Ella Walter
Cisco AnyConnect is a Virtual Private Network (VPN) client that enables highly secure remote access across a range of devices. It can be used to connect to a Palo Alto Networks (PAN) firewall, which is a security policy to deny specific traffic while allowing Cisco AnyConnect VPN traffic to traverse the firewall. This can be achieved by configuring a Palo Alto GP gateway to permit connections using the Cisco AnyConnect client. However, it is important to note that the AnyConnect software may cause issues by putting the default gateway to the next virtual IP, and it may require specific versions of the AnyConnect VPN client to successfully establish connections.
| Characteristics | Values |
|---|---|
| AnyConnect client | Cisco AnyConnect Secure Mobility Client |
| AnyConnect server | Cisco ASA |
| AnyConnect VPN | Enabled from the AnyConnect Client VPN radio button on the Security & SD-WAN > Configure > Client VPN > AnyConnect Settings tab |
| AnyConnect VPN server | Uses Transport Layer Security (TLS) & Datagram Transport Layer Security (DTLS) for tunneling |
| AnyConnect VPN client version | 4.8 or higher on Windows, macOS, Linux, or mobile devices |
| AnyConnect on MX | Supports Layer 2 Tunneling Protocol (L2TP)/Internet Protocol Security (IPsec) Client VPN and AnyConnect VPN simultaneously |
| AnyConnect VPN traffic | Can be routed through Site-to-Site VPN (both AutoVPN and Non-Meraki VPN) |
| AnyConnect with Meraki MX Appliance | Enables users secure and seamless connectivity between different locations |
| AnyConnect tunnel | Created by the AnyConnect software to the FW |
| AnyConnect default gateway | The next virtual IP from the web pool |
| AnyConnect on ASA | Requires setup of inside and outside zones and interfaces on the PAN and ASA |
| AnyConnect traffic | Hits the public PAN IP address (outside untrusted zone) |
| AnyConnect authentication | Client is authenticated and assigned an IP from the ASA pool |
| AnyConnect and GlobalProtect | GlobalProtect is the Palo Alto VPN client; AnyConnect is the Cisco VPN client |
| AnyConnect and PAN VPN | AnyConnect is not supported by PAN VPN |
| AnyConnect and built-in client firewall | Access-list filter is pushed to the client PC; lockdown of the connecting clients' firewall for incoming traffic |
| AnyConnect and QUIC traffic | Cisco AnyConnect users experience an immediate disconnect and reduced speed for new connections when QUIC traffic is denied |
Explore related products
What You'll Learn
Cisco AnyConnect and GlobalProtect
Cisco AnyConnect can be used with a PAN firewall. One way to do this is to set up an ASA 5585-X as an AnyConnect server so that users can access an internal network. The ASA can be placed behind a PAN firewall, with a public IP address.
It is possible to use the Cisco AnyConnect client to connect to the GlobalProtect VPN. One user described their process for doing so: they pointed the GlobalProtect client to the VPN URL, which then prompted them to sign in with Okta. After authenticating, they were then able to accept or deny a push notification sent to their mobile.
Some users have reported issues with using the GlobalProtect client, finding it unreliable and unstable, causing it to kick users off at random. However, upgrading to a 4.x version of the software has been reported to resolve these issues. It is not possible to mix VPN clients with different vendor products.
Poaching Pans: Perfect Eggs, Every Time
You may want to see also
Explore related products
AnyConnect client firewall
Cisco AnyConnect is a VPN client with a firewall setting. This firewall can be configured in Cisco ASDM. It is configured in the webvpn-section of a group-policy.
Cisco AnyConnect can be used with a PAN firewall. One user on Reddit described their setup, which involves using a 1-1 NAT on the Palo to the untrusted interface of the ASA, assuming multiple static IPs. Another user described a similar setup, but with two interfaces on the ASA, one outside/above the Palo with a public IP, and another interface hooked into the Palo firewalls via an L2 switch to accommodate Palo failovers.
Cisco AnyConnect is not supported by Palo Alto's GlobalProtect VPN client. However, it is possible to configure the Palo Alto GP gateway to permit connections using the Cisco AnyConnect client. This can be done by following the documentation on the PANW website on how to get to the gateway config.
Conditioning Metal Baking Pans: The Ultimate Guide
You may want to see also
Explore related products
AnyConnect on the MX appliance
Cisco AnyConnect is a VPN client/802.1x supplicant used with ASAs for VPN and ISE (Cisco Identity Services Engine). It is possible to use AnyConnect with a Palo Alto gateway.
AnyConnect is supported on the MX appliance. Users have reported that AnyConnect and DUO MFA are easy to set up on all MX devices. To do this, you must enable AnyConnect in the Client VPN settings. You will need to get the licensing for AnyConnect, put in a support case to enable SAML auth, and then follow the documentation.
However, one user reported that their networking partner told them that Cisco AnyConnect cannot be used with MX68CW and MX105 appliances. Instead, they were told that they must use native VPN clients built into Windows and other supported operating systems. Other users have contradicted this, stating that they use AnyConnect with MX105 appliances without any issues.
Another user has reported that they are using AnyConnect with an ASA 5585-X server behind a PAN firewall. They have two interfaces on the ASA, one outside/above the PAN with a public IP, and another interface hooked into the PAN firewalls via an L2 switch to accommodate PAN failovers.
How to Clean Your Pan After Burning BBQ Sauce
You may want to see also
Explore related products
AnyConnect VPN server on the MX
The AnyConnect VPN server on the MX uses Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS) for tunneling and requires AnyConnect VPN client version 4.8 or higher on either Windows, macOS, Linux, or mobile devices to terminate remote access connections successfully. The AnyConnect client negotiates a tunnel with the AnyConnect server and gives you the ability to access resources or networks on or connected to the AnyConnect server (MX).
Unlike the AnyConnect implementation on the Adaptive Security Appliance (ASA), the MX security appliance supports Secure Socket Layer (SSL), VPN, and other AnyConnect modules that do not require additional configuration on the MX. The MX supports Layer 2 Tunneling Protocol (L2TP)/Internet Protocol Security (IPsec) Client VPN and AnyConnect VPN simultaneously.
To enable AnyConnect, ensure that your network firmware version meets the minimum requirement. For MX64(W) and MX65(W), the firmware version must be 17.6+, and for all other supported models, the latest MX-16 firmware. Upgrades can be managed by navigating to Organization > Monitor > Firmware upgrades. To enable AnyConnect VPN, select Enabled from the AnyConnect Client VPN radio button on the Security & SD-WAN > Configure > Client VPN > AnyConnect Settings tab.
The AnyConnect server on the MX uses TLS 1.2 for tunnel negotiation, and TLS 1.3 on MX 19.1+, hence it needs a server identity certificate. The MX supports three certificate options: With this option, the MX Appliance will enroll in a public trusted certificate using the DDNS hostname of the Meraki network. This publicly trusted certificate renews automatically. The DDNS hostname is not easy to remember, hence, it is highly recommended to use an AnyConnect profile to create a DDNS alias to simplify user interaction.
Changing the Server Certificate Generation Method back to the default option of Auto-Generated from Custom will cause the MX to delete the current uploaded custom certificate. A factory reset or device replacement (RMA) will generate a new private key for that MX. As such, a new CSR will need to be generated, signed and the resulting certificates will need to be re-added under Security & SD-WAN > Configure > Client VPN > AnyConnect.
When configuration is complete, save the xml profile. It is recommended to use a unique file name to avoid profile overrides by other AnyConnect servers, then you can upload the file to the profile update section on the AnyConnect settings page.
Python Presence in Florida: Panhandle Python Problems?
You may want to see also
AnyConnect on ASA vs. MX
AnyConnect is a fully-fledged end-point mobility client solution. It can be used with the Adaptive Security Appliance (ASA) or FirePOWER, supporting multiple features like Host Scan and Web Launch. However, when using AnyConnect on the MX security appliance, certain features are not supported, such as Web Launch and client software deployment or update. The MX appliance supports SSL Core VPN and other AnyConnect modules that do not require additional configuration.
When using AnyConnect with the MX, a license is required, and license costs vary based on type, duration, and user count. The MX supports Layer 2 Tunneling Protocol (L2TP)/Internet Protocol Security (IPsec) Client VPN and AnyConnect VPN simultaneously. Stateless high availability and WAN failover are also supported, meaning that when HA or WAN failover occurs, active user sessions will be disconnected, and users will need to reconnect to the new active WAN link or the new primary MX.
When comparing the two, one user on Reddit said that they have supported both ASA's and Palo firewalls and that "ASA's just plain suck". They go on to say that they are keeping their ASA's just for AnyConnect until they roll out global protect. Another user said that they have heard stories of people keeping ASA's for AnyConnect alone and that of all the issues with the ASA platform, AnyConnect is not one.
To set up an ASA 5585-X to act as an AnyConnect server, you can do a 1-1 NAT on the Palo to the untrusted interface of the ASA. You can also set up inside and outside zones and interfaces on the PAN and ASA.
Pan Proportions: Halving a 9 x 13
You may want to see also
Frequently asked questions
AnyConnect is a Cisco VPN client/802.1x supplicant. It enables a highly secure connectivity experience across a broad set of PC and mobile devices.
PAN stands for Palo Alto Networks. PAN firewalls are used to deny QUIC traffic while allowing Cisco AnyConnect VPN traffic to traverse the firewall.
It is possible to configure a Palo Alto GP gateway to permit connections using the Cisco AnyConnect client. To do this, you need a Global Protect gateway license installed on FW, and you can find documentation on the PANW website on how to get to the gateway config.
One issue is that the AnyConnect software pulls 2 IPs, which can cause traffic to not pass correctly. Another issue is that the AnyConnect client reconnects every minute, disrupting traffic flow.
