Using a web browser, open https://ravpn-address , where ravpn-address is the IP address or hostname of the outside interface on which you are allowing VPN connections.

Log into the site.

Configure the remote access VPN connection profile.

1. Click Device, then click Setup Connection Profile in the Remote Access VPN group. (Click View Configuration if you already configured a profile).

   For existing connections, click Edit to modify the profile.

2. Configure the connection profile settings:

   • Connection Profile Name—Enter a name, for example, Corporate-RAVPN.

   • AD Realm/Directory Server for User Authentication—Select the identity realm used for authenticating remote users. If you have not already configured one, click Create New Identity Realm at the bottom of the drop-down list and create it now.

   • AnyConnect Packages—Upload AnyConnect Clients for each operating system you will support. Wait for the upload to complete before continuing.

   The connection profile settings should look similar to the following:

   
   

   

   
   

3. Click Next, then configure the device identity properties:

   • Certificate of Device Identity—Select the internal certificate used to establish the identity of the device. Clients must accept this certificate to complete a secure VPN connection. You can use the DefaultInternalCertificate if you do not have your own.

   • Outside Interface—Select your outside interface, to which remote users will connect. This interface is normally named “outside.”

   • Fully-qualified Domain Name for the Outside Interface—If you have a DNS name for the outside interface, enter it here. For example, corporate-vpn.example.com.

   The device identity section of the page might look like the following:

   
   

   

   
   

4. Continue down the page and configure the IPv4 Address Pool and optionally, the IPv6 Address Pool.

   Select an object that identifies a network. Remote access VPN users are assigned an address from this pool. For example, a network object that specifies 10.1.10.0/24. If the object does not already exist, click Create New Network at the bottom of the list. Also configure a pool for IPv6 if you support those addresses.

   
   

   

   
   

5. Scroll down the page and configure the DNS settings for remote connections.

   Enter the IP addresses of the DNS servers you use, and your local domain name, for example, example.com. You can click OpenDNS to use the Open DNS servers.

   
   

   

   
   

6. Click Next, scroll down, and configure the Corporate Resource options.

   (You can also configure the banner, connection time and timeout, and proxy settings, but these are not directly related to hair pinning.)

   The following settings are critical to making hair pinning possible in the remote access VPN.

   • Split Tunneling—Disable this feature. You want all traffic to go to the VPN gateway, whereas split tunneling is a way to allow remote clients to directly access local or Internet sites outside of the VPN.

   • NAT Exempt—Enable this feature. Select the inside interface, then select a network object that defines the internal networks. In this example, the object should specify 192.168.1.0/24. RA VPN traffic going to the internal network will not get address translation. However, because hair-pinned traffic is going out the outside interface, it will still be NAT’ed because the NAT exemption applies to the inside interface only.

   
   

   

   
   

7. Optionally, select an AnyConnect Client Profile, then click Next.

8. Review the RA VPN configuration, then click Finish.

Configure the NAT rule to translate all connections going out the outside interface to ports on the outside IP address (interface PAT).

1. Click Policies > NAT.

2. Do one of the following:

   • To edit the InsideOutsideNatRule, mouse over the Action column and click the edit icon ().

   • To create a new rule, click +.

3. Configure a rule with the following properties:

   • Title—For a new rule, enter a meaningful name without spaces. For example, OutsideInterfacePAT.

   • Create Rule For—Manual NAT.

   • Placement—Before Auto NAT Rules (the default).

   • Type—Dynamic.

   • Original Packet—For Source Address, select either Any or any-ipv4. For Source Interface, ensure that you select Any (which is the default). For all other Original Packet options, keep the default, Any.

   • Translated Packet—For Destination Interface, select outside. For Translated Address, select Interface. For all other Translated Packet options, keep the default, Any.

   The following graphic shows the simple case where you select Any for the source address.

   
   

   

   
   

4. Click OK.

Commit your changes.

1. Click the Deploy Changes icon in the upper right of the web page.

   

2. Click the Deploy Now button.

   Wait for deployment to finish. The deployment summary should indicate that you have successfully deployed your changes, and the task status for the job should be Deployed.

Configure the site-to-site VPN connection on Site B, which hosts the directory server.

1. Click Device, then click View Configuration in the Site-to-Site VPN group.

2. Click the + button.

3. Configure the following options for Endpoint Settings.

   • Connection Profile Name—Enter a name, for example, SiteA (to indicate that the connection is to Site A).

   • Local Site—These options define the local endpoint.

     • Local VPN Access Interface—Select the outside interface (the one with the 192.168.2.1 address in the diagram).

     • Local Network—Click + and select the network object that identifies the local network that should participate in the VPN connection. Because the directory server is on this network, it can participate in the site-to-site VPN. Assuming that the object does not already exist, click Create New Network and configure an object for the 192.168.1.0/24 network. After saving the object, select it in the drop-down list and click OK.

       
       

       

       
       

   • Remote Site—These options define the remote endpoint.

     • Remote IP Address—Enter 192.168.4.6, which is the IP address of the remote VPN peer's interface that will host the VPN connection.

     • Remote Network—Click + and select the network objects that identify the remote networks that should participate in the VPN connection. Click Create New Network, configure the following objects, then select them in the list.

       1. SiteAInside, Network, 192.168.3.0/24.

          
          

          

          
          

       2. SiteAInterface, Host, 192.168.4.6. This is key: you must include the remote access VPN connection point address as part of the remote network for the site-to-site VPN connection so that the RA VPN hosted on that interface can use the directory server.

          
          

          

          
          

   When you are finished, the endpoint settings should look like the following:

   
   

   

   
   

4. Click Next.

5. Define the privacy configuration for the VPN.

   For this use case, we assume you qualify for export controlled features, which allows the use of strong encryption. Adjust these example settings to meet your needs and your license compliance.

   • IKE Version 2, IKE Version 1—Keep the defaults, IKE Version 2 enabled, IKE Version 1 disabled.

   • IKE Policy—Click Edit and enable AES-GCM-NULL-SHA and AES-SHA-SHA, and disable DES-SHA-SHA.

   • IPsec Proposal—Click Edit. In the Select IPSec Proposals dialog box, click +, then click Set Default to choose the default AES-GCM proposals.

   • Local Preshared Key, Remote Peer Preshared Key—Enter the keys defined on this device and on the remote device for the VPN connection. These keys can be different in IKEv2. The key can be 1-127 alphanumeric characters. Remember these keys, because you must configure the same strings when creating the site-to-site VPN connection on the Site A device.

   The IKE policy should look like the following:

   
   

   

   
   

6. Configure the Additional Options.

   • NAT Exempt—Select the interface that hosts the inside network, in this example, the inside interface. Typically, you do not want traffic within a site-to-site VPN tunnel to have their IP addresses translated. This option works only if the local network resides behind a single routed interface (not a bridge group member). If the local network is behind more than one routed interface, or one or more bridge group members, you must manually create the NAT exempt rules. For information on manually creating the required rules, see Exempting Site-to-Site VPN Traffic from NAT.

   • Diffie-Helman Group for Perfect Forward Secrecy—Select Group 19. This option determines whether to use Perfect Forward Secrecy (PFS) to generate and use a unique session key for each encrypted exchange. The unique session key protects the exchange from subsequent decryption, even if the entire exchange was recorded and the attacker has obtained the preshared or private keys used by the endpoint devices. For an explanation of the options, see Deciding Which Diffie-Hellman Modulus Group to Use.

   The options should look like the following.

   
   

   

   
   

7. Click Next.

8. Review the summary and click Finish.

   The summary information is copied to the clipboard. You can paste the information in a document and use it to help you configure the remote peer, or to send it to the party responsible for configuring the peer.

9. Click the Deploy Changes icon in the upper right of the web page.

   

10. Click the Deploy Now button and wait for deployment to complete successfully.

    Now the Site B device is ready to host one end of the site-to-site VPN connection.

Log out of the Site B device and log into the Site A device.

Configure the site-to-site VPN connection on Site A, which will host the remote access VPN.

1. Click Device, then click View Configuration in the Site-to-Site VPN group.

2. Click the + button.

3. Configure the following options for Endpoint Settings.

   • Connection Profile Name—Enter a name, for example, SiteB (to indicate that the connection is to Site B).

   • Local Site—These options define the local endpoint.

     • Local VPN Access Interface—Select the outside interface (the one with the 192.168.4.6 address in the diagram).

     • Local Network—Click + and select the network objects that identify the local networks that should participate in the VPN connection. Click Create New Network, configure the following objects, then select them in the list. Note that you created the same objects in the Site B device, but you have to create them again in the Site A device.

       1. SiteAInside, Network, 192.168.3.0/24.

          
          

          

          
          

       2. SiteAInterface, Host, 192.168.4.6. This is key: you must include the remote access VPN connection point address as part of the inside network for the site-to-site VPN connection so that the RA VPN hosted on that interface can use the directory server on the remote network.

          
          

          

          
          

   • Remote Site—These options define the remote endpoint.

     • Remote IP Address—Enter 192.168.2.1, which is the IP address of the remote VPN peer's interface that will host the VPN connection.

     • Remote Network—Click + and select the network object that identifies the remote network that should participate in the VPN connection, the one that includes the directory server. Click Create New Network and configure an object for the 192.168.1.0/24 network. After saving the object, select it in the drop-down list and click OK. Note that you created the same object in the Site B device, but you have to create it again in the Site A device.

       
       

       

       
       

   When you are finished, the endpoint settings should look like the following. Notice that the local/remote networks are flipped compared to the Site B settings. This is how the two ends of a point-to-point connection should always look.

   
   

   

   
   

4. Click Next.

5. Define the privacy configuration for the VPN.

   Configure the same IKE version, policy, and IPsec proposal, and the same preshared keys, as you did for the Site B connection, but make sure that you reverse the Local and Remote preshared keys.

   The IKE policy should look like the following:

   
   

   

   
   

6. Configure the Additional Options.

   • NAT Exempt—Select the interface that hosts the inside network, in this example, the inside interface. Typically, you do not want traffic within a site-to-site VPN tunnel to have their IP addresses translated. This option works only if the local network resides behind a single routed interface (not a bridge group member). If the local network is behind more than one routed interface, or one or more bridge group members, you must manually create the NAT exempt rules. For information on manually creating the required rules, see Exempting Site-to-Site VPN Traffic from NAT.

   • Diffie-Helman Group for Perfect Forward Secrecy—Select Group 19.

   The options should look like the following.

   
   

   

   
   

7. Click Next.

8. Review the summary and click Finish.

9. Click the Deploy Changes icon in the upper right of the web page.

   

10. Click the Deploy Now button and wait for deployment to complete successfully.

    Now the Site A device is ready to host the other end of the site-to-site VPN connection. Because Site B is already configured with compatible settings, the two devices should negotiate a VPN connection.

    You can confirm the connection by logging into the device CLI and pinging the directory server. You can also use the show ipsec sa command to view the session information.

Configure the directory server on Site A. Click Test to verify that there is a connection.

1. Select Objects, then select Identity Realm from the table of contents.

2. Click the + button.

3. Configure the basic realm properties.

   • Name—A name for the directory realm. For example, AD.

   • Type—The type of directory server. Active Directory is the only supported type, and you cannot change this field.

   • Directory Username, Directory Password—The distinguished username and password for a user with appropriate rights to the user information you want to retrieve. For Active Directory, the user does not need elevated privileges. You can specify any user in the domain. The username must be fully qualified; for example, Administrator@example.com (not simply Administrator).

     Note

     The system generates ldap-login-dn and ldap-login-password from this information. For example, Administrator@example.com is translated as cn=adminisntrator,cn=users,dc=example,dc=com. Note that cn=users is always part of this translation, so you must configure the user you specify here under the common name “users” folder.

   • Base DN—The directory tree for searching or querying user and group information, that is, the common parent for users and groups. For example, cn=users,dc=example,dc=com. For information on finding the base DN, see Determining the Directory Base DN.

   • AD Primary Domain— The fully qualified Active Directory domain name that the device should join. For example, example.com.

   
   

   

   
   

4. Configure the directory server properties.

   • Hostname/IP Address—The hostname or IP address of the directory server. If you use an encrypted connection to the server, you must enter the fully-qualified domain name, not the IP address. For this example, enter 192.168.1.175.

   • Port—The port number used for communications with the server. The default is 389. Use port 636 if you select LDAPS as the encryption method. For this example, keep 389.

   • Encryption—To use an encrypted connection for downloading user and group information. The default is None, which means that user and group information is downloaded in clear text. For RA VPN, you can use LDAPS, which is LDAP over SSL. Use port 636 if you select this option. RA VPN does not support STARTTLS. For this example, select None.

   • Trusted CA Certificate—If you select an encryption method, upload a Certificate Authority (CA) certificate to enable a trusted connection between the system and the directory server. If you are using a certificate to authenticate, the name of the server in the certificate must match the server Hostname / IP Address. For example, if you use 192.168.1.175 as the IP address but ad.example.com in the certificate, the connection fails.

   
   

   

   
   

5. Click the Test button to verify the system can contact the server.

   The system uses separate processes to access the server, so you might get errors indicating that the connection works for one type of use but not another, for example, available for Identity policies but not for remote access VPN. If the server cannot be reached, verify that you have the right IP address and host name, that the DNS server has an entry for the hostname, and so forth. Also, verify that the site-to-site VPN connection is working and that you included Site A's outside interface address in the VPN, and that NAT is not translating traffic for the directory server. You might also need to configure a static route for the server.

6. Click OK.

Click Device > Smart License > View Configuration, and enable the RA VPN license.

When enabling the RA VPN license, select the type of license you purchased: Plus, Apex (or both), or VPN Only. For more information, see Licensing Requirements for Remote Access VPN.

Configure the remote access VPN on Site A.

1. Click Device, then click Setup Connection Profile in the Remote Access VPN group.

2. Define the AnyConnect client configuration.

   • Connection Profile Name—The name for this connection, up to 50 characters without spaces. For example, MainOffice. You cannot use an IP address as the name.

     Note	The name you enter here is what users will see in the connection list in the AnyConnect client. Choose a name that will make sense to your users.

   • AD Realm/Directory Server for User Authentication—Select the directory realm.

   • AnyConnect Packages—The AnyConnect full installation software images that you will support on this VPN connection. For each package, the filename, including extensions, can be no more than 60 characters. You can upload separate packages for Windows, Mac, and Linux endpoints.

     Download the packages from software.cisco.com (there is a link to the right location at the end of the page). If the endpoint does not already have the right package installed, the system prompts the user to download and install the package after the user authenticates.

   
   

   

   
   

3. Click Next.

4. Define the device identity and client addressing configuration.

   • Certificate of Device Identity—Select DefaultInternalCertificate. This is the internal certificate used to establish the identity of the device. Clients must accept this certificate to complete a secure VPN connection. If you have a different certificate that you want use, click Create New Internal Certificate in the drop-down list and upload it.

   • Outside Interface—Select outside, the one with the 192.168.4.6 IP address. This is the interface to which users connect when making the remote access VPN connection.

     
     

     

     
     

   • Fully-qualified Domain Name for the Outside Interface—The name of the interface, for example, ravpn.example.com. If you specify a name, the system can create a client profile for you. For this example, we will leave it blank.

     Note	You are responsible for ensuring that the DNS servers used in the VPN and by clients can resolve this name to the outside interface's IP address. Add the FQDN to the relevant DNS servers.

   • IPv4, IPv6 Address Pools—These options define the address pools for the remote endpoints. For this example, select Create New Network in the IPv4 address pool and create an object for the 172.18.1.0/24 network, then select the object. Clients are assigned an address from this pool. Leave the IPv6 pool blank. The address pool cannot be on the same subnet as the IP address for the outside interface.

     The object should look like the following:

     
     

     

     
     

     The pool specification should look like the following:

     
     

     

     
     

   • Primary, Secondary DNS Servers—For this example, click the OpenDNS button to load these fields with the OpenDNS public DNS servers. RA VPN clients use these DNS servers clients for domain name resolution when connected to the VPN. Optionally, enter the IP addresses of your DNS servers.

   • Domain Search Name—Enter the domain name for your network, e.g. example.com. This domain is added to hostnames that are not fully-qualified, for example, serverA instead of serverA.example.com.

     
     

     

     
     

5. Click Next.

6. Define the connection settings to customize AnyConnect client behavior.

   Keep the default settings for all options, as they are appropriate for most networks.

   Because NAT Exempt is selected, you need to configure the following options:

   • Inside Interfaces—Select the inside interface. These are the interfaces for the internal networks remote users will be accessing. NAT rules are created for these interfaces.

   • Inside Networks—Select the SiteAInside network object. These are the network objects that represent internal networks remote users will be accessing.

   
   

   

   
   

7. Click Next.

8. Review the summary.

   First, verify that the summary is correct.

   Then, click Instructions to see what end users need to do to initially install the AnyConnect software and test that they can complete a VPN connection. Click Copy to copy these instructions to the clipboard, and paste them in a text file or email.

9. Click Finish.

Click the Deploy Changes icon in the upper right of the web page.

Click the Deploy Now button and wait for deployment to complete successfully.

Upload the image files to each FTD device that is acting as an RA VPN headend that should use the customized icons and logos.

1. Log into the device CLI using an SSH client.

2. In the CLI, enter the system support diagnostic-cli command to enter diagnostic CLI mode.

   
   > system support diagnostic-cli
   Attaching to Diagnostic CLI ... Press 'Ctrl+a then d' to detach.
   Type help or '?' for a list of available commands.
   
   ftdv1>
   

   Note	Read the message! You must press Ctrl+a, then d, to get out of the diagnostic CLI and back into the normal FTD CLI mode.

3. Note the command prompt. The normal CLI uses > only, whereas the diagnostic CLI’s user EXEC mode uses the hostname plus >. In this example, ftdv1>. You need to get into privileged EXEC mode, which uses # as the ending character, for example, ftdv1#. If your prompt already has #, skip this step. Otherwise, enter the enable command, and simply press Enter at the password prompt without entering a password.

   
   ftdv1> enable
   Password:
   ftdv1#
   

4. Use the copy command to copy each file from the hosting server to the FTD device’s disk0. You can place them in a subdirectory, such as disk0:/anyconnect-images/. You can create a new folder using the mkdir command.

   For example, if the TFTP server’s IP address is 10.7.0.80, and you want to create a new directory, the commands would be similar to the following. Note that responses to the copy command are omitted after the first example.

   
   ftdv1# mkdir disk0:anyconnect-images 
   
   Create directory filename [anyconnect-images]? yes 
   
   Created dir disk0:/anyconnect-images
   
   ftdv1# copy /noconfirm tftp://10.7.0.80/app_logo.png 
   disk0:/anyconnect-images/app_logo.png 
   
   Accessing tftp://10.7.0.80/app_logo.png...!!!!!!
   Writing file disk0:/anyconnect-images/app_logo.png...
   !!!!!!
   12288 bytes copied in 1.000 secs (12288 bytes/sec)
   
   ftdv1# copy /noconfirm tftp://10.7.0.80/company_logo.png 
   disk0:/anyconnect-images/company_logo.png 
   ftdv1# copy /noconfirm tftp://10.7.0.80/company_logo_alt.png 
   disk0:/anyconnect-images/company_logo_alt.png 
   

Use the import webvpn command in the diagnostic CLI to instruct the AnyConnect Client to download these images when installing itself on client machines.

ftdv1# import webvpn AnyConnect-customization type resource platform win 
name app_logo.png disk0:/anyconnect-images/app_logo.png 

ftdv1# import webvpn AnyConnect-customization type resource platform win 
name company_logo.png disk0:/anyconnect-images/company_logo.png 

ftdv1# import webvpn AnyConnect-customization type resource platform win 
name company_logo_alt.png disk0:/anyconnect-images/company_logo_alt.png 

Verify the configuration: