By far, Cisco's most popular VPN product and remote access
product is Cisco AnyConnect.
If you've used it before, you know that it's
just the best that there is.
It's amazing.
It's lightweight.
It's easy to deploy.
It's easy for the end users to use and get
connected into the VPN network.
But did you know that it does a lot more than just tunneling
traffic in over DTLS or TLS?
It does all sorts of stuff based on identity authentication
and posture assessment--
you'll get to see.
In this Nugget, we're actually going to fire up AnyConnect. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
In this Nugget, we're actually going to fire up AnyConnect.
I'm going to show you where you can get AnyConnect installed
on your computer and see all the different features about it.
And we'll talk about how AnyConnect
allows us to perform several different tasks,
like identity-based authentication, as well as
posture assessment.
Let's get going.
Look, AnyConnect is a really big deal.
I'm speaking from professional experience
here without any other motivation behind me
when I say that I have yet to find another VPN remote access
VPN solution that's as pleasant to work with than AnyConnect. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
VPN solution that's as pleasant to work with than AnyConnect.
And while the deployment may be a little trickier than normal,
it's so incredibly powerful, yet, so incredibly lightweight
for end users to work with that it's just
the preferred solution when it comes to VPNs.
But allowing people into our network from the outside--
that poses a lot more risk.
But that's why AnyConnect is so incredibly powerful.
Most people have only worked with it
to connect to a network.
But did you know how much extra stuff AnyConnect can really do? WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But did you know how much extra stuff AnyConnect can really do?
That's what this Nugget in the next Nugget are all about.
So let's first talk about how the authentication takes
place within AnyConnect.
And then the next Nugget, we'll actually
talk about posture assessment itself.
So you've deployed a shiny new Cisco firewall appliance.
Now, these appliances are really for AnyConnect,
they come in two flavors.
They're the Firepower Threat Defense device,
or they're the Cisco ASA.
Traditionally, you hear about AnyConnect WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Traditionally, you hear about AnyConnect
deployed via the ASA.
But know that the Firepower Threat device can also
handle the same thing.
And, of course, Firepower Threat devices in groups
can be managed by Firepower Management Center.
Just think about the full picture
when it comes to working with Cisco AnyConnect.
But when we're talking about AnyConnect,
we're talking about remote access VPNs
and allowing in-users out there in the world
on the internet who are shopping on Amazon and watching Netflix.
We're allowing these people into the firewall WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We're allowing these people into the firewall
and then on the inside of the network, not necessarily
accessing whatever they want.
That's where AnyConnect and AAA services
start to come into play.
Yeah, of course, the default configuration
is we can say Bob down here connects
in through the internet into Firepower or the ASA.
They get placed into a special pool
of IP addresses specifically reserved
for AnyConnect clients.
Of course, I have to spell AnyConnect correctly.
And now Bob has made his way into the AnyConnect WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And now Bob has made his way into the AnyConnect
pool of IP addresses.
From here, we can say if any of these IP addresses
can allow access to other sources.
Or we could control that access at the user level.
But the big thing is that when Bob goes to connect
and he reaches this point of the firewall,
the firewall says hold up, Bob.
We need to make sure you're really who you say you are.
So if I clear the screen for just a moment,
it looks like this.
We're going to bring AnyConnect up onto the screen.
And this is where I'm trying to get connected WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And this is where I'm trying to get connected
into that DevNet Sandbox instance we
saw just a couple Nuggets ago.
I'm going to click Connect here.
And it says we're trying to contact this specific endpoint.
And you can see it's prompting me for a username and password.
So I'm going to paste my password in right here
and click OK.
It establishes the VPN section, and there we go.
I'm going to bring AnyConnect back up here.
And you can see now I've got the green checkmark.
And it's showing me as I'm connected.
Now, if I shrink AnyConnect down a little bit
to fit on the screen, I actually got to move it WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to fit on the screen, I actually got to move it
because I can't shrink it.
There's a little gear here at the bottom that
tells you all the statistics and what's
going on behind the scenes.
You can see right here, this client IPv6 address,
192.168.102.
That's the IP address I was given when I got connected.
And this is what's allowing me to access the resources that
are here in the DevNet Sandbox on this 10.10.20 subnet.
You see, my subnet here that I've been assigned to
and my user account have been explicitly permitted in order WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and my user account have been explicitly permitted in order
to access these credentials.
Now, how did all of this authentication really
take place?
I can't say for sure because I'm not the architect of the DevNet
Sandbox.
But if I had to guess when me--
I'm going to put Knox here--
attempted to get connected to AnyConnect,
I ran into either a Firepower Threat device or an ASA
appliance.
And then from here, my credentials
were authenticated against an identity data store.
This could be something like ISE or NPS or ACS.
And it could have even proxy using RADIUS or TACACS WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And it could have even proxy using RADIUS or TACACS
against an Active Directory profile.
The point is, is I typed in my username.
And I provided my randomly generated password
that they emailed to me.
It got authenticated off of this data store.
And it told the firewall here, placed them in the 192.168.102
dot whatever subnet.
And that subnet in this specific case
was given access to my ISE environment WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
was given access to my ISE environment
that I'm trying to work with right now in the DevNet
Sandbox.
Now, you may be thinking to yourself, how can I download
AnyConnect and follow along?
How can I see how this really works?
And that's really the beauty of the DevNet sandboxes
that we now have all of these tools
that we can experiment with.
So if you go to devnetsandbox.cisco.com,
let me walk you through the process of how I actually
got here.
If I go to Sandbox Labs right here at the top,
this shows you every single type of sandbox and Cisco appliance WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
this shows you every single type of sandbox and Cisco appliance
that you can work with.
And what you're really looking for here
is anything that says reserve.
So in my case, since I wanted to work with Identity Services
Engine, I filtered my categories down to security.
And then I found the Identity Services Engine with mud.
That's this one, and I clicked the RESERVE button.
So if you click the RESERVE button,
you'll get this cool little pop-up here.
And it asks you how long do you want to reserve this for?
Now, eight hours is a really long time to reserve a sandbox. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Now, eight hours is a really long time to reserve a sandbox.
If you don't need eight hours on the sic, because remember,
if you reserve this, nobody else can use it.
So you're hogging it the whole time.
So if you don't need eight hours on a sandbox,
click the little pencil here and choose
something more like one hour-- something small.
When you click the RESERVE button,
it will spin up that instance for you in email, the username
and password to you.
Then you can go into the sandbox itself
while it's being created and activated.
And under the VPN Access Section right here, this tab, this WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And under the VPN Access Section right here, this tab, this
is where you can download the Cisco AnyConnect VPN Client
software.
That's what you want to do.
It's a very basic installation.
And the next thing you know, you've
got the Cisco AnyConnect Secure Mobility Client
installed in your computer.
And you can get tested connecting to the AnyConnect
instance once they email you your username, password,
and URL to get connected to.
Now, the really cool thing about Cisco AnyConnect
in this specific installation that they've provided us here
is that it does a whole heck of a lot more than just WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
is that it does a whole heck of a lot more than just
authenticate your username and password.
You're seeing all of these other things that are listed here--
Roaming Security, AMP Enabler, Systems Scan, Web Security.
That's what we're going to talk about in the next Nugget
when we start talking about posture assessment.
And I'm really excited to talk about it.
But this is one way that you should consider
how remote access VPNs work and how they can
and how we can authenticate in users, as they
try to get brought into the network using a tool,
like Cisco, ISE, or the older ACS or even Windows Server NPS WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
like Cisco, ISE, or the older ACS or even Windows Server NPS
products.
I hope this has been informative for you,
and I'd like to thank you for viewing.