only? What if I do not update? compatibility issues with wh

Hello:
Thank you for the update for remote access for desktops.
Personally, I do not want to give remote access to anyone but myself as privacy is my friend. Can this remote desktop software still be for me personally unless I allow access and for my MAC lap top only? What if I do not update? I do use this lap top in other countries. compatibility issues with what?

Apple Remote Desktop is off be default. It has to be enabled for some one to be able to remotely connect to the computer. And then, you still have to have a user name and password on the computer to remotely connect with.
If you want to see if remote access has is enabled for Apple Remote Desktop; you can find the setting in, Apple Menu, System Prefrences, Sharing. If it's enabled, Remote Management or Screen Sharing will be checked.
Beucase Apple Remote Desktop Agent is part of the Mac Operating System; even if your not using it, Apple Software Updates will from time to time offer updates for ARD Agent. Software Updates can some times be stacked ontop of each other; so chosing not to install an update, can mean other updates you may want may not be offered. At least until you install the updates those updates require. Also software updates can improve the security of your computer.

I'm not allowed access to my own files...

Hello all,
Just talked to an Adobe person on the Chat, but he couldn't help me, he told me to get someone on the phone... on the phone, they told me they couldn't help me because my product was too old... they told me to come here and ask for help... now I just hope you guys aren't going to tell me you can't help me, because of some other sort of reason!
Here's my problem:
For a few years now, I use a CS2 for work, both on my office-computer and on my home computer.
Ever since I installed it, on one of the computers the updates of Adobe Acrobat keep popping up, but only get halfway. They start installing, announcing themselves: “Adobe is now installing Acrobat 7.1…” and suddenly, it stops and says: “Windows finds it impossible
to write onto the file C:\Program files\Adobe\Adobe Acrobat\Activex\AcroIEhelper.dll. Check if you have access to this file”.
It gives me the choice between “resume, ignore, or abort”. If I choose resume or ignore, the installation goes on till the end and I am asked to reboot. As if everything has gone well.
But it hasn’t. For when I do, after the computer’s started up again, instead of having an updated Acrobat, the update starts all over again:
“now installing Acrobat 7.1…” until the reboot, the same way again, and so ad infitum.
After a few times, I actually went checking in my computer for this location, to see what was wrong with this file on which Windows seemed to have so much trouble “writing onto”. I searched for the file called AcroIEhelper.dll, but found it wasn’t there… No wonder they couldn’t write anything on it, I thought!
I copied the file from my disk in the CS-box, and placed it exactly on the location it was supposed to be; at least, that’s what I tried to do,
but soon as I did, a box appeared saying: “You are not allowed to execute this transaction” (or something of the sort – I’m translating from
Dutch here). No matter howmany times I try, it always stops me, blocking my access.
It never says why, however.
So, the update is never really finished, I know that now, it's for lack of this blasted file. But I'm never allowed to put it where it belongs.
Ever since, each day when switching on my computer, the first thing I have to do is to stop this Adobe Acrobat update, which
stubbornly -and uselessly- starts installing, before I can start working. Every single day, and I am sick of it!
The computer it happens on is the second one I installed the CS on, it's a Vista. I don't think that's the problem, though. Would it?
I was assured I could install my CS on 3 systems, this was the second. The one in my office is an XP Pro.
Anybody can give me the answer to the refusal of this file? Why am I not allowed access to the files in my own computer? And is there a
way to MAKE the thing give me access?
Tanks for any help...

Thanks, Markerline. I couldn't reply this weekend, since I had omitted to send my login-password on this forum to my home-computer. It's at home I'm having the problem: over here at work, nothing bothers asking me if I want to be updated. (I don't even know whether I'm getting updated at all; I'm not allowed to experiment much whith this one, since I'm in the National network...
I think I've tried it most of the times from an ampty desktop. Nothing to do with Adobe nor anything else working yet. After all, the update is the first thing that pops up after startup; I have to abort it before I can start doing anything.
I'll try it again, after reading the articles you write about. I might find the answer if I learn more of what this IEhelperthingy is all about. It's really small, a few 5 MB or so; but it seems to be important enough to cause trouble.
If I never manage to force-squeeze it into the Adobe file, my only hope is to get rid of these eternal useless attempts to update to Acrobat 7.1. I'd be happy to go on working with number 6 or whatever I have right now, as long as I'm not constantly pestered by a never-ending update.
My old computer never told me I wasn't allowed to do what I wanted to it, the way this one does. I find it annoying! It makes me feel like it takes me for a fool....

FF 5 running on windows 7 has suddenly stopped allowing access to comcast mail, but this is not a problem under Snow Leopard

I am running the latest version of firefox on a windows 7 laptop and Mac desktop. The windows version was allowing access to comcast email until it suddenly stopped. It won't let me open any email on the summary page or view the entire inbox. Opening firefox in safe mode does not eliminate the problem. I have no problem accessing comcast mail on the MAC or with Chrome, Safari or IE on the laptop.

Hi Steve1904,
So you have use the backup and Restore to restore your files from Windows XP to Windows 7 directly?
This should be considered not work.
If you would like to transfer files between Windows XP and Windows 7, you need another tool called Windows Easy Transfer.
See the article below if you would like to upgrade from Windows XP to Windows 7:
Upgrading from Windows XP to Windows 7
If possible, follow the steps there, then things should be OK.
Best regards
Michael Shao
TechNet Community Support

How do I allow access to non admin network users to disk volume?

I would like to allow access to a specific volume (disk) on one of our networked macs (Mac1) to all users. I've set user accounts on Mac 1 for all network users. These users are "regular" users, not admin. They can access this disk (and all others on Mac1) if I log in as Admin set Users to Admin. If I do this, then users have access to ALL data on all disks. If I do not, leaving them as "regular" users, when they log in they only see public folders. How can I allow access to the one disk volume without making network users admin? I tried changing various settings for the volume in Finder Info (everone else=read/write; ignore permissions) with no luck.
Thanks
iMac, ibooks, G5, Tibook Mac OS X (10.4.4)

Your observations are correct - by default, an "admin" user connecting over AFP can choose from available "volumes" (default) or "shares", whereas a non-admin user can only mount "shares".
By default, the only "shares" on an OS X client machine are the users' "Public" folders, and unlike pre-OS X Macs, it isn't easy to configure your own share points. Apple's official statement is that users wanting this functionality should buy OS X Server.
However, it is possible to create an arbitrary share point using 3rd party software called "SharePoints" (donationware). I have never used it, but it seems to be well regarded. Alternatively, you can do it manually following the instructions in this hint & comments (especially apw8's):
http://www.macosxhints.com/article.php?story=20011108161839416
Once the external drive (or folder on the external drive) is configured as a share point, it should be possible for non-admin users to select and mount it once they connect over AFP.

Anyconnect using IKEV2 allowing access to Vendor

Similar Messages

Maybe you are looking for