Document ID: 111891 |
Introduction
In Cisco IOS® Software Release 12.4(20)T and later, a virtual interface SSLVPN-VIF0 was introduced for AnyConnect VPN client connections. But, this SSLVPN-VIF0 interface is an internal interface, which does not support user configurations. This created a problem with AnyConnect VPN and Zone Based Policy Firewall since with the firewall, traffic can only flow between two interfaces when both interfaces belong to security zones. Since the user cannot configure the SSLVPN-VIF0 interface to make it a zone member, VPN client traffic terminated on the Cisco IOS WebVPN gateway after decryption cannot be forwarded to any other interface belonging to a security zone. The symptom of this problem can be seen with this log message reported by the firewall:
*Mar 4 16:43:18.251: %FW-6-DROP_PKT: Dropping icmp session 192.168.1.12:0 192.168.10.1:0 due to One of the interfaces not being cfged for zoning with ip ident 0
This issue was later addressed in newer software releases of Cisco IOS. With the new code, the user can assign a security zone to a virtual-template interface, which is referenced under the WebVPN context, in order to associate a security zone with the WebVPN context .
Prerequisites
Requirements
In order to take advantage of the new capability in Cisco IOS, you need to ensure the Cisco IOS WebVPN gateway device is running Cisco IOS Software Release 12.4(20)T3, Cisco IOS Software Release12.4(22)T2, or Cisco IOS Software Release12.4(24)T1 and later.
Components Used
The information in this document is based on these software and hardware versions:
-
Cisco IOS 3845 series router running version 15.0(1)M1 Advanced Security feature set
-
Cisco AnyConnect SSL VPN Client version for Windows 2.4.1012
The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, make sure that you understand the potential impact of any command.
Conventions
Refer to the Cisco Technical Tips Conventions for more information on document conventions.
Configure
In this section, you are presented with the information to configure the features described in this document.
Note: Use the Command Lookup Tool (registered customers only) to obtain more information on the commands used in this section.
Network Diagram
This document uses this network setup:
Configure Cisco IOS AnyConnect Server
Here are the high level configuration steps that need to be performed on the Cisco IOS AnyConnect server in order to make it interoperate with the Zone Based Policy Firewall. The resulting final configuration are included for two typical deployment scenarios later in this document.
-
Configure a Virtual Template interface and assign it in a security zone for traffic decrypted from the AnyConnect connection.
-
Add the previously configured Virtual Template to the WebVPN context for the AnyConnect configuration.
-
Complete the rest of the WebVPN and Zone Based Policy Firewall configuration.
There are two typical scenarios with AnyConnect and ZBF, and here are the final router configurations for each scenario.
Deployment Scenario 1
VPN traffic belongs to the same security zone as the inside network.
The AnyConnect traffic goes into the same security zone that the inside LAN interface belongs to post decryption.
Note: A self zone is also defined to only allow http/https traffic to the router itself for access restriction.
| Router Configuration |
|---|
Router#show run
Building configuration...
Current configuration : 5225 bytes
!
! Last configuration change at 16:25:30 UTC Thu Mar 4 2010 by cisco
!
version 15.0
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router
!
boot-start-marker
boot system flash:
boot-end-marker
!
aaa new-model
!
aaa authentication login default local
aaa authentication login webvpn local
!
aaa session-id common
!
!
ip cef
!
!
ip inspect log drop-pkt
no ip domain lookup
!
!
parameter-map type inspect audit-map
audit-trail on
tcp idle-time 20
!
parameter-map type inspect global
!
!
crypto pki trustpoint TP-self-signed-2692466680
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-2692466680
revocation-check none
rsakeypair TP-self-signed-2692466680
!
!
crypto pki certificate chain TP-self-signed-2692466680
certificate self-signed 01
<actual certificate deleted here for brevity>
quit
!
!
username cisco password 0 cisco
!
!
class-map type inspect match-any test
match protocol tcp
match protocol udp
match protocol icmp
class-map type inspect match-all router-access
match access-group name router-access
!
!
policy-map type inspect firewall-policy
class type inspect test
inspect audit-map
class class-default
drop
policy-map type inspect out-to-self-policy
class type inspect router-access
inspect
class class-default
drop
policy-map type inspect self-to-out-policy
class type inspect test
inspect
class class-default
drop
!
zone security inside
zone security outside
zone-pair security in-out source inside destination outside
service-policy type inspect firewall-policy
zone-pair security out-self source outside destination self
service-policy type inspect out-to-self-policy
zone-pair security self-out source self destination outside
service-policy type inspect self-to-out-policy
!
!
interface Loopback0
ip address 172.16.1.1 255.255.255.255
!
interface GigabitEthernet0/0
ip address 192.168.10.1 255.255.255.0
ip nat inside
ip virtual-reassembly
zone-member security inside
!
interface GigabitEthernet0/1
ip address 209.165.200.230 255.255.255.224
ip nat outside
ip virtual-reassembly
zone-member security outside
!
interface Virtual-Template1
ip unnumbered Loopback0
zone-member security inside
!
!
ip local pool test 192.168.1.1 192.168.1.100
ip forward-protocol nd
!
ip http server
ip http secure-server
ip nat inside source list 1 interface GigabitEthernet0/1 overload
ip route 0.0.0.0 0.0.0.0 209.165.200.225
!
ip access-list extended router-access
permit tcp any host 209.165.200.230 eq www
permit tcp any host 209.165.200.230 eq 443
!
access-list 1 permit 192.168.10.0 0.0.0.255
!
control-plane
!
!
!
line con 0
exec-timeout 0 0
logging synchronous
line aux 0
modem InOut
transport input all
line vty 0 4
transport input all
!
exception data-corruption buffer truncate
scheduler allocate 20000 1000
!
webvpn gateway webvpn_gateway
ip address 209.165.200.230 port 443
http-redirect port 80
ssl trustpoint TP-self-signed-2692466680
inservice
!
webvpn install svc flash:/webvpn/svc.pkg sequence 1
!
webvpn context test
secondary-color white
title-color #669999
text-color black
ssl authenticate verify all
!
!
policy group policy_1
functions svc-enabled
svc address-pool "test"
svc keep-client-installed
svc split include 192.168.10.0 255.255.255.0
virtual-template 1
default-group-policy policy_1
aaa authentication list webvpn
gateway webvpn_gateway
inservice
!
end
|
Deployment Scenario 2
VPN traffic belongs to a different security zone from the inside network.
The AnyConnect traffic belongs to a separate VPN zone, and there is a security policy that controls what vpn traffic can flow into the inside zone. In this particular example, telnet and http traffic are allowed from the AnyConnect client to the inside LAN network.
| Router Configuration |
|---|
Router#show run
Building configuration...
Current configuration : 6029 bytes
!
! Last configuration change at 20:57:32 UTC Fri Mar 5 2010 by cisco
!
version 15.0
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router
!
boot-start-marker
boot system flash:
boot-end-marker
!
aaa new-model
!
!
aaa authentication login default local
aaa authentication login webvpn local
!
!
aaa session-id common
!
ip cef
!
!
ip inspect log drop-pkt
no ip domain lookup
!
multilink bundle-name authenticated
parameter-map type inspect global
parameter-map type inspect audit-map
audit-trail on
tcp idle-time 20
!
!
crypto pki trustpoint TP-self-signed-2692466680
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-2692466680
revocation-check none
rsakeypair TP-self-signed-2692466680
!
!
crypto pki certificate chain TP-self-signed-2692466680
certificate self-signed 01
<actual certificate deleted for brevity>
quit
!
!
license udi pid CISCO3845-MB sn FOC09483Y8J
archive
log config
hidekeys
username cisco password 0 cisco
!
!
class-map type inspect match-any test
match protocol tcp
match protocol udp
match protocol icmp
class-map type inspect match-all router-access
match access-group name router-access
class-map type inspect match-any http-telnet-ftp
match protocol http
match protocol telnet
match protocol ftp
class-map type inspect match-all vpn-to-inside-cmap
match class-map http-telnet-ftp
match access-group name tunnel-traffic
!
!
policy-map type inspect firewall-policy
class type inspect test
inspect audit-map
class class-default
drop
policy-map type inspect out-to-self-policy
class type inspect router-access
inspect
class class-default
drop
policy-map type inspect self-to-out-policy
class type inspect test
inspect
class class-default
pass
policy-map type inspect vpn-to-in-policy
class type inspect vpn-to-inside-cmap
inspect
class class-default
drop
!
zone security inside
zone security outside
zone security vpn
zone-pair security in-out source inside destination outside
service-policy type inspect firewall-policy
zone-pair security out-self source outside destination self
service-policy type inspect out-to-self-policy
zone-pair security self-out source self destination outside
service-policy type inspect self-to-out-policy
zone-pair security in-vpn source inside destination vpn
service-policy type inspect firewall-policy
zone-pair security vpn-in source vpn destination inside
service-policy type inspect vpn-to-in-policy
!
!
interface Loopback0
ip address 172.16.1.1 255.255.255.255
!
!
interface GigabitEthernet0/0
ip address 192.168.10.1 255.255.255.0
ip nat inside
ip virtual-reassembly
zone-member security inside
!
!
interface GigabitEthernet0/1
ip address 209.165.200.230 255.255.255.224
ip nat outside
ip virtual-reassembly
zone-member security outside
!
!
interface Virtual-Template1
ip unnumbered Loopback0
zone-member security vpn
!
!
ip local pool test 192.168.1.1 192.168.1.100
ip forward-protocol nd
!
!
ip http server
ip http secure-server
ip nat inside source list 1 interface GigabitEthernet0/1 overload
ip route 0.0.0.0 0.0.0.0 209.165.200.225
!
ip access-list extended broadcast
permit ip any host 255.255.255.255
ip access-list extended router-access
permit tcp any host 209.165.200.230 eq www
permit tcp any host 209.165.200.230 eq 443
ip access-list extended tunnel-traffic
permit ip any 192.168.1.0 0.0.0.255
!
access-list 1 permit 192.168.10.0 0.0.0.255
!
!
control-plane
!
!
!
line con 0
exec-timeout 0 0
logging synchronous
line aux 0
modem InOut
transport input all
line vty 0 4
transport input all
!
exception data-corruption buffer truncate
scheduler allocate 20000 1000
!
webvpn gateway webvpn_gateway
ip address 209.165.200.230 port 443
http-redirect port 80
ssl trustpoint TP-self-signed-2692466680
inservice
!
webvpn install svc flash:/webvpn/svc.pkg sequence 1
!
webvpn context test
secondary-color white
title-color #669999
text-color black
ssl authenticate verify all
!
!
policy group policy_1
functions svc-enabled
svc address-pool "test"
svc keep-client-installed
svc split include 192.168.10.0 255.255.255.0
virtual-template 1
default-group-policy policy_1
aaa authentication list webvpn
gateway webvpn_gateway
inservice
!
end
|
Verify
Use this section to confirm that your configuration works properly.
The Output Interpreter Tool (registered customers only) (OIT) supports certain show commands. Use the OIT to view an analysis of show command output.
Several show commands are associated with WebVPN. You can execute these commands at the command-line interface (CLI) to show statistics and other information. Refer to Verifying WebVPN Configuration for more information about show commands. Refer to Zone-Based Policy Firewall Configuration guide for more information on commands used to verify the Zone Based Policy Firewall configuration.
Troubleshoot
This section provides information you can use to troubleshoot your configuration.
Troubleshooting Commands
Note: Refer to Important Information on Debug Commands before you use debug commands.
Several debug commands are associated with WebVPN. Refer to Using WebVPN Debug Commands for more information about these commands. Refer to the command for more information on Zone Based Policy Firewall debugging commands.
Cisco Support Community - Featured Conversations
Related Information
| Updated: Apr 07, 2010 | Document ID: 111891 |