FTD Anyconnect Management VPN Tunnel
Summary:
From release 6.7, Cisco FTD supports configuration of AnyConnect Management tunnels.
The AnyConnect Management feature allows to create a VPN tunnel immediately after the endpoint finishes its startup. There is no need that the users manually launch the AnyConnect app, as soon as their system is powered up, the AnyConnect VPN agent service detects the Management VPN feature and initiates an AnyConnect session using theHost Entry defined in the Server List of the AnyConnect Management VPN Profile.
A management VPN tunnel ensures connectivity to the corporate network whenever the client system is powered up, not just when a VPN connection is established by the end-user. You can perform patch management on out-of-the-office endpoints, especially devices that are infrequently connected by the user, via VPN, to the office network. Endpoint OS login scripts that require corporate network connectivity also benefits from this feature.
AnyConnect Management Tunnel allows administrators to have AnyConnect connected without user intervention prior to the user log in. AnyConnect Management tunnel can work in conjunction with Trusted Network Detection and therefore is triggered only when the endpoint is off-premise and disconnected from User-initiated VPN. AnyConnect Management tunnel is transparent to the end-user and disconnects automatically when the user initiates VPN.
AnyConnect VPN agent service is automatically started upon system boot-up. It detects that the management tunnel feature is enabled (via the management VPN profile), therefore it launches the management client application to initiate a management tunnel connection. The management client application uses the host entry from the management VPN profile to initiate the connection. Then the VPN tunnel is established as usual, with one exception: no software update is performed during a management tunnel connection since the management tunnel is meant to be transparent to the user.
The user initiates a VPN tunnel via the AnyConnect UI, which triggers the management tunnel termination. Upon management tunnel termination, the user tunnel establishment continues as usual.
The user disconnects the VPN tunnel, which triggers the automatic re-establishment of the management tunnel
Configuration
A regular user VPN Connection Profile is already configured and working.
1. Create Management VPN Group Policy
2. Create Management-VPN connection profile
3. Create Management Tunnel Profile
4. Modify or create regular user Anyconnect Profile
5. Upload Management Tunnel profile and regular user profile to FMC
6. Attach Management Tunnel profile and regular user profile to the regular user VPN Group Policy
7. After user connects to user VPN tunnel, the management tunnel profile will be downloaded to the following folder and renamed to VpnMgmtTunProfile.xml.
C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client\Profile\MgmtTun
After user disconnects User Tunnel, Management Tunnel is automatically reconnected.
When the computer is back to office network
Reference:
https://www.cisco.com/c/en/us/support/docs/security/adaptive-security-appliance-asa-software/215442-configure-anyconnect-management-vpn-tunn.html
https://www.cisco.com/c/en/us/support/docs/security-vpn/secure-socket-layer-ssl/217040-configure-ssl-anyconnect-management-vpn.html
https://technook.home.blog/2019/07/11/cisco-anyconnect-managent-vpn-tunnel-microsoft-ca/
Comments
Post a Comment