HOWTO: Basic Cisco ASA AnyConnect VPN 8.2(5)

A while back I posted a how-to for configuring AnyConnect in ASA version 8.3+.  I recently received a request to post the 8.2(5) configuration, so here it is.  The example below uses split tunneling and local authentication.  For RADIUS authentication, see this post.

Before beginning, verify you have the AnyConnect essentials license (without this license, only two simultaneous sessions are permitted).

asa# sh ver | inc AnyConnect
AnyConnect Premium Peers          : 25             perpetual
AnyConnect Essentials             : 25             perpetual
AnyConnect for Mobile             : Enabled        perpetual
AnyConnect for Cisco VPN Phone    : Enabled        perpetual
asa#

The following steps configure an AnyConnect VPN between the 10.10.10.0/24 VPN subnet and 192.168.10.0/24 LAN subnet.

Step 1) Create ACL for split tunneling VPN traffic:

asa(config)# access-list SplitTunnelACL standard permit 192.168.10.0 255.255.255.0 
asa(config)# 

Step 2) Create IP pool for AnyConnect clients:

asa(config)# ip local pool AnyConnect-pool 10.10.10.1-10.10.10.254 mask 255.255.255.0 
asa(config)# 

Step 3) Configure NAT exemption (nonat)

asa(config)# access-list nonat extended permit ip 192.168.10.0 255.255.255.0 10.10.10.0 255.255.255.0 
asa(config)# nat (inside) 0 access-list nonat

Step 4) Enable webvpn on the outside interface, configure the ASA to web-deploy the AnyConnect client, and enable AnyConnect:

asa(config)# webvpn 
asa(config-webvpn)# enable outside 
INFO: WebVPN and DTLS are enabled on 'outside'. 
asa(config-webvpn)# svc image disk0:/anyconnect-win-3.1.05152-k9.pkg 1 
asa(config-webvpn)# svc image disk0:/anyconnect-macosx-i386-3.1.05152-k9.pkg 2 
asa(config-webvpn)# svc image disk0:/anyconnect-linux-64-3.1.05152-k9.pkg 3 
asa(config-webvpn)# svc image disk0:/anyconnect-linux-3.1.05152-k9.pkg 4 
asa(config-webvpn)# svc enable 
asa(config-webvpn)# exit 
asa(config)#

Step 5) Configure a group-policy:

asa(config)# group-policy AnyConnect-policy internal 
asa(config)# group-policy AnyConnect-policy attributes 
asa(config-group-policy)#  dns-server value 8.8.8.8 
asa(config-group-policy)#  vpn-tunnel-protocol svc webvpn 
asa(config-group-policy)#  split-tunnel-policy tunnelspecified 
asa(config-group-policy)#  split-tunnel-network-list value SplitTunnelACL 
asa(config-group-policy)#  default-domain value cloud10solutions.local 
asa(config-group-policy)#  address-pools value AnyConnect-pool 
asa(config-group-policy)# exit 
asa(config)# 

Step 6) Apply address-pool and group-policy to tunnel-group (in this case, the DefaultWEBVPNGroup) 

asa(config)# tunnel-group DefaultWEBVPNGroup general-attributes 
asa(config-tunnel-general)# address-pool AnyConnect-pool 
asa(config-tunnel-general)# default-group-policy AnyConnect-policy 
asa(config-tunnel-general)# exit 
asa(config)# 

Step 7) If using local authentication, create local users for remote access:

asa(config)# username vpnuser password p@ssw0rd
asa(config)# username vpnuser attributes
asa(config-username)# service-type remote-access
asa(config-username)# exit
asa(config)#

You should now be able to connect to your AnyConnect VPN:

asa# sh vpn-sessiondb 
--------------------------------------------------------------------------- 
VPN Session Summary 
--------------------------------------------------------------------------- 
                               Active : Cumulative : Peak Concur : Inactive 
                             ----------------------------------------------

AnyConnect Client            :      1 :          1 :           1 :        0 
  SSL/TLS/DTLS               :      1 :          1 :           1 :        0 
--------------------------------------------------------------------------- 
Total Active and Inactive    :      1             Total Cumulative :      1 
Device Total VPN Capacity    :     25 
Device Load                  :     4% 
--------------------------------------------------------------------------- 



--------------------------------------------------------------------------- 
Tunnels Summary 
--------------------------------------------------------------------------- 
                               Active : Cumulative : Peak Concurrent 
                             ---------------------------------------------- 
AnyConnect-Parent            :      1 :          1 :               1 
SSL-Tunnel                   :      1 :          1 :               1 
DTLS-Tunnel                  :      1 :          1 :               1 
--------------------------------------------------------------------------- 
Totals                       :      3 :          3 
--------------------------------------------------------------------------- 

asa#