In the simplest configuration, the AnyConnect client will use a specific entry in a connection list. The connection list can contain backup entries, in case the first entry is non-responsive.

<ServerList>
  <HostEntry>
   <HostName>ACME VPN headend</HostName>		! name that in displayed in AnyConnect window list
   <HostAddress>hq.company.com</HostAddress>	   ! first entry that will be tried, can be IP
   <BackupServerList>                                 ! backup section list
    <HostAddress>warsaw.company.com</HostAddress>     ! second option
    <HostAddress>london.company.com</HostAddress>     ! third option
    <HostAddress>milan.company.com</HostAddress>      ! fourth option
    <HostAddress>berlin.company.com</HostAddress>     ! fifth option
   </BackupServerList>
   </HostEntry>
</ServerList>

In a VPN load-balanced configuration, if there are no sessions remaining:

1. The ASA will try to find and disconnect stale clients (clients connected over 8 hours ago and in hibernation).

2. If no stale clients were found, the connection will fail with a message to the user.

3. The AnyConnect client will not automatically try the next connection entry or backup entries. This occurs because the connection failure happened after initial authentication, so the AnyConnect client appears to have successfully connected. This isn’t a big problem: the user can select the next entry from the list of available connections, or retry with the same connection.

• SSL—SSL is generally obsolete, but it’s used widely in data sheets and literature because people know the name. See https://tools.ietf.org/html/rfc7568.

• TLS—TLS 1.0, 1.1, 1.2 and 1.3 are current versions. TLS 1.0 and 1.1 are being deprecated by major OS and browser companies by March 2020. ASA, FTD, and AnyConnect supports TLS up to 1.2 for VPN connectivity.

• DTLS—DTLS is UDP-based TLS for VPN connectivity. See https://tools.ietf.org/html/rfc6347.

• DTLS bears more complexity in performing high-speed calculations for processing traffic.

• Current generation crypto accelerators were optimized for years to process IPsec traffic.

Question: Can you rate-limit traffic per AnyConnect user?

Answer:

• FTD—Yes. See https://www.cisco.com/c/en/us/td/docs/security/firepower/640/configuration/guide/fpmc-config-guide-v64/firepower_threat_defense_remote_access_vpns.html#task_rvk_qnl_ngb

• ASA—You can only limit traffic per Tunnel Group. See https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/82310-qos-voip-vpn.html#anc11 and https://www.cisco.com/c/en/us/td/docs/security/asa/asa913/configuration/firewall/asa-913-firewall-config/conns-qos.html#ID-2133-000002dd

• Make sure you’re using AnyConnect 4.8.x and DTLS v1.2 or IKEv2 for the headend (FTD 6.6/ASA 9.10+) configuration

• (ASA) Verify the optimization setting for crypto hardware. There are two options:

  • crypto engine accelerator-bias ssl

  • crypto engine accelerator-bias ipsec

  Note	Changing this setting will cause traffic disruption.

• MTU in the Group Policy—The higher MTU, the better. However, once you cross 1406, you may start having problems.

• (ASA) AnyConnect tunnel optimizations can be enabled on ASA devices to potentially optimize throughput available per client. Apply following customization for the ASA:

  webvpn
   anyconnect-custom-attr TunnelOptimizationsEnabled description Optimizations Enabled
   anyconnect-custom-data TunnelOptimizationsEnabled False false
   anyconnect-custom-data TunnelOptimizationsEnabled True true
  

  Then in the group-policy:

  group-policy <Group Policy Name> attributes
    anyconnect-custom TunnelOptimizationsEnabled value True 
  

For detailed information to make sure you're getting the most performance from your ASAv, see the following document:

https://www.cisco.com/content/en/us/td/docs/security/asa/misc/asav-optimization/optimizing-your-asav-deployment.html

Question: Does FTDv support remote access VPN?

Answer: Yes!

Cloud Providers

We currently support following cloud providers for FTDv:

• Microsoft Azure cloud (all instances support up to 250 VPN endpoints):

  • Standard D3—4 vCPUs, 14 GB, 4vNICs

  • Standard D3_v2—4 vCPUs, 14 GB, 4vNICs

  • Standard D4_v2—8 vCPUs, 28 GB, 8vNICs (New in Version 6.5)

  • Standard D5_v2—16 vCPUs, 56 GB, 8vNICs (New in Version 6.5)

• Amazon AWS cloud (all instances support up to 250 VPN endpoints):

  • c4.xlarge—4 vCPUs, 7.5 GB, 2 interfaces, 1 management interface

  • c3.xlarge—4 vCPUs, 7.5 GB, 2 interfaces, 1 management interface

See which FTDv version is supported in which cloud: https://www.cisco.com/c/en/us/td/docs/security/firepower/compatibility/firepower-compatibility.html

Hypervisors

We currently support following hypervisors for FTDv:

• VMware ESXi

  • 4vCPU/8GB (default)

  • 8vCPU/16GB

  • 12vCPU/24GB

• KVM

  • 4vCPU/8GB (default)

  • 8vCPU/16GB

  • 12vCPU/24GB

See which FTDv version is supported in which hypervisor: https://www.cisco.com/c/en/us/td/docs/security/firepower/compatibility/firepower-compatibility.html

• NGFWv RAVPN in AWS—https://youtu.be/2GtK_T9bCAY

• Deploying AnyConnect SSL VPN with ASA (and Firepower Threat Defense) - BRKSEC-2501, CiscoLive!2018 Barcelona

• Deploying AnyConnect with Firepower Threat Defense with posture and MFA - BRKSEC-2348, CiscoLive!2020 Barcelona

• Firepower NGFW Clustering Deep Dive - BRKSEC-3032, CiscoLive!2020 Barcelona

• Firepower Platforms Deep Dive - BRKSEC-3035, CiscoLive!2020 Barcelona

• NGFWv and ASAv in Public Cloud (AWS and Azure) - BRKSEC-2064, CiscoLive!2019 Barcelona

• NGFWv and ASAv in Public Cloud (AWS and Azure) – BRKSEC-2064

• Deploying NGFWv & ASAv in Public Cloud (AWS and Azure) – LTRSEC-3052

• Optimizing Your Firepower/FTD Deployment - BRKSEC-2066

• Best Practices for the Cisco Firepower NGFW - TECSEC-2002

• Firepower Platform Deep Dive - BRKSEC-3035

• Dissecting FTD: architecture and troubleshooting - BRKSEC-3455

• Advanced Firepower IPS deployment - BRKSEC-3300

• Firepower Migration Tools - PSOSEC-2005