Give the connection profile a name and optionally a group alias.Ĭlick the 'Select' button next to the 'Client Address Pools' option.

The ' Allow user to select connection profile' check option will allow the An圜onnect user to select the group they will be connecting to.ģ-) Create a new An圜onnect connection profile:Ĭlick the Add button, the 'An圜onnect connection profile' window will open. Then select the interface where the An圜onnect clients will be connecting to (in this example the outside interface). Same time the ASA should have the CA Root certificate in order to properly validate the certificate of the connecting client.ġ-) Make sure you have an An圜onnect image applied in the ASA firewall:Ĭonfiguration > Remote Access VPN > Network (Client) Access > An圜onnect Client SoftwareĬlick the Add button, and browse the flash for the proper image (optionally you can upload the client from the local PC).Ģ-) Enable anyconnect in the outside interface:Ĭonfiguration > Remote Access VPN > Network (Client) Access > An圜onnect Connection ProfilesĬheck the box 'Enable Cisco An圜onnect VPN Client or legacy SSL Client' In order to acomplish the An圜onnect authentication using certificates the An圜onnect client should get a valid certificate from the CA server, at the 'ssl certificate-authentication interface port '). (Feature in the ASA 8.2.x release, using pre-8.2.x ASA code it will require to globally enabling the certificate authentication with the command Since the ASA version in use is 8.2.x we can enable per tunnel-group certificate authentication. Microsoft Windows 2003 server as the CA server for the scenario. The information in this document is based on these software and hardware versions:ĪSA 5510 that runs software version 8.2(2) and ASDM version 6.4(9)Īnyconnect client software version 3.0 (It will work the same for versions prior to 8.3)

Meraki anyconnect