WEBVTT

1
00:00.000 --> 00:01.268 align:middle line:84%


2
00:01.268 --> 00:03.310 align:middle line:90%
One of the problems that
we've had over the years

3
00:03.310 --> 00:05.500 align:middle line:90%
is how do we get the
AnyConnect client,

4
00:05.500 --> 00:07.070 align:middle line:90%
or before that the
VPN client, how

5
00:07.070 --> 00:09.148 align:middle line:90%
do we get a software
client installed on the PC

6
00:09.148 --> 00:11.690 align:middle line:90%
if we're not using the native
client on the operating system.

7
00:11.690 --> 00:16.810 align:middle line:90%
The answer is now is hit a URL
and it downloads the client

8
00:16.810 --> 00:17.680 align:middle line:84%
and installs it.

9
00:17.680 --> 00:19.878 align:middle line:90%
And also, what we do
is we can have updates

10
00:19.878 --> 00:20.920 align:middle line:84%
that happen that way too.

11
00:20.920 --> 00:23.230 align:middle line:90%
A client is using the
AnyConnect software client,

12
00:23.230 --> 00:26.270 align:middle line:90%
they connect, it detected
they're using an older version

13
00:26.270 --> 00:28.190 align:middle line:90%
and it downloads the new
one and away they go.

14
00:28.190 --> 00:29.980 align:middle line:90%
Now, besides just
having the software

15
00:29.980 --> 00:34.000 align:middle line:90%
it's also really handy to
spoon-feed users on here's
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

15
00:29.980 --> 00:34.000 align:middle line:90%
it's also really handy to
spoon-feed users on here's

16
00:34.000 --> 00:35.560 align:middle line:84%
exactly how to use it.

17
00:35.560 --> 00:38.410 align:middle line:90%
And a really great way to
do that with AnyConnect

18
00:38.410 --> 00:40.648 align:middle line:90%
is to give them a profile
that they just click

19
00:40.648 --> 00:41.815 align:middle line:84%
on that has all the details.

20
00:41.815 --> 00:44.620 align:middle line:90%
It has details about the
server to connect to,

21
00:44.620 --> 00:47.080 align:middle line:90%
the encryption
algorithms to use,

22
00:47.080 --> 00:49.570 align:middle line:90%
the backup servers to use if
their primary wasn't there.

23
00:49.570 --> 00:52.240 align:middle line:90%
We can have a built
as part of a profile

24
00:52.240 --> 00:54.137 align:middle line:84%
and deployed to the client.

25
00:54.137 --> 00:56.470 align:middle line:90%
So, in this video I'd like
to demonstrate the AnyConnect

26
00:56.470 --> 00:59.560 align:middle line:90%
profile editor that we can
use to create these profiles

27
00:59.560 --> 01:01.850 align:middle line:84%
that then our users can use.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

27
00:59.560 --> 01:01.850 align:middle line:84%
that then our users can use.

28
01:01.850 --> 01:03.910 align:middle line:90%
So, here's the Cisco
AnyConnect client right here

29
01:03.910 --> 01:06.920 align:middle line:90%
and this is the
VPN profile editor.

30
01:06.920 --> 01:09.100 align:middle line:90%
You can download it
separately from Cisco

31
01:09.100 --> 01:11.520 align:middle line:90%
to go ahead and create
and modify the profiles.

32
01:11.520 --> 01:13.943 align:middle line:90%
So, I'm just going to launch
the VPN profile editor

33
01:13.943 --> 01:16.360 align:middle line:90%
and here you simply specify
the details that you want you.

34
01:16.360 --> 01:18.318 align:middle line:90%
Do you want to prompt
the user before starting,

35
01:18.318 --> 01:20.620 align:middle line:90%
do you want the auto-connect
on startup, what

36
01:20.620 --> 01:21.950 align:middle line:84%
do you want to have happen.

37
01:21.950 --> 01:24.550 align:middle line:90%
And so you can specify, for
example, the server list,

38
01:24.550 --> 01:26.170 align:middle line:90%
you say I want to
add some servers.

39
01:26.170 --> 01:30.370 align:middle line:90%
So, we can specify the display
name like primary VPN servers,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

39
01:26.170 --> 01:30.370 align:middle line:90%
So, we can specify the display
name like primary VPN servers,

40
01:30.370 --> 01:32.290 align:middle line:90%
this is what the user
would see, and then

41
01:32.290 --> 01:34.457 align:middle line:90%
to support that you'd put
the fully qualified domain

42
01:34.457 --> 01:37.470 align:middle line:90%
name, which would be resolvable
via DNS with the IP address.

43
01:37.470 --> 01:39.880 align:middle line:90%
In my lab we're
going to use this.

44
01:39.880 --> 01:43.070 align:middle line:90%
And then if we're using IPsec,
this is really important,

45
01:43.070 --> 01:45.190 align:middle line:90%
we would go up here to
the primary protocol

46
01:45.190 --> 01:48.370 align:middle line:90%
and say, I don't want to
use SSL, I want use IPsec.

47
01:48.370 --> 01:50.500 align:middle line:90%
Remove the checkbox
next to ASA gateway

48
01:50.500 --> 01:52.640 align:middle line:90%
if you're not using
that and then by default

49
01:52.640 --> 01:55.452 align:middle line:90%
it's going to use EAP
AnyConnect as the authentication

50
01:55.452 --> 01:57.910 align:middle line:90%
method, which is what we have
our headend server configured

51
01:57.910 --> 01:58.490 align:middle line:84%
for.

52
01:58.490 --> 02:03.050 align:middle line:90%
Then we click on OK, and then
click on file, click on save,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

52
01:58.490 --> 02:03.050 align:middle line:90%
Then we click on OK, and then
click on file, click on save,

53
02:03.050 --> 02:04.480 align:middle line:84%
and let me show you where--

54
02:04.480 --> 02:06.100 align:middle line:90%
let me show you
where on Windows this

55
02:06.100 --> 02:07.720 align:middle line:90%
is kept because
that's important too.

56
02:07.720 --> 02:10.270 align:middle line:90%
So, your VPN client,
your AnyConnect client,

57
02:10.270 --> 02:13.390 align:middle line:90%
it's going to go to this
location, this PC, local C

58
02:13.390 --> 02:17.770 align:middle line:90%
drive, program data, Cisco,
and then the Cisco AnyConnect

59
02:17.770 --> 02:21.168 align:middle line:90%
secure mobility client, and
then the profile folder.

60
02:21.168 --> 02:22.710 align:middle line:90%
And that's where
it's going to look--

61
02:22.710 --> 02:24.370 align:middle line:90%
[LAUGHTER]---- these
profiles I made.

62
02:24.370 --> 02:25.780 align:middle line:90%
That was me just playing
around with a whole bunch

63
02:25.780 --> 02:28.370 align:middle line:90%
of different profiles having
fun with the profile editor.

64
02:28.370 --> 02:31.960 align:middle line:90%
So, we could save this, give
it a name, I'll call this 10,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

64
02:28.370 --> 02:31.960 align:middle line:90%
So, we could save this, give
it a name, I'll call this 10,

65
02:31.960 --> 02:34.395 align:middle line:90%
click on save, and
then if our clients use

66
02:34.395 --> 02:36.020 align:middle line:90%
that profile it's
going to connect them

67
02:36.020 --> 02:39.550 align:middle line:90%
to this server with
the protocol of IPsec

68
02:39.550 --> 02:41.000 align:middle line:84%
as opposed to using SSL.

69
02:41.000 --> 02:43.720 align:middle line:90%
That's all baked
into the profile.

70
02:43.720 --> 02:45.820 align:middle line:90%
And one other element I
want to talk about also

71
02:45.820 --> 02:49.840 align:middle line:90%
is under preferences it has
an option for Windows VPN

72
02:49.840 --> 02:52.000 align:middle line:84%
establishment local users only.

73
02:52.000 --> 02:54.940 align:middle line:90%
Allow remote users is
going to be helpful

74
02:54.940 --> 02:57.880 align:middle line:90%
if you are trying to launch
this in a lab environment

75
02:57.880 --> 02:59.840 align:middle line:84%
from a remote desktop session.

76
02:59.840 --> 03:02.530 align:middle line:90%
In fact, what I
ended up doing was
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

76
02:59.840 --> 03:02.530 align:middle line:90%
In fact, what I
ended up doing was

77
03:02.530 --> 03:04.960 align:middle line:90%
I spent a lot of time with it
like why isn't this working.

78
03:04.960 --> 03:06.970 align:middle line:90%
I finally ended
up just using VNC

79
03:06.970 --> 03:08.840 align:middle line:90%
to my little virtual
machine here,

80
03:08.840 --> 03:10.960 align:middle line:90%
and then running the
AnyConnect client.

81
03:10.960 --> 03:12.760 align:middle line:90%
Just as a heads up,
if you're running

82
03:12.760 --> 03:16.678 align:middle line:90%
AnyConnect from an existing RDP
session, there's going to be--

83
03:16.678 --> 03:18.970 align:middle line:90%
there's going to be challenges
and that box right there

84
03:18.970 --> 03:21.400 align:middle line:90%
is one of them that
you'd want to turn on

85
03:21.400 --> 03:24.700 align:middle line:90%
if you want AnyConnect to have
a chance of working from an RDP

86
03:24.700 --> 03:26.865 align:middle line:90%
session on the machine
you're looking at.

87
03:26.865 --> 03:28.240 align:middle line:90%
And the good news
is your clients

88
03:28.240 --> 03:29.830 align:middle line:90%
won't have to worry about that
because your clients won't

89
03:29.830 --> 03:32.250 align:middle line:90%
be at those computers,
they won't be RDP'd
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

89
03:29.830 --> 03:32.250 align:middle line:90%
be at those computers,
they won't be RDP'd

90
03:32.250 --> 03:34.010 align:middle line:84%
in to their own computers.

91
03:34.010 --> 03:35.968 align:middle line:90%
And I want to share with
you this little Nugget

92
03:35.968 --> 03:39.720 align:middle line:90%
I found from Cisco.com
and that is right here.

93
03:39.720 --> 03:41.650 align:middle line:90%
This would have saved
me about an hour

94
03:41.650 --> 03:43.030 align:middle line:84%
if I'd found it earlier.

95
03:43.030 --> 03:45.340 align:middle line:90%
It said you must disable
the function manually,

96
03:45.340 --> 03:48.395 align:middle line:90%
the function of
bypass downloader,

97
03:48.395 --> 03:50.020 align:middle line:90%
you must disable this
function manually

98
03:50.020 --> 03:53.470 align:middle line:90%
by setting the bypass
downloader value to false,

99
03:53.470 --> 03:55.090 align:middle line:84%
else the connection will fail.

100
03:55.090 --> 03:57.010 align:middle line:90%
That's if your device
doesn't support SSL.

101
03:57.010 --> 04:02.350 align:middle line:90%
So, because we are using IPsec
VPNs in a FlexVPN scenario,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

101
03:57.010 --> 04:02.350 align:middle line:90%
So, because we are using IPsec
VPNs in a FlexVPN scenario,

102
04:02.350 --> 04:03.590 align:middle line:84%
we need to turn that off.

103
04:03.590 --> 04:05.340 align:middle line:90%
So, let me show you
exactly where that is.

104
04:05.340 --> 04:08.020 align:middle line:90%
So, I'm going to open up file
explorer on this Windows 10

105
04:08.020 --> 04:11.230 align:middle line:90%
client and I'm going to the
path of Cisco AnyConnect

106
04:11.230 --> 04:12.467 align:middle line:84%
secure mobility client.

107
04:12.467 --> 04:14.800 align:middle line:90%
So, the profiles folders is
where the profiles are kept.

108
04:14.800 --> 04:17.498 align:middle line:90%
We just saved that one called
10, but what we want to do

109
04:17.498 --> 04:20.019 align:middle line:90%
is for the local policy
we want to go right here.

110
04:20.019 --> 04:23.350 align:middle line:90%
So, AnyConnect local policy,
it's an XML Document,

111
04:23.350 --> 04:25.870 align:middle line:90%
if we right-click
and click on edit,

112
04:25.870 --> 04:28.510 align:middle line:90%
here's the bypass
downloader option

113
04:28.510 --> 04:31.670 align:middle line:90%
and I set mine to true
to get this to work.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

113
04:28.510 --> 04:31.670 align:middle line:90%
and I set mine to true
to get this to work.

114
04:31.670 --> 04:33.340 align:middle line:90%
Now, there is also
a tool that we

115
04:33.340 --> 04:35.990 align:middle line:90%
could use to modify
that if we didn't want

116
04:35.990 --> 04:37.330 align:middle line:84%
to use a text editor there.

117
04:37.330 --> 04:39.170 align:middle line:90%
Also, I had some
rights issues too.

118
04:39.170 --> 04:41.920 align:middle line:90%
So, I had to go
into the file system

119
04:41.920 --> 04:44.020 align:middle line:90%
and give myself
permission so I could

120
04:44.020 --> 04:46.410 align:middle line:90%
modify that file
because by default it

121
04:46.410 --> 04:48.910 align:middle line:90%
didn't give me the rights to
actually tweak it or modify it.

122
04:48.910 --> 04:51.470 align:middle line:90%
I could open it up and
edit it, but not save it.

123
04:51.470 --> 04:54.190 align:middle line:90%
So, the other tool we
could use to modify that

124
04:54.190 --> 04:56.860 align:middle line:90%
is this bad boy
right here, which

125
04:56.860 --> 05:01.100 align:middle line:90%
is the VPN local policy editor,
also available from Cisco.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

125
04:56.860 --> 05:01.100 align:middle line:90%
is the VPN local policy editor,
also available from Cisco.

126
05:01.100 --> 05:03.650 align:middle line:90%
And what this does, it
gives you a nice easier way

127
05:03.650 --> 05:04.490 align:middle line:84%
of modifying that.

128
05:04.490 --> 05:06.170 align:middle line:90%
So, right here,
bypass downloader,

129
05:06.170 --> 05:09.300 align:middle line:90%
you just check that if you
want to bypass the downloader.

130
05:09.300 --> 05:12.030 align:middle line:90%
The files save and that'll
be yet another way to do it.

131
05:12.030 --> 05:14.870 align:middle line:90%
So, with some profiles created
and my AnyConnect client

132
05:14.870 --> 05:17.150 align:middle line:90%
sitting there waiting
to go, our next step

133
05:17.150 --> 05:20.060 align:middle line:90%
is to validate that the
AnyConnect client can connect

134
05:20.060 --> 05:23.030 align:middle line:90%
to R1 our headend server
using that profile

135
05:23.030 --> 05:24.420 align:middle line:84%
or using a profile.

136
05:24.420 --> 05:25.945 align:middle line:90%
So, we'll do that
in the next video.

137
05:25.945 --> 05:28.070 align:middle line:90%
Meanwhile, I hope this has
been informative for you

138
05:28.070 --> 05:31.300 align:middle line:90%
and I'd like to thank
you for viewing.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

138
05:28.070 --> 05:31.300 align:middle line:90%
and I'd like to thank
you for viewing.