One of the problems that we've had over the years
is how do we get the AnyConnect client,
or before that the VPN client, how
do we get a software client installed on the PC
if we're not using the native client on the operating system.
The answer is now is hit a URL and it downloads the client
and installs it.
And also, what we do is we can have updates
that happen that way too.
A client is using the AnyConnect software client,
they connect, it detected they're using an older version
and it downloads the new one and away they go.
Now, besides just having the software
it's also really handy to spoon-feed users on here's WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
it's also really handy to spoon-feed users on here's
exactly how to use it.
And a really great way to do that with AnyConnect
is to give them a profile that they just click
on that has all the details.
It has details about the server to connect to,
the encryption algorithms to use,
the backup servers to use if their primary wasn't there.
We can have a built as part of a profile
and deployed to the client.
So, in this video I'd like to demonstrate the AnyConnect
profile editor that we can use to create these profiles
that then our users can use. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that then our users can use.
So, here's the Cisco AnyConnect client right here
and this is the VPN profile editor.
You can download it separately from Cisco
to go ahead and create and modify the profiles.
So, I'm just going to launch the VPN profile editor
and here you simply specify the details that you want you.
Do you want to prompt the user before starting,
do you want the auto-connect on startup, what
do you want to have happen.
And so you can specify, for example, the server list,
you say I want to add some servers.
So, we can specify the display name like primary VPN servers, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So, we can specify the display name like primary VPN servers,
this is what the user would see, and then
to support that you'd put the fully qualified domain
name, which would be resolvable via DNS with the IP address.
In my lab we're going to use this.
And then if we're using IPsec, this is really important,
we would go up here to the primary protocol
and say, I don't want to use SSL, I want use IPsec.
Remove the checkbox next to ASA gateway
if you're not using that and then by default
it's going to use EAP AnyConnect as the authentication
method, which is what we have our headend server configured
for.
Then we click on OK, and then click on file, click on save, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Then we click on OK, and then click on file, click on save,
and let me show you where--
let me show you where on Windows this
is kept because that's important too.
So, your VPN client, your AnyConnect client,
it's going to go to this location, this PC, local C
drive, program data, Cisco, and then the Cisco AnyConnect
secure mobility client, and then the profile folder.
And that's where it's going to look--
[LAUGHTER]---- these profiles I made.
That was me just playing around with a whole bunch
of different profiles having fun with the profile editor.
So, we could save this, give it a name, I'll call this 10, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So, we could save this, give it a name, I'll call this 10,
click on save, and then if our clients use
that profile it's going to connect them
to this server with the protocol of IPsec
as opposed to using SSL.
That's all baked into the profile.
And one other element I want to talk about also
is under preferences it has an option for Windows VPN
establishment local users only.
Allow remote users is going to be helpful
if you are trying to launch this in a lab environment
from a remote desktop session.
In fact, what I ended up doing was WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
In fact, what I ended up doing was
I spent a lot of time with it like why isn't this working.
I finally ended up just using VNC
to my little virtual machine here,
and then running the AnyConnect client.
Just as a heads up, if you're running
AnyConnect from an existing RDP session, there's going to be--
there's going to be challenges and that box right there
is one of them that you'd want to turn on
if you want AnyConnect to have a chance of working from an RDP
session on the machine you're looking at.
And the good news is your clients
won't have to worry about that because your clients won't
be at those computers, they won't be RDP'd WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
be at those computers, they won't be RDP'd
in to their own computers.
And I want to share with you this little Nugget
I found from Cisco.com and that is right here.
This would have saved me about an hour
if I'd found it earlier.
It said you must disable the function manually,
the function of bypass downloader,
you must disable this function manually
by setting the bypass downloader value to false,
else the connection will fail.
That's if your device doesn't support SSL.
So, because we are using IPsec VPNs in a FlexVPN scenario, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So, because we are using IPsec VPNs in a FlexVPN scenario,
we need to turn that off.
So, let me show you exactly where that is.
So, I'm going to open up file explorer on this Windows 10
client and I'm going to the path of Cisco AnyConnect
secure mobility client.
So, the profiles folders is where the profiles are kept.
We just saved that one called 10, but what we want to do
is for the local policy we want to go right here.
So, AnyConnect local policy, it's an XML Document,
if we right-click and click on edit,
here's the bypass downloader option
and I set mine to true to get this to work. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and I set mine to true to get this to work.
Now, there is also a tool that we
could use to modify that if we didn't want
to use a text editor there.
Also, I had some rights issues too.
So, I had to go into the file system
and give myself permission so I could
modify that file because by default it
didn't give me the rights to actually tweak it or modify it.
I could open it up and edit it, but not save it.
So, the other tool we could use to modify that
is this bad boy right here, which
is the VPN local policy editor, also available from Cisco. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
is the VPN local policy editor, also available from Cisco.
And what this does, it gives you a nice easier way
of modifying that.
So, right here, bypass downloader,
you just check that if you want to bypass the downloader.
The files save and that'll be yet another way to do it.
So, with some profiles created and my AnyConnect client
sitting there waiting to go, our next step
is to validate that the AnyConnect client can connect
to R1 our headend server using that profile
or using a profile.
So, we'll do that in the next video.
Meanwhile, I hope this has been informative for you
and I'd like to thank you for viewing. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and I'd like to thank you for viewing.