Please enable JavaScript.

Coggle requires JavaScript to display documents.

SIMOS (ASA VPN (Clientless VPN (Configuration (Steps (Enable clientless…

- - - - CIFS
      - Advanced
        
        Applicatoin Plugins
        
        thin-application client access
        
        Configuration
        
        Download and import application plug-in
        
        Enable application plug-in access
        
        Optionally, deploy access-control
        
        Create a smart-tunnel list.
        
        Assign smart-tunnel list
        
        Smart Tunnels
        
        native-application client access
        
        Reccomended for Apps with no Plugin
        
        Applications with native clients
        
        Web-based applications
        
        Port Forwarding
        
        native-application client access
        
        Only use if Smart tunnels no possible
      - Port Forwarding
        
        RDP
        
        Telnet
        
        Citrix
        
        VNC
        
        SSH
    - - Authentication with X.509 Cert
        
        Authenticate Server to Client
        
        Authenticate Client to Server
        
        Select Cryptographic Algorithms
        
        Establish protected session
        
        TCP or IDP
      - Session Establishment
        
        Phase 1
        
        Initiated by client
        
        Hello messages
        
        Negotiate Parameters
        
        Authentication
        
        Encryption Algorithm
        
        Key Exchange Method
        
        RSA
        
        DH
        
        Phase 2
        
        Server certificate and key exchange
        
        2-way authentication
        
        Client authentication optional
        
        Phase 3
        
        Client Certificate (If required)
        
        Key Exchange
        
        Cipher Suite Activated
        
        Data Transfer Integrity
        
        SHA1 or MD5
        
        Confidentiality
        
        DES-40,
        DES-CBC,
        3DES-EDE,
        3DES-CBC,
        RC4-40, or
        RC4-128.
        
        Phase 4
        
        Data Transfer Starts
        
        Exchange of session keys
        
        Session ID
        
        Given by Server to Client
        
        resume session
        
        Client doesn't need to renegotiate
        
        Client/Server
      - Transmission Protection
        
        SSL/TLS Record Protocol
        
        Data Stream Partitioned
        
        Each Partition a 'Record'
        
        Header
        
        Data
        
        HMAC
        
        Data + HMAC Encrypted
        
        cryptographic envelopes to data
        
        SSL Connection
        
        2 Phases
        
        Session Negotiation/Handshake
        
        Typically uses RSA
        
        Application Data Transfer
        
        Encrypts Data Traffic
        
        Confidentiality
        
        3 more items...
        
        Data integrity
        
        2 more items...
    - - Pre-SSL VPN configuration
      - Basic SSL VPN configuration
      - Advanced SSL VPN configuration
      - requires an identity certificate
        
        Self Signed
        
        PKI Preferred
      - Steps
        
        Enable clientless SSL VPN
        
        create custom connection profile
        
        create a custom policy
        
        Apply custom group policy to custom connection profile
        
        Create a user account in the Cisco ASA local database
      - Preconfiguration Info
        
        IP addressing plan
        
        Naming plan
        
        Certificate policy
        
        Certificate settings
        
        Username and password policy
      - DEfault Support
        
        Web browsing using HTTP and HTTPS
        File shares using CIFS and FTP
    - - Policy Group
        
        Passwords
        
        RADIUS
        
        TACACS+
        
        OTP systems
        
        PKI
        
        smart cards
        
        LDAP
        
        Windows NTLM
        
        Windows XP/2000 AD
        
        Methods
  - - - Advanced
        
        Hostscan
        
        DAP
        
        Authentication
        
        Centralized AAA
        
        Authentication with digital certificates
        
        Enrolling CLients
        
        Manual
        
        Microsoft AD
        
        Direct SCEP
        
        1 more item...
        
        SCEP proxy
        
        1 more item...
        
        Revoking
        
        CRLs
        
        OCSP
        
        AAA authorization
        
        Is enabled in the connection profile.
        
        two-factor client authentication enabled by choosing the "Both
        
        Local Authorisation
        
        Double & Triple Authentication
        
        RSA/SDI + LDAP authentication
        
        Certificates + RADIUS
        
        Certificates + RADIUS + RSA/SDI
      - Client Based IPsec
      - 2 Modes
        
        Stand Alone
        
        Web Based
      - IP Address Assignment
        
        connection profile local pool
        
        local pool in group policy
        
        Per user in local AAA user database
      - COnfiguratino Tasks
        
        Install the Cisco AnyConnect client image
        
        Enable AnyConnect on ASA
        
        Enable full-client SSL VPN traffic termination on a ASA interface
        
        Install identity certificate of the ASA appliance to the chosen VPN traffic termination interface.
        
        Define an IP address pool.
        
        Configure identity NAT for VPN client access.
        
        Edit the default group policy or create a custom one:
        
        Make sure that support for Cisco AnyConnect SSL VPNs is enabled.
        
        Optionally, configure split tunneling,
        
        Edit the default connection profile or create a custom one:
        
        Allow the user to choose a connection profile at login.
        
        Select the authentication method. The default option is the local AAA authentication method.
        
        To provide IP addresses to the Cisco AnyConnect clients, select the client address pool.
        
        Split Tunnelling
        
        Tunnel all networks
        
        Tunnel Network List
        
        Exclude Network List
      - DTLS
        
        Alternative to SSL/TLS
        
        RFC 4347
        
        Based on TLS
        
        UDP Transport
        
        Supports Dual DTLS/TLS
        
        Supports TLS Fallback
        
        DPD must be configured
        
        443 Default port
      - Software Management
        
        Predeployment (manual) method
        
        Software management tools
        
        Web launch
        
        Client Persistance
        
        Stays installed on client PC
      - Sydtem Integration
        
        Trusted Network Detection
        
        Configuration
        
        Enable the use of an automatic VPN policy.
        
        Configure a trusted network policy.
        
        Configure an untrusted network policy.
        
        Define the trusted domain.
        
        Define the trusted DNS.
        
        Actions when TN Detected
        
        Disconnect
        
        Connect
        
        Do Nothing
        
        Pause
        
        Client Scripting
        
        Reqiuires SBL or TND
      - Client Based SSL
    - - Anyconnect Version 3
        
        Supports IKEv2
      - Uses SSL by default
      - IPSec must be configuredas primary
      - IKEv2 COnfiguration Steps
        
        Enable IKEv2 on the outside interface, and choose an interface certificate.
        
        Enable Client Services.
        
        Create an IKEv2 group.
        
        Create or edit a Cisco AnyConnect connection profile.
        
        Create or edit a client connection profile.
        
        Connect and update the client profile.
        
        Reconnect using IPsec and IKEv2.
    - - Before, During and after SSL VPN session
      - Check Posture
        
        Components
        
        Prelogin policies
        
        Prelogin assessment
        
        Integration with dynamic access policies
        
        HostScan
      - Functionality
        
        Basic HostScan
        
        Endpoint Asessment
        
        Advanced Endpoint Assessment
        
        Requires additional license
        
        Antivirus
        
        Force file system protection
        
        Force virus definitions update
        
        Antispyware
        
        Personal firewall
      - Posture Module
        
        Deployment Methods
        
        Predeployment method
        
        Web deployment method:
      - Configure
        
        Enable HostScan on ASA
        
        Configure basic HostScan checks
        
        registry
        
        file
        
        process
        
        Activate extension or extensions
        
        Endpoint Assessment
        
        Detect
        
        antispyware
        
        personal firewall software
        
        antivirus
        
        Advanced Endpoint Assessment
        
        Remediate
        
        antivirus
        
        antispyware
        
        personal firewall software
      - Enable Feature on ASA
        
        Upload Image to ASA Flash
      - DAP
        
        Components
        
        DAP Records
        
        Local and AAA attributes
        
        Endpoint attributes of connecting VPN clients:
        
        Hierachy
        
        DAP
        
        User profile
        
        Group policy attached to the user profile
        
        Group policy attached to the connection profile
        
        DfltGrpPolicy settings
        
        Operations
        
        Action
        
        Conitinue
        
        Terminate
        
        ACLS
        
        Webtype ACLs
        
        Port Forwarding Lists
        
        Bookmarks
        
        Functions
        
        File Server Browsing
        
        File Server Entry
        
        HTTP Proxy
        
        URL Entry
        
        Access Methods
        
        Unchanged
        
        AnyConnect Client
        
        Web-Portal
        
        Both-Default-Web-Portal
        
        Both-Default-AnyConnect Client
        
        Integration with HostScan
        
        A remote client attempts a VPN connection.
        
        ASA performs posture assessment
        
        Uses HostScan values.
        
        ASA authenticates user via AAA.
        
        AAA server returns authorization attributes for user.
        
        ASA applies AAA authorization attributes to session.
        
        ASA selects DAP records based on
        
        user AAA authorization,
        
        User information,
        
        posture assessment.
        
        ASA aggregates DAP attributes ->
        
        from selected DAP records
        
        they become DAP policy
        
        ASA applies DAP policy to session.
        
        AntiSpyware and AntiVirus Compliance
        
        Attribute type
        
        Vendor
        
        Product
        
        Version
        
        Time since last update
  - - - IKE Policy
      - PSK
      - Transform Set
      - VPN Peer
      - Traffic for VPN
  - - - Prelogin Requirements
      - How to authenticate
      - Users/sites Into groups
      - Separate Policies
        
        AAA Login
        
        Post Login
      - selected before authentication
      - Two Default Profiles
        
        DefaultRAGroup
        
        DefaultWEBVPNGroup
    - - Post Login Settings
      - Policy restrictions
      - 1 Default Policy
        
        DfltGrpPolicy.
      - Defines Post Login Policy
    - - AnyConnect SSL VPN
      - Clientless SSL VPN
      - IPsec VPN
    - - Order
        
        DAP rules
        
        User profile
        
        Group policy attached to the user profile
        
        Group policy attached to the connection profile
        
        DfltGrpPolicy settings
- - - - Create IPsec transform-set
        
        crypto ipsec transform-set MYSET esp-aes 128 esp-sha-hmac
      - Create IPsec profile
        
        crypto ipsec profile MYPROFILE set transform-set MYSET
      - Create tunnel interface
        
        interface Tunnel0 ip unnumbered GigabitEthernet0/0 tunnel source GigabitEthernet0/0 tunnel destination 172.17.2.24
      - Specify tunnel encapsulation
        
        tunnel mode ipsec ipv4 tunnel protection ipsec profile MYPROFILE
      - Create Static Routes
        
        ip route 10.1.2.0 255.255.255.0 Tunnel0
    - - Hub and Spoke Topology
      - COnfigure IKE Peering
      - Configure IPsec transform set
      - Configure IPsec protection profile
      - Configure VTI
      - Configure ISAKAMP Profile
  - - - mGRE
      - IKE + IPsec
      - NHRP
        
        Client Server Protocol
        
        Hub is Server
        
        Spoke is client
    - - mGRE on Hub
      - Point-to-Point Gre on Spoke
    - - mGRE on Spokes
    - - Preshared Key
      - PKI
    - - Create IKE Policy
      - Create IPsec Profile
        
        Include Transform Set
      - Creates mGRE Interface
        
        IP address,
        
        set IP MTU size
        
        TCP MSS
      - NHRP
        
        Server on Hub
        
        Client on Spoke
      - Assign IPsec profile to mGRE interface
      - Enable IP processing on this interface
      - Routing
        
        EIGRP
        
        interface Tunnel 0 no ip split-horizon eigrp 1
        
        interface Tunnel 0 no ip next-hop-self eigrp
        
        No auto-summary
        
        OSPF
        
        interface Tunnel0 ip ospf network point-to-multipoint
        
        interface Tunnel0 ip ospf priority 10
        
        interface Tunnel0 ip ospf network broadcast
      - Verification
        
        show interface
        
        show ip nhrp
        
        show dmvpn detail
        
        show ip route
  - - - IKEv2 parameters
        
        crypto ikev2 profile default
      - hub-and-spoke, remote access, and site-to-site
        
        interface Virtual-Template1 type tunnel
      - Dual stack IPv4/IPv6 and GRE
        
        tunnel mode gre ip
      - DMVPN shortcut switching
        
        ip nhrp network-id 1
- - - - Phase 1
        
        Main mode
        
        Aggressive Mode
        
        Establishes IKE/ISAKAMP SA
      - Phase 2
        
        Establishes Addtional SAs
        
        PFS
        
        Unique Keys
    - - IKE_SA_INIT
      - IKE_SA_AUT
      - CREATE_CHILD SA
      - No distinct Phase1/2 like IKEv1
  - - - Out dated
- - - - Point to Point
      - Fully Meshed
      - Hub and Spoke
    - - Partial mesh
      - Tiered Hub and Spoke
      - Joined Hub and Spoke