Contents

Introduction

Prerequisites

Requirements

Components Used

Background Information

What is a Remote Access VPN?

What is SD-WAN Remote Access VPN?

Split Tunneling vs Tunnel All

Before SDRA and After SDRA

What is FlexVPN?

Prerequisites Configuration

ISE Configuration

Split-Tunneling vs Tunnel All in AnyConnect Client

CA Server Configuration in Cisco IOS® XE

SD-WAN RA Configuration

Crypto PKI Configuration

AAA Configuration

FlexVPN Configuration

SD-WAN RA Configuration Example

AnyConnect Client Configuration

Configure AnyConnect Profile Editor

Install the AnyConnect Profile (XML)

Disable the AnyConnect Downloader

Unblock Untrusted Servers on AnyConnect Client

Use AnyConnect Client

Verify

Related Information

Introduction

This document describes how to configure  SD-WAN Remote Access (SDRA) with AnyConnect Client using a Cisco IOS® XE Autonomous mode as a CA server, and a Cisco Identity Services Engine (ISE) server for the Authentication, Authorization, and Accounting.

Prerequisites

Requirements

Cisco recommends that you have knowledge of these topics:

- Cisco Software-defined Wide Area Network (SD-WAN)

- Public Key Infrastructure (PKI)

- FlexVPN

- RADIUS server

Components Used

The information in this document is based on these software and hardware versions:

- C8000V version17.07.01a

- vManage version 20.7.1

- CSR1000V version 17.03.04.a

- ISE version 2.7.0.256

- AnyConnect Secure Mobility Client version 4.10.04071

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

Background Information

What is a Remote Access VPN?

Remote Access VPN allows the remote user to securely connect to the company networks, use applications, and data that is only accessible through the devices plugged in at the office.

A remote-access VPN works by a virtual tunnel created between an employee’s device and the company’s network.

This tunnel goes through the public internet but the data sent back and forth through it is protected by encryption and security protocols to help keep it private and secure.

The two main components in this type of VPN are a network access server/RA headend and VPN client software.

What is SD-WAN Remote Access VPN?

The Remote Access has been integrated into the SD-WAN solution that eliminates the need for separate Cisco SD-WAN and RA infrastructure and enables rapid scalability of RA services with the use of the Cisco AnyConnect as an RA software Client.

Remote Access provides remote users access to the organization's network. This enables the work from Home.

The Advantages

- RA provides access to an organization's network from devices/users at remote locations. (HO)

- Extends the Cisco SD-WAN solution to RA users without the requirement of each RA user's device to be part of the Cisco SD-WAN fabric.

- Data Security

- Split-Tunneling or Tunnel All

- Scalability

- Ability to distribute the RA load across numerous Cisco IOS® XE SD-WAN devices in the Cisco SD-WAN fabric.

Split Tunneling vs Tunnel All

Split tunneling is used in scenarios where only specific traffic must be tunneled (SD-WAN subnets for example) as shown in the image.

Before SDRA and After SDRA

The traditional remote access VPN design requires separate RA infrastructure outside of the Cisco SD-WAN fabric to provide remote user access to the network like non SD-WAN appliances such as ASA, Regular Cisco IOS® XE, or third-party devices, and RA traffic is moved forward to SD-WAN appliance as shown in the image.

The SD-WAN Remote Access changes the way remote users connect to the network. They connect directly to the cEdge that is used as RA headend. Extends Cisco SD-WAN features and benefits to RA users. RA users become branch LAN-side users.

For each RA client, the SD-WAN RA headend assigns an IP address to an RA client and adds a static host route to the assigned IP address in the service VRF in which the RA user is placed.

The static route specifies the VPN tunnel of the RA client connection. The SD-WAN RA headend advertises the static IP within the service VRF of the RA client with the use of OMP to all edge devices in the service VPN.

What is FlexVPN?

SD-WAN RA Leverages the Cisco FlexVPN RA solution. FlexVPN is Cisco's implementation of the IKEv2 standard feature a unified paradigm and CLI that combines site to site, remote access, hub and spoke topologies, and partial meshes (spoke to spoke direct). FlexVPN offers a simple but modular framework that extensively uses the tunnel interface paradigm while it remains compatible with legacy VPN implementations.

Prerequisites Configuration

For this example, an SD-WAN RA lab setup has been created as shown in the image.

Additional components have been configured for this SD-WAN RA lab scenario:

- A Regular Cisco IOS® XE in Autonomous mode as a CA server.

- An ISE/Radius server for Authentication, Authorization, and Accounting.

- A Windows PC with reachability to the cEdge through the WAN interface.

- AnyConnect Client already installed.

Note: The CA  and RADIUS servers have been placed in the service VRF 1.  Both servers must be reachable through the service VRF for all the SD-WAN RA headends.

Note: The Cisco SD-WAN Remote Access is supported on the 17.7.1a version and specific devices for SDRA. For supported devices reference navigate to: Supported platforms for the SD-WAN RA headend

ISE Configuration

To support the SD-WAN RA headend, ensure that the parameters are configured on the RADIUS server. These parameters are required for RA connections:

- User authentication credentials

- Username and password for AnyConnect-EAP connections

- Policy parameters (attributes) that apply to a user or to a user group

- VRF: Service VPN that the RA user is assigned to

- IP pool name: Name of the IP pool defined on the RA headend

- Server subnets: Subnet access to provide to the RA user

The first step to configure in the ISE is the RA headend or cEdge IP address as a Network device to be able to make Radius requests to the ISE.

Navigate to Administration > Network Devices and add the RA Headed (cEdge) IP address and Password as shown in the image.

Network device added as shown in the image.

In the RADIUS Server is needed to configure the usernames and password for the AnyConnect authentication as shown in the image. Navigate to Administration > Identities.

A policy Set needs to be created with the match condition to hit as shown in the image. In this case, the All Device types condition is used, which means all the users hit this Policy.

Then, the Authorization Policy has been created one per condition. The condition All Device types and the Identity groups to match.

In the Authorization Profile, we need to configure the Access Type as Access_ACCEPT under the Advanced Attributes Settings, select the Cisco vendor and Cisco-AV-pair attribute.

It Is necessary to configure some policy parameters for the users:

- VRF, the Service VRF to which the user belongs.

- The IP pool name, each user connection is assigned an IP address, that belongs to the IP pool configured in the cEdges.

- the subnets that the user can access

Caution:  The IP vrf forwarding command must come before the IP unnumbered command. If the virtual access interface is cloned from the virtual template, and the IP vrf forwarding command is then applied, any IP configuration is removed from the virtual access interface.

User attributes:

Access Type = ACCESS_ACCEPT

cisco-av-pair = ip:interface-config=vrf forwarding 1

cisco-av-pair = ip:interface-config=ip unnumbered Loopback1

cisco-av-pair = ipsec:addr-pool=RA-POOL

cisco-av-pair = ipsec:route-set=prefix 10.11.15.0/24

cisco-av-pair = ipsec:route-set=prefix 10.11.16.0/24

Split-Tunneling vs Tunnel All in AnyConnect Client

ipsec:route-set=prefix attribute received in the AnyConnect Client is installed as shown in the image.

CA Server Configuration in Cisco IOS® XE

The CA server provisions certificates to the Cisco IOS® XE SD-WAN devices and enables the RA headend to authenticate itself to RA clients.

The CEDGE cannot be a CA server as these crypto PKI server commands are not supported in the Cisco IOS® XE SD-WAN.

- Generate an RSA Keypair

- Create the PKI trustpoint for the CA server

- Configure the rsakeypair with the previously KEY-CA generated.

Note: The PKI server and PKI trustpoint must use the same name.

- Create the CA server

- Configure issuer-name for your CA server

- Activate the CA server using “No shutdown”

crypto key generate rsa modulus 2048 label KEY-CA

!

crypto pki trustpoint CA

revocation-check none

rsakeypair KEY-CA

auto-enroll

!

crypto pki server CA

no database archive

issuer-name CN=CSR1Kv_SDWAN_RA

grant auto

hash sha1

lifetime certificate 3600

lifetime ca-certificate 3650

auto-rollover

no shutdown

!

Verify if the CA server is enabled.

CA-Server-CSRv#show crypto pki server CA

Certificate Server CA:

Status: enabled

State: enabled

Server's configuration is locked  (enter "shut" to unlock it)

Issuer name: CN=CSR1Kv_SDWAN_RA

CA cert fingerprint: 10DA27AD EF54A3F8 12925750 CE2E27EB

Granting mode is: auto

Last certificate issued serial number (hex): 3

CA certificate expiration timer: 23:15:33 UTC Jan 17 2032

CRL NextUpdate timer: 05:12:12 UTC Jan 22 2022

Current primary storage dir: nvram:

Database Level: Minimum - no cert data written to storage

Auto-Rollover configured, overlap period 30 days

Autorollover timer: 23:15:37 UTC Dec 18 2031

Verify if the CA server certificate is installed.

CA-Server-CSRv#show crypto pki certificates verbose CA

CA Certificate

Status: Available

Version: 3

Certificate Serial Number (hex): 01

Certificate Usage: Signature

Issuer:

cn=CSR1Kv_SDWAN_RA

Subject:

cn=CSR1Kv_SDWAN_RA

Validity Date:

start date: 23:15:33 UTC Jan 19 2022

end date: 23:15:33 UTC Jan 17 2032

Subject Key Info:

Public Key Algorithm: rsaEncryption

RSA Public Key: (2048 bit)

Signature Algorithm: SHA1 with RSA Encryption

Fingerprint MD5: 10DA27AD EF54A3F8 12925750 CE2E27EB

Fingerprint SHA1: 44E256C3 4FA45C5D F0398630 9D88B75E 5026CE4A

X509v3 extensions:

X509v3 Key Usage: 86000000

Digital Signature

Key Cert Sign

CRL Signature

X509v3 Subject Key ID: 92F7CD72 355AA85F 672867D4 EC0C10C5 0B177C38

X509v3 Basic Constraints:

CA: TRUE

X509v3 Authority Key ID: 92F7CD72 355AA85F 672867D4 EC0C10C5 0B177C38

Authority Info Access:

Cert install time: 23:44:35 UTC Mar 13 2022

Associated Trustpoints: -RA-truspoint CA

Storage: nvram:CSR1Kv_SDWAN#1CA.cer

The Fingerprint SHA 1 from the CA certificate is used on the crypto pki trustpoint in the cEdge router (RA headend) with the remote access configuration.

Fingerprint SHA1: 44E256C3 4FA45C5D F0398630 9D88B75E 5026CE4A

SD-WAN RA Configuration

Note: This document does not cover the SD-WAN onboarding process for Controllers and cEdge. It is assumed the SD-WAN fabric is up and fully functional.

Crypto PKI Configuration

- Create PKI trustpoint.

- Configure the URL for the CA server.

- Copy the fingerprint sha 1 from the CA server certificate.

- Configure the Subject Name and Alt Name for the new  Identity certificate.

- Configure the rsakeypar with the previously KEY-ID generated.

crypto pki trustpoint RA-TRUSTPOINT

subject-name CN=cEdge-SDWAN-1.crv

enrollment url http://10.11.14.226:80

fingerprint 44E256C34FA45C5DF03986309D88B75E5026CE4A

subject-name CN=cEdge-SDWAN-1.crv

vrf 1

rsakeypair KEY-NEW

revocation-check none

Ask for the CA certificate to authenticate:

crypto pki authenticate RA-TRUSTPOINT

Generates the CSR, sends to the CA server and it receives the new Identity certificate:

Crypto pki enroll RA-TRUSTPOINT

Verify the CA certificate and the cEdge certificate:

cEdge-207#show crypto pki certificates RA-TRUSTPOINT

Certificate

Status: Available

Certificate Serial Number (hex): 04

Certificate Usage: General Purpose

Issuer:

cn=CSR1Kv_SDWAN_RA

Subject:

Name: cEdge-207

hostname=cEdge-207

cn=cEdge-SDWAN-1.crv

Validity Date:

start date: 03:25:40 UTC Jan 24 2022

end   date: 03:25:40 UTC Dec 3 2031

Associated Trustpoints: RA-TRUSTPOINT

Storage: nvram:CSR1Kv_SDWAN#4.cer

CA Certificate

Status: Available

Certificate Serial Number (hex): 01

Certificate Usage: Signature

Issuer:

cn=CSR1Kv_SDWAN_RA

Subject:

cn=CSR1Kv_SDWAN_RA

Validity Date:

start date: 23:15:33 UTC Jan 19 2022

end   date: 23:15:33 UTC Jan 17 2032

Associated Trustpoints: RA-TRUSTPOINT

Storage: nvram:CSR1Kv_SDWAN#1CA.cer

AAA Configuration

aaa new-model

!

aaa group server radius ISE-RA-Group

server-private 10.11.14.225 key Cisc0123

ip radius source-interface GigabitEthernet2

!

aaa authentication login ISE-RA-Authentication group ISE-RA-Group

aaa authorization network ISE-RA-Authorization group ISE-RA-Group

aaa accounting network ISE-RA-Accounting start-stop group ISE-RA-Group

FlexVPN Configuration

Configure IP Pool

ip local pool RA-POOL 10.20.14.1 10.20.14.100

Configure an IKEv2 Proposals (Ciphers and parameters) and Policy:

crypto ikev2 proposal IKEV2-RA-PROP

encryption aes-cbc-256

integrity sha256

group 19

prf sha256

crypto ikev2 policy IKEV2-RA-POLICY

proposal IKEV2-RA-PROP

Configure an IKEv2 Profile name-mangler:

crypto ikev2 name-mangler IKEV2-RA-MANGLER

eap suffix delimiter @

Note: The name-mangler derives the name from the prefix in the EAP identity (username) delimitating in the EAP identity that separates the prefix and the suffix.

Configure IPsec ciphers:

crypto ipsec transform-set IKEV2-RA-TRANSFORM-SET esp-aes 256 esp-sha-hmac

mode tunnel

Configure Crypto IKEv2 profile:

crypto ikev2 profile RA-SDWAN-IKEV2-PROFILE

match identity remote any

identity local address 192.168.10.218

authentication local rsa-sig

authentication remote anyconnect-eap aggregate

pki trustpoint RA-TRUSTPOINT

aaa authentication anyconnect-eap ISE-RA-Authentication

aaa authorization group anyconnect-eap list ISE-RA-Authorization name-mangler IKEV2-RA-MANGLER password Cisc0123456

aaa authorization user anyconnect-eap list ISE-RA-Authorization USER-SDWAN password Us3r123456

aaa accounting anyconnect-eap ISE-RA-Accounting

Configure Crypto IPSEC profile:

crypto ipsec profile IKEV2-RA-PROFILE

set transform-set IKEV2-RA-TRANSFORM-SET

set ikev2-profile RA-SDWAN-IKEV2-PROFILE

Configure Virtual Template Interface:

!

interface Virtual-Template101 type tunnel

vrf forwarding 1

tunnel mode ipsec ipv4

tunnel protection ipsec profile IKEV2-RA-PROFILE

Configure Virtual Template in the Crypto IKEv2 Profile:

crypto ikev2 profile RA-SDWAN-IKEV2-PROFILE

virtual-template 101

SD-WAN RA Configuration Example

aaa new-model

!

aaa group server radius ISE-RA-Group

server-private 10.11.14.225 key Cisc0123

!

aaa authentication login ISE-RA-Authentication group ISE-RA-Group

aaa authorization network ISE-RA-Authorization group ISE-RA-Group

aaa accounting network ISE-RA-Accounting start-stop group ISE-RA-Group

!

crypto pki trustpoint RA-TRUSTPOINT

subject-name CN=cEdge-SDWAN-1.crv

enrollment url http://10.11.14.226:80

fingerprint 44E256C34FA45C5DF03986309D88B75E5026CE4A

subject-name CN=cEdge-SDWAN-1.crv

vrf 1

rsakeypair KEY-NEW

revocation-check none

!

ip local pool RA-POOL 10.20.14.1 10.20.14.100

!

crypto ikev2 name-mangler IKEV2-RA-MANGLER

eap suffix delimiter @

!

crypto ikev2 proposal IKEV2-RA-PROP

encryption aes-cbc-256

integrity sha256

group 19

prf sha256

!

crypto ikev2 policy IKEV2-RA-POLICY

proposal IKEV2-RA-PROP

!

crypto ipsec transform-set IKEV2-RA-TRANSFORM-SET esp-aes 256 esp-sha-hmac

mode tunnel

!

crypto ikev2 profile RA-SDWAN-IKEV2-PROFILE

match identity remote any

identity local address 192.168.10.218

authentication local rsa-sig

authentication remote anyconnect-eap aggregate

pki trustpoint RA-TRUSTPOINT

aaa authentication anyconnect-eap ISE-RA-Authentication

aaa authorization group anyconnect-eap list ISE-RA-Authorization name-mangler IKEV2-RA-MANGLER password Cisc0123456

aaa authorization user anyconnect-eap list ISE-RA-Authorization USER-SDWAN password Us3r123456

aaa accounting anyconnect-eap ISE-RA-Accounting

!

crypto ipsec profile IKEV2-RA-PROFILE

set transform-set IKEV2-RA-TRANSFORM-SET

set ikev2-profile RA-SDWAN-IKEV2-PROFILE

!

interface Virtual-Template101 type tunnel

vrf forwarding 1

tunnel mode ipsec ipv4

tunnel protection ipsec profile IKEV2-RA-PROFILE

!

crypto ikev2 profile RA-SDWAN-IKEV2-PROFILE

virtual-template 101

AnyConnect Client Configuration

The AnyConnect Client uses SSL as the default protocol for tunnel establishment, and this protocol is not supported for SD-WAN RA (Road map). RA uses FlexVPN, therefore IPSEC is the protocol used and it is mandatory to change it and this is done through the XML profile.

The user can manually enter the FQDN of the VPN gateway in the address bar of the AnyConnect client. This results in the SSL connection to the gateway.

Configure AnyConnect Profile Editor

- Navigate to Server List and click Add.

- Select IPsec as "Primary Protocol".

- Uncheck the ASA gateway option.

- Select EAP-AnyConnect as the “Auth Method During IKE Negotiation”.

- Display/Name (Required) is the name used to save this connection under the AnyConnect client.

- FQDN or IP Address must be filed with the cEdge (Public) IP Address.

- Save the profile.

Install the AnyConnect Profile (XML)

The XML profile can be manually put into the directory:

For Windows:

C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client\Profile

For MAC OS:

/opt/cisco/anyconnect/profile

The AnyConnect client needs to be restarted in order for the profile to become visible in the GUI. The process can be restarted by right-clicking the AnyConnect icon in the Windows tray and selecting the Quit option:

Disable the AnyConnect Downloader

The AnyConnect client tries to perform the download of the XML profile after successful log in by default.

If the profile is not available, the connection fails. As a workaround, it is possible to disable the AnyConnect profile download capability on the client itself.

For Windows:

C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client\AnyConnectLocalPolicy.xml

For MAC OS:

/opt/cisco/anyconnect/AnyConnectLocalPolicy.xml

The "BypassDownloader" option is set to "true":

<?xml version="1.0" encoding="UTF-8"?>

<AnyConnectLocalPolicy xmlns="http://schemas.xmlsoap.org/encoding/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://schemas.xmlsoap.org/encoding/ AnyConnectLocalPolicy.xsd" acversion="4.9.04043">

<BypassDownloader>true</BypassDownloader>

<EnableCRLCheck>false</EnableCRLCheck>

<ExcludeFirefoxNSSCertStore>false</ExcludeFirefoxNSSCertStore>

<ExcludeMacNativeCertStore>false</ExcludeMacNativeCertStore>

<ExcludePemFileCertStore>false</ExcludePemFileCertStore>

<ExcludeWinNativeCertStore>false</ExcludeWinNativeCertStore>

<FipsMode>false</FipsMode>

<RestrictPreferenceCaching>false</RestrictPreferenceCaching>

<RestrictServerCertStore>false</RestrictServerCertStore>

<RestrictTunnelProtocols>false</RestrictTunnelProtocols>

<RestrictWebLaunch>false</RestrictWebLaunch>

<StrictCertificateTrust>false</StrictCertificateTrust>

<UpdatePolicy>

<AllowComplianceModuleUpdatesFromAnyServer>true</AllowComplianceModuleUpdatesFromAnyServer>

<AllowISEProfileUpdatesFromAnyServer>true</AllowISEProfileUpdatesFromAnyServer>

<AllowManagementVPNProfileUpdatesFromAnyServer>true</AllowManagementVPNProfileUpdatesFromAnyServer>

<AllowServiceProfileUpdatesFromAnyServer>true</AllowServiceProfileUpdatesFromAnyServer>

<AllowSoftwareUpdatesFromAnyServer>true</AllowSoftwareUpdatesFromAnyServer>

<AllowVPNProfileUpdatesFromAnyServer>true</AllowVPNProfileUpdatesFromAnyServer></UpdatePolicy>

</AnyConnectLocalPolicy>

Unblock Untrusted Servers on AnyConnect Client

Navigate to Settings > Preferences and uncheck all the box options.

The most important is the “Block Connections to untrusted servers“ for this scenario.

Note: The Certificate used for RA headend/cEdge authentication is the one previously created and signed by the CA server in Cisco IOS® XE. As this  CA server is not a Public entity like GoDaddy, Symantec, Cisco, and so on. The PC Client interprets the certificate as an untrusted server. This is fixed using a Public Certificate or CA server your company trusts.

Use AnyConnect Client

Once all the SDRA configuration is placed the flow for a successful connection is shown as the image.

Verify

The virtual template interface is used to create the virtual access interface to start a crypto channel and establish IKEv2 and IPsec security associations (SAs) between the server (cEdge) and the client (AnyConnect user).

Note: The virtual-template interface is always up/down. Status is up and Protocol is down.

cEdge-207#show ip int brief

Interface              IP-Address      OK? Method Status                Protocol

GigabitEthernet1       unassigned      YES unset  up                    up

GigabitEthernet2       192.168.10.218  YES other  up                    up

GigabitEthernet3       10.11.14.227    YES other  up                    up

Sdwan-system-intf      10.1.1.18        YES unset  up                    up

Loopback1              192.168.50.1    YES other  up                    up

Loopback65528          192.168.1.1     YES other  up                    up

NVI0                   unassigned      YES unset  up                    up

Tunnel2                192.168.10.218  YES TFTP   up                    up

Virtual-Access1        192.168.50.1    YES unset  up                    up

Virtual-Template101    unassigned      YES unset  up                    down

Check the actual configuration applied for the Virtual-Acces interface associated with the client with show derived-config interface virtual-access <number>.

cEdge-207#show derived-config interface virtual-access 1

Building configuration...

Derived configuration : 252 bytes

!

interface Virtual-Access1

vrf forwarding 1

ip unnumbered Loopback1

tunnel source 192.168.10.218

tunnel mode ipsec ipv4

tunnel destination 192.168.10.219

tunnel protection ipsec profile IKEV2-RA-PROFILE

no tunnel protection ipsec initiate

end

Check the IPsec security associations (SAs) for AnyConnect client with the show crypto ipsec sa peer <AnyConnect Pubic IP >.

cEdge-207#show crypto ipsec sa peer 192.168.10.219

interface: Virtual-Access2

Crypto map tag: Virtual-Access2-head-0, local addr 192.168.10.218

protected vrf: 1

local  ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)

remote ident (addr/mask/prot/port): (10.20.14.13/255.255.255.255/0/0)

current_peer 192.168.10.219 port 50787

PERMIT, flags={origin_is_acl,}

#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0

#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0

#pkts compressed: 0, #pkts decompressed: 0

#pkts not compressed: 0, #pkts compr. failed: 0

#pkts not decompressed: 0, #pkts decompress failed: 0

#send errors 0, #recv errors 0

outbound pcp sas:

… Output Omitted….

Check IKEv2 SA parameters for the session, the username, and the assigned IP.

Note: The assigned IP address must match the IP address on the AnyConnect Client side.

cEdge-207#sh crypto ikev2 session detail

IPv4 Crypto IKEv2 Session

Session-id:21, Status:UP-ACTIVE, IKE count:1, CHILD count:1

Tunnel-id Local                 Remote                fvrf/ivrf            Status

1         192.168.10.218/4500   192.168.10.219/62654  none/1               READY

Encr: AES-CBC, keysize: 256, PRF: SHA256, Hash: SHA256, DH Grp:19, Auth sign: RSA, Auth verify: AnyConnect-EAP

Life/Active Time: 86400/532 sec

CE id: 1090, Session-id: 21

Local spi: DDB03CE8B791DCF7       Remote spi: 60052513A60C622B

Status Description: Negotiation done

Local id: 192.168.10.218

Remote id: *$AnyConnectClient$*

Remote EAP id: anavazar@cisco.com

Local req msg id:  0              Remote req msg id:  23

Local next msg id: 0              Remote next msg id: 23

Local req queued:  0              Remote req queued:  23

Local window:      5              Remote window:      1

DPD configured for 45 seconds, retry 2

Fragmentation not  configured.

Dynamic Route Update: disabled

Extended Authentication not configured.

NAT-T is detected  outside

Cisco Trust Security SGT is disabl

Assigned host addr: 10.20.14.19

Initiator of SA : No

Child sa: local selector  0.0.0.0/0 - 255.255.255.255/65535

remote selector 10.20.14.19/0 - 10.20.14.19/65535

ESP spi in/out: 0x43FD5AD3/0xC8349D4F

AH spi in/out: 0x0/0x0

CPI in/out: 0x0/0x0

Encr: AES-CBC, keysize: 256, esp_hmac: SHA96

ah_hmac: None, comp: IPCOMP_NONE, mode tunnel

IPv6 Crypto IKEv2 Session

cEdge-207#show crypto session detail

Crypto session current status

Code: C - IKE Configuration mode, D - Dead Peer Detection

K - Keepalives, N - NAT-traversal, T - cTCP encapsulation

X - IKE Extended Authentication, F - IKE Fragmentation

R - IKE Auto Reconnect, U - IKE Dynamic Route Update

S - SIP VPN

Interface: Virtual-Access1

Profile: RA-SDWAN-IKEV2-PROFILE

Uptime: 00:17:07

Session status: UP-ACTIVE

Peer: 192.168.10.219 port 62654 fvrf: (none) ivrf: 1

Phase1_id: *$AnyConnectClient$*

Desc: (none)

Session ID: 94

IKEv2 SA: local 192.168.10.218/4500 remote 192.168.10.219/62654 Active

Capabilities:DN connid:1 lifetime:23:42:53

IPSEC FLOW: permit ip 0.0.0.0/0.0.0.0 host 10.20.14.19

Active SAs: 2, origin: crypto map

Inbound:  #pkts dec'ed 89 drop 0 life (KB/Sec) 4607976/2573

Outbound: #pkts enc'ed 0 drop 0 life (KB/Sec) 4608000/2573

Related Information

- Cisco SD-WAN Remote Access

- Configure the FlexVPN Server

- Download AnyConnect

- Technical Support & Documentation - Cisco Systems