Scribd
Upload
16 views5 pages

SIMOS.4006.ASA.Clientless.SSL.VPN.Certificate.Authentication.v001

Uploaded by

minhlilili
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
16 views5 pages

SIMOS.4006.ASA.Clientless.SSL.VPN.Certificate.Authentication.v001

Uploaded by

minhlilili
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 5

CCNP Security – SIMOS

ASA Clientless SSL VPN Certificate


Authentication
CA Options
» Use ASA firewall as CA
• Client certificate enrollment can only be achieved through
dedicated internal web page
• SCEP is not supported
• Users authenticate in the web page via OTP (One-Time-
Password) generated by the ASA per user/certificate
• Issued to clients via e-mail or phone
» Use IOS router as CA
» Use other CA’s (Microsoft server CA)
Copyright © www.ine.com
ASA Additional Configuration Steps
» ASA needs to trust the CA that issued the client’s
certificate
• Import the CA’s certificate
» Optionally also enroll ASA with the same CA,
request a certificate
• The user can properly verify the identity of its VPN gateway
» Change the authentication method to certificate
• Under the tunnel-group
• Ideally use both certificate and username/password
Copyright © www.ine.com
Client Configuration Steps
» Import the CA’s certificate
» Request a certificate from the CA
• If using this certificate for AnyConnect sessions, read the
certificate requirements from Release Notes
» A certificate cannot just be used for all purposes
• This is restricted through Key Usage and Extended Key
usage certificate attributes
• For example CA’s certificate is only used for signing

Copyright © www.ine.com
Q&A

Copyright © www.ine.com All rights reserved.

You might also like