Linux cisco anyconnect config file

/.bash_aliases file:(where you don’t actually type the «^D»: it means you hit Ctrl-D to finish).

If you want to edit your aliases file instead directly, you can run a simple editor, ‘nano’, which is usually available on Debian and Ubuntu systems:

Connecting and Disconnecting

Connecting (Graphical window)

And it should show ‘vpn.uci.edu’ already. Just click Connect.

If you get an error message about an untrusted server or certificate..

..you can fix that following the instructions from Robert in the section NOTE 1 — Connect-error, below.

(By the way, depending on how the installation went, and whatever of the Linux desktop environments you are using (Gnome, Unity, KDE, Mate, Cinnamon, XFCE, etc.) you may also find that the vpnui graphical client now also appears somewhere in your Applications menu. But don’t count on it! This is Linux, after all.. 🙂 )

Connecting (via command-line)

1. To start the client from a command-line prompt in a terminal window, using the alias you made above:
2. At the VPN> prompt, type connect vpn.uci.edu and press Enter. (If you get an error message about an untrusted server or certificate, you can fix that following the instructions from Robert in the section NOTE 1 — Connect-error, below.) Otherwise, you should now see:If you do not see this, but get a connect error instead, please see NOTE 1 — Connect Error below.
3. Ignore the message about entering your UCInetID and password, for now.
4. Choose one of the choices by number and press return — usually UCI or UCIFull. (See the differences in the Tunnels below.) For instance, for UCI, press 3 and hit Enter.
5. Enter your UCInetID and password in the Username and Password boxes and press return.
6. At the accept? [y/n]: prompt, type y and press Enter. You may get several notices the first time about the downloader performing update checks. At the end you should see a >> state: Connected message and a new VPN> prompt. You are now connected.
7. Either leave the VPN> prompt open or if you want your terminal back just type quit at the VPN> prompt (the connection will remain active).

Connecting automatically via Command-line (w/o typing in your Username/Password)

I never (not yet?) figured out how to get the Cisco anyconnect software to run via script with command-line parameters sufficient for its running without having to type in your username (UCINetID) and password. I looked into the vpn command / executable supplied by Cisco (in the anyconnect-predeploy package) and running -h on it does not give much help.

Therefore, if you need something command-line and automated, I suggest you use the alternative method using open-source openvpn/openconnect software which I mentioned at the very top of this document. I include a way to do that in an automated way, and I find it works just as well and just as fast, but without having to install proprietary Cisco software. (This is the age of Ed Snowden’s warning to us all, after all.. :-/

NOTE 1 — Connect-error

In most cases I have seen, a connection is made. I have, however, seen the below error before only once. It was when the person was installing on a netbook (running Gnome) which was on campus and usingthe campus wifi system (though I don’t know if those factors were the cause). It didn’t matter if they answered y or n, they continued to get the error and be denied connection.

Update 2015-12-6: «Robert» wrote me with a solution to this:

• ..the connect error. can be resolved by sym-linking the cisco ca directory to the system ca directory as cisco only seems to include one root certificate by default. Or you can install the certificate chain from the VPN provider — sym-linking the system certs worked fine for me. Credit goes to: https://plus.google.com/+AndreasKotowicz/posts/2afhvvNZpE6

Thank you, Robert!

To disconnect (gui)

1. Just click disconnect in the window

To disconnect (command-line)

1. At the VPN> prompt, type disconnect and hit Enter.

To exit (command-line)

1. At the VPN> prompt, type quit and hit return.

De-installation / Removal

1. Run Cisco’s provided un-install script
2. Optionally, also remove the cisco directory (if you don’t need the .log files that were left behind):

Additional Hints, Tips, and Handling of Errors and Problems Contributed by Users

Several people have written in to me with some additional tips and solutions which I’ll add here:

• From pierrechauffour:
• From zviad aburjania: This turned out to be a missing library fixable by:
• From zviad aburjania (2): (If that link no longer works, it is just recommended to start /opt/cisco/anyconnect/bin/vpnagentd first.)

From pascal müller:

Pascal researched and found that the error, anyconnect was not able to establish a connection to the specified secure gateway is a known problem with Cisco clients before version 4, when these earlier clients are installed on Ubuntu 16.04+. The solution is either to downgrade your Ubuntu, or upgrade your Cisco client. At my university we have upgraded to offering version 4 (anyconnect-predeploy-linux-64-4.3.05017-k9.tar.gz), and this supposedly works with the newer Ubuntus. I did not myself test the new version 4 Anyconnect client with Ubuntus 15.x and 16.x. But I have tested it today (April 27 2017) with my Ubuntu 17.04 system, and it works great.

Contact / Feedback

Please email me to let me know how this process went for you, and/or with any suggestions for improvement on this page itself. Thanks.

Acknowledgements

1. Mike Iglesias and Sylvia Bass at UCI’s OIT for for putting up the link to here from their VPN-Linux page.
2. a page at Georgia Tech (now defunct), from which part of this page (the old Section 2, no longer included) was originally adapted.
3. Joe Remenak for clear, concise feedback on some additional steps (1 and 11) necessary now for the newer 64-bit Ubuntus.
4. Tom Distler, for the Tux/Cisco image at the top of this page, which I mooched from his page, How to connect Linux to a Cisco VPN using a PCF file.
5. James Condie at UCI, who encountered multiple problems with the latest changes in the 4.3.05017 version of Cisco’s install — but patiently stuck with it — thus encouraging me to update this page once again, and clarify a few additional things for newer Linux users.
6. Philippe Moisan, who caught and reported an incompatibility with the find vpnagentd command above in Installation Step 8, for some versions of Linux, and offered also a fix: to put quotes around the «*vpnagentd*» which should work with all flavors of find.

Источник

Configure AnyConnect Secure Mobility Client for Linux using Client Certificate Authentication on an ASA

Available Languages

Download Options

Contents

Introduction

This document describes a configuration example for Adaptive Security Appliance (ASA) Cisco AnyConnect Secure Mobility Client access that uses client certificate for authentication for a Linux Operative System (OS) for an AnyConnect user to connect successfully to an ASA Headend.

Contributed by Dinesh Moudgil, Cisco HTTS Engineer.

Prerequisites

Requirements

This document assumes that the ASA is fully operational and configured to allow the Cisco Adaptive Security Device Manager (ASDM) or Command Line Interface (CLI) to make configuration changes.

Cisco recommends that you have knowledge of these topics:

Basic knowledge of ASA’s CLI and ASDM
SSLVPN configuration on the Cisco ASA Head End
Fundamental knowledge of PKI
Familiarity with Linux OS

Components Used

The information in this document is based on these software and hardware versions:

Cisco Adaptive Security Appliance ASA5585-SSP-20
Cisco Adaptive Security Appliance Software Version 9.9(2)36
Adaptive Security Device Manager Version 7.9(1)
AnyConnect Version 4.6.03049
Ubuntu OS 16.04.1 LTS

Note: Download the AnyConnect VPN Client package (anyconnect-linux*.pkg) from the Cisco Software Download (registered customers only) site. Copy the AnyConnect VPN client to the ASA’s flash memory, which is then downloaded to the remote user computers in order to establish the SSL VPN connection with the ASA.

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, make sure that you understand the potential impact of any command.

Backgound Information

For a successful client certificate authentication on Linux devices, AnyConnect secure mobility client supports the following certificate stores:

1. Linux OS (PEM) certificate store
2. Firefox (NSS) certificate store

This document is based on client certificate authentication using a Linux OS (PEM) certificate store.

1. To use Linux OS certificate store, PEM file-based certificates are placed in these directories.

Note: By default, the path for installing client certificate and the private key is not present so it needs to be manually created using this command.

mkdir -p .cisco/certificates/client/private/

If you are using a Windows Certificate Authority,

1. Download the CA Certificate (Base64 encoded) with extension .cer
2. Download the User Identity Certificate (Base64 encoded) with extension .cer
3. Change the extension of certificates from .cer to .pem extension

2. To use Firefox (NSS) certificate store, user can import their certificate via Firefox.
The CA certificate for the ASA can be imported into NSS certificate store by AnyConnect client automatically if the user clicks “Always Connect” button on the certificate security warning dialog when browsing to ASA via HTTPS.

AnyConnect Linux uses Firefox certificate store (NSS) as default, if it fails then it would turn to use Linux OS certificate store.

Note: Currently, AnyConnect on a Linux OS doesn’t support GNOME Keyring so AnyConnect won’t able to use the certificate imported to the GNOME Keyring.
Please make sure there are no related certificates in Linux OS certificate store and Firefox (NSS) certificate store before importing a new user certificate.

Ensure that your files meet the following requirements:

• All certificate files must end with the extension .pem.
• All private key files must end with the extension .key.
• A client certificate and its corresponding private key must have the same filename. For example: client.pem and client.key.

For a clean start, please consider the following approach:

Linux OS (PEM) certificate store:
A. Remove unnecessary PEM files under “/opt/.cisco/certificates”, but keep the “/opt/.cisco/certificates/ca/VeriSignClass3PublicPrimaryCertificationAuthority-G5.pem” certificate intact. This is the CA certificate AnyConnect relies on to perform the code signing verification.
B. Remove the user certificates that are not required from the path