Anyconnect Asa
The latest version of Cisco AnyConnect Secure Mobility Client 4.8 is available for download. We will provide the direct download links of the Cisco AnyConnect software on this page. If you want to download a specific version, you can download it at the end of this article. Trusted Endpoints detection on Android does not rely on certificates, so there is no dependency on a specific AnyConnect app version. Familiarize yourself with the limitations of ASA SAML 2.0 authentication by reviewing the Use Single Sign-On with Clientless SSL VPN documentation in the Cisco ASA Series VPN CLI Configuration Guide. Dec 07, 2020 Cisco ASA with AnyConnect ASA SSL VPN using Duo Single Sign-On Choose this option for the best end-user experience for ASA with a cloud-hosted identity provider. With this SAML configuration, end users experience the interactive Duo Prompt when using the Cisco AnyConnect Client for VPN.
This post will try to help understand the differences between anyconnect premium and anyconnect essentials licenses.
For a more complete understanding of all of the licensing on the Cisco ASA see this post.
- Home Vpn En Asa. Cisco AnyConnect Secure Mobility VPN. If you report a problem with this VPN client to the helpdesk please mention you are using the AnyConnect Secure Mobility client.
- The AnyConnect client negotiates a tunnel with the AnyConnect server and gives you the ability to access resources or networks on or connected to the AnyConnect server (MX). Unlike the AnyConnect implementation on the ASA, with support for other features like host scan, web launch, etc, the MX security appliance supports SSL, VPN, and other.
Note: You cannot have both Essentials and Premium running at once.
Note: Cisco ASA 8.3+ no longer requires both the Active and Standby unit to each have a license. The active license is shared between the failover units. This should not be confused with the ‘shared premium license’.
Note: Cisco Secure Desktop is now deprecated. Cisco has stopped development for it.
Source of this image: Cisco’s Partner Education center – ASA Licensing Webex.
To enable AnyConnect essentials:
Purchase the license (L-ASA-AC-E-55xx= it costs $100-$500).
Anyconnect Asa Vpn
Apply the license to the ASA using the activation-key command. This does not require a reboot.
Apply the config:
Now your firewall will be licensed to have up to however many connections that are on the “Total VPN Connections”. For instance if your show version says this:
You will now be licensed to accommodate 250 anyconnect connectionns.
To enable AnyConnect Premium
Buy the license. You must purchase a license for a specific number of users (L-ASA-SSL-10= costs around $800).
Apply the license to the ASA using the activation-key command. This does not require a reboot.
Configure the ASA:
If you’ve already licensed this ASA for Essentials in the past then it will still show as an enabled license.
Once this is complete your ASA will be licensed to accept however many Anyconnect connections as you have Premium Licenses for. So if your show version looks like this:
Then your ASA can have 10 Anyconnect or webvpn users at once.
Note: The name “Anyconnect Premium” has changed a lot in different versions. Here are the different naming schemes.
- 7.1(1) known as “ssl vpn”
- 8.2(1) name changed to “anyconnect premium ssl vpn edition”
- 8.3(1) name changed to “anyconnect premium ssl vpn”
- 8.4(1) name changed to “anyconnect premium”
AnyConnect for Mobile
This license allows AnyConnect connections from mobile devices. There is current support for iPhone, iPad, Android version 4.0 and up, rooted Androids and Samsung Galaxy’s.
The mobile license is on or off and not tied to a number of users. It costs between $100-$500.
This license is applied by simply using the activation-key command. A reboot is not needed. There is no further configuration needed after that.
Advanced Endpoint Assessment
Advanced Endpoint Assessment includes all of the Endpoint Assessment features, and lets you configure an attempt to update noncompliant computers to meet version requirements.
This license is applied by simply using the activation-key command. A reboot is not needed.
Shared Premium License
New to ASA 8.3+ code is the ability to share licensing. This is only for Anyconnect Premium. It allows for one ASA to have a shared license which other ASAs can use.
This configuration requires two extra licenses. A license is needed for the shared server which indicates how many shared licenses there are and there also is a need for any participating ASAs.
Cisco Asa Vpn Configuration
After buying a shared participant license and applying it with the activation-key command, configure it with a command similar to this:
license-server address 10.15.0.15 secret SeKreTkey
The show version on the participant ASA will show this:
Now buy the shared premium license for the server for the amount of users you wish to have.
Apply the license using the activation-key command. Then apply the following config:
The show version at this point looks like this:
Also you can see the show shared license output:
If the license count isn’t going up when joining a shared pool here are a couple of other settings that may help you:
Anyconnect Asa Download
These two settings will limit how many sessions this host or the other hosts can use. This may be set already and limiting what is usable.