Using a web browser, open https://ravpn-address , where ravpn-address is the IP address or hostname of the outside interface on which you are allowing VPN connections.

Log into the site.

Configure the remote access VPN connection.

1. Click View Configuration in the Device > Remote Access VPN group.

2. Click Group Policies in the table of contents, then click the edit icon () for the DfltGrpPolicy object.

3. Make the following changes to the default group policy:

   • On the General page, in DNS Server, select the DNS server group that defines the servers VPN endpoints should use to resolve domain names.

     
     

     

     
     

   • On the Split Tunneling page, for both IPv4 and IPv6 Split Tunneling, select the Allow all traffic over tunnel option. This is the default setting, so it might already be configured correctly.

     
     

     

     
     

     Note	This is a critical setting to enable hair-pinning. You want all traffic to go to the VPN gateway, whereas split tunneling is a way to allow remote clients to directly access local or Internet sites outside of the VPN.

4. Click OK to save the changes to the default group policy.

5. Click Connection Profiles and either edit an existing profile or create a new one.

6. In the connection profile, page through the wizard and configure all options as you would for any other RA VPN configuration. However, you must configure the following options correctly to enable hair-pinning:

   • Group Policy, in step 2. Select the group policy you customized for hair-pinning.

     
     

     

     
     

   • NAT Exempt, in step 3. Enable this feature. Select the inside interface, then select a network object that defines the internal networks. In this example, the object should specify 192.168.1.0/24. RA VPN traffic going to the internal network will not get address translation. However, because hair-pinned traffic is going out the outside interface, it will still be NAT’ed because the NAT exemption applies to the inside interface only. Note that if you have other connection profiles defined, you need to add to the existing settings, as the configuration applies to all connection profiles.

     
     

     

     
     

     Note	The NAT Exempt option is the other critical setting for the hair pin configuration.

7. (Optional.) In the Global Settings step, select the Bypass Access Control policy for decrypted traffic (sysopt permit-vpn) option.

   By selecting this option, you remove the need to configure access control rules to allow traffic from RA VPN pool addresses. This option provides improved security (external users cannot spoof addresses in the pool), but it means that RA VPN traffic is exempt from inspection, including URL filtering and intrusion protection. Consider the pros and cons before deciding on this option.

8. Review the RA VPN configuration, then click Finish.

Configure the NAT rule to translate all connections going out the outside interface to ports on the outside IP address (interface PAT).

1. Click Policies > NAT.

2. Do one of the following:

   • To edit the InsideOutsideNatRule, mouse over the Action column and click the edit icon ().

   • To create a new rule, click +.

3. Configure a rule with the following properties:

   • Title—For a new rule, enter a meaningful name without spaces. For example, OutsideInterfacePAT.

   • Create Rule For—Manual NAT.

   • Placement—Before Auto NAT Rules (the default).

   • Type—Dynamic.

   • Original Packet—For Source Address, select either Any or any-ipv4. For Source Interface, ensure that you select Any (which is the default). For all other Original Packet options, keep the default, Any.

   • Translated Packet—For Destination Interface, select outside. For Translated Address, select Interface. For all other Translated Packet options, keep the default, Any.

   The following graphic shows the simple case where you select Any for the source address.

   
   

   

   
   

4. Click OK.

(If you do not configure Bypass Access Control policy for decrypted traffic (sysopt permit-vpn) in the connection profile.) Configure an access control rule to allow access from the remote access VPN address pool.

1. Click Policies > Access Control.

2. Click + to create a new rule.

3. Configure a rule with the following properties:

   • Order—Select a position in the policy before any other rule that might match these connections and block them. The default is to add the rule to the end of the policy. If you need to reposition the rule later, you can edit this option or simply drag and drop the rule to the right slot in the table.

   • Title—Enter a meaningful name without spaces. For example, RAVPN-address-pool.

   • Action—Allow. You can select Trust if you do not want this traffic to be inspected for protocol violations or intrusions.

   • Source/Destination tab—For Source > Network, select the same object you used in the RA VPN connection profile for the address pool. Leave the default, Any, for all other Source and Destination options.

     
     

     

     
     

   • Application, URL, and Users tabs—Leave the default settings on these tabs, that is, nothing selected.

   • Intrusion, File tabs—You can optionally select intrusion or file policies to inspect for threats or malware.

   • Logging tab—You can optionally enable connection logging.

4. Click OK.

Commit your changes.

1. Click the Deploy Changes icon in the upper right of the web page.

   

2. Click the Deploy Now button.

   You can wait until deployment completes, or click OK and check the task list or deployment history later.

Configure the site-to-site VPN connection on Site B, which hosts the directory server.

1. Click Device, then click View Configuration in the Site-to-Site VPN group.

2. Click the + button.

3. Configure the following options for Endpoint Settings.

   • Connection Profile Name—Enter a name, for example, SiteA (to indicate that the connection is to Site A).

   • Local Site—These options define the local endpoint.

     • Local VPN Access Interface—Select the outside interface (the one with the 192.168.2.1 address in the diagram).

     • Local Network—Click + and select the network object that identifies the local network that should participate in the VPN connection. Because the directory server is on this network, it can participate in the site-to-site VPN. Assuming that the object does not already exist, click Create New Network and configure an object for the 192.168.1.0/24 network. After saving the object, select it in the drop-down list and click OK.

       
       

       

       
       

   • Remote Site—These options define the remote endpoint.

     • Remote IP Address—Enter 192.168.4.6, which is the IP address of the remote VPN peer's interface that will host the VPN connection.

     • Remote Network—Click + and select the network objects that identify the remote networks that should participate in the VPN connection. Click Create New Network, configure the following objects, then select them in the list.

       1. SiteAInside, Network, 192.168.3.0/24.

          
          

          

          
          

       2. SiteAInterface, Host, 192.168.4.6. This is key: you must include the remote access VPN connection point address as part of the remote network for the site-to-site VPN connection so that the RA VPN hosted on that interface can use the directory server.

          
          

          

          
          

   When you are finished, the endpoint settings should look like the following:

   
   

   

   
   

4. Click Next.

5. Define the privacy configuration for the VPN.

   For this use case, we assume you qualify for export controlled features, which allows the use of strong encryption. Adjust these example settings to meet your needs and your license compliance.

   • IKE Version 2, IKE Version 1—Keep the defaults, IKE Version 2 enabled, IKE Version 1 disabled.

   • IKE Policy—Click Edit and enable AES-GCM-NULL-SHA and AES-SHA-SHA, and disable DES-SHA-SHA.

   • IPsec Proposal—Click Edit. In the Select IPSec Proposals dialog box, click +, then click Set Default to choose the default AES-GCM proposals.

   • Local Preshared Key, Remote Peer Preshared Key—Enter the keys defined on this device and on the remote device for the VPN connection. These keys can be different in IKEv2. The key can be 1-127 alphanumeric characters. Remember these keys, because you must configure the same strings when creating the site-to-site VPN connection on the Site A device.

   The IKE policy should look like the following:

   
   

   

   
   

6. Configure the Additional Options.

   • NAT Exempt—Select the interface that hosts the inside network, in this example, the inside interface. Typically, you do not want traffic within a site-to-site VPN tunnel to have their IP addresses translated. This option works only if the local network resides behind a single routed interface (not a bridge group member). If the local network is behind more than one routed interface, or one or more bridge group members, you must manually create the NAT exempt rules. For information on manually creating the required rules, see Exempting Site-to-Site VPN Traffic from NAT.

   • Diffie-Helman Group for Perfect Forward Secrecy—Select Group 19. This option determines whether to use Perfect Forward Secrecy (PFS) to generate and use a unique session key for each encrypted exchange. The unique session key protects the exchange from subsequent decryption, even if the entire exchange was recorded and the attacker has obtained the preshared or private keys used by the endpoint devices. For an explanation of the options, see Deciding Which Diffie-Hellman Modulus Group to Use.

   The options should look like the following.

   
   

   

   
   

7. Click Next.

8. Review the summary and click Finish.

   The summary information is copied to the clipboard. You can paste the information in a document and use it to help you configure the remote peer, or to send it to the party responsible for configuring the peer.

9. Click the Deploy Changes icon in the upper right of the web page.

   

10. Click the Deploy Now button and wait for deployment to complete successfully.

    Now the Site B device is ready to host one end of the site-to-site VPN connection.

Log out of the Site B device and log into the Site A device.

Configure the site-to-site VPN connection on Site A, which will host the remote access VPN.

1. Click Device, then click View Configuration in the Site-to-Site VPN group.

2. Click the + button.

3. Configure the following options for Endpoint Settings.

   • Connection Profile Name—Enter a name, for example, SiteB (to indicate that the connection is to Site B).

   • Local Site—These options define the local endpoint.

     • Local VPN Access Interface—Select the outside interface (the one with the 192.168.4.6 address in the diagram).

     • Local Network—Click + and select the network objects that identify the local networks that should participate in the VPN connection. Click Create New Network, configure the following objects, then select them in the list. Note that you created the same objects in the Site B device, but you have to create them again in the Site A device.

       1. SiteAInside, Network, 192.168.3.0/24.

          
          

          

          
          

       2. SiteAInterface, Host, 192.168.4.6. This is key: you must include the remote access VPN connection point address as part of the inside network for the site-to-site VPN connection so that the RA VPN hosted on that interface can use the directory server on the remote network.

          
          

          

          
          

   • Remote Site—These options define the remote endpoint.

     • Remote IP Address—Enter 192.168.2.1, which is the IP address of the remote VPN peer's interface that will host the VPN connection.

     • Remote Network—Click + and select the network object that identifies the remote network that should participate in the VPN connection, the one that includes the directory server. Click Create New Network and configure an object for the 192.168.1.0/24 network. After saving the object, select it in the drop-down list and click OK. Note that you created the same object in the Site B device, but you have to create it again in the Site A device.

       
       

       

       
       

   When you are finished, the endpoint settings should look like the following. Notice that the local/remote networks are flipped compared to the Site B settings. This is how the two ends of a point-to-point connection should always look.

   
   

   

   
   

4. Click Next.

5. Define the privacy configuration for the VPN.

   Configure the same IKE version, policy, and IPsec proposal, and the same preshared keys, as you did for the Site B connection, but make sure that you reverse the Local and Remote preshared keys.

   The IKE policy should look like the following:

   
   

   

   
   

6. Configure the Additional Options.

   • NAT Exempt—Select the interface that hosts the inside network, in this example, the inside interface. Typically, you do not want traffic within a site-to-site VPN tunnel to have their IP addresses translated. This option works only if the local network resides behind a single routed interface (not a bridge group member). If the local network is behind more than one routed interface, or one or more bridge group members, you must manually create the NAT exempt rules. For information on manually creating the required rules, see Exempting Site-to-Site VPN Traffic from NAT.

   • Diffie-Helman Group for Perfect Forward Secrecy—Select Group 19.

   The options should look like the following.

   
   

   

   
   

7. Click Next.

8. Review the summary and click Finish.

9. Click the Deploy Changes icon in the upper right of the web page.

   

10. Click the Deploy Now button and wait for deployment to complete successfully.

    Now the Site A device is ready to host the other end of the site-to-site VPN connection. Because Site B is already configured with compatible settings, the two devices should negotiate a VPN connection.

    You can confirm the connection by logging into the device CLI and pinging the directory server. You can also use the show ipsec sa command to view the session information.

Configure the directory server on Site A. Click Test to verify that there is a connection.

1. Select Objects, then select Identity Sources from the table of contents.

2. Click + > AD.

3. Configure the basic realm properties.

   • Name—A name for the directory realm. For example, AD.

   • Type—The type of directory server. Active Directory is the only supported type, and you cannot change this field.

   • Directory Username, Directory Password—The distinguished username and password for a user with appropriate rights to the user information you want to retrieve. For Active Directory, the user does not need elevated privileges. You can specify any user in the domain. The username must be fully qualified; for example, Administrator@example.com (not simply Administrator).

     Note

     The system generates ldap-login-dn and ldap-login-password from this information. For example, Administrator@example.com is translated as cn=adminisntrator,cn=users,dc=example,dc=com. Note that cn=users is always part of this translation, so you must configure the user you specify here under the common name “users” folder.

   • Base DN—The directory tree for searching or querying user and group information, that is, the common parent for users and groups. For example, cn=users,dc=example,dc=com. For information on finding the base DN, see Determining the Directory Base DN.

   • AD Primary Domain— The fully qualified Active Directory domain name that the device should join. For example, example.com.

   
   

   

   
   

4. Configure the directory server properties.

   • Hostname/IP Address—The hostname or IP address of the directory server. If you use an encrypted connection to the server, you must enter the fully-qualified domain name, not the IP address. For this example, enter 192.168.1.175.

   • Port—The port number used for communications with the server. The default is 389. Use port 636 if you select LDAPS as the encryption method. For this example, keep 389.

   • Encryption—To use an encrypted connection for downloading user and group information. The default is None, which means that user and group information is downloaded in clear text. For RA VPN, you can use LDAPS, which is LDAP over SSL. Use port 636 if you select this option. RA VPN does not support STARTTLS. For this example, select None.

   • Trusted CA Certificate—If you select an encryption method, upload a Certificate Authority (CA) certificate to enable a trusted connection between the system and the directory server. If you are using a certificate to authenticate, the name of the server in the certificate must match the server Hostname / IP Address. For example, if you use 192.168.1.175 as the IP address but ad.example.com in the certificate, the connection fails.

   
   

   

   
   

5. Click the Test button to verify the system can contact the server.

   The system uses separate processes to access the server, so you might get errors indicating that the connection works for one type of use but not another, for example, available for Identity policies but not for remote access VPN. If the server cannot be reached, verify that you have the right IP address and host name, that the DNS server has an entry for the hostname, and so forth. Also, verify that the site-to-site VPN connection is working and that you included Site A's outside interface address in the VPN, and that NAT is not translating traffic for the directory server. You might also need to configure a static route for the server.

6. Click OK.

Click Device > Smart License > View Configuration, and enable the RA VPN license.

When enabling the RA VPN license, select the type of license you purchased: Plus, Apex (or both), or VPN Only. For more information, see Licensing Requirements for Remote Access VPN.

Configure the remote access VPN on Site A.

1. Click View Configuration in the Device > Remote Access VPN group. Ensure that you are on the Connection Profiles page.

2. Create or edit a connection profile.

3. In the first step of the wizard, configure the profile name and then select the AD realm as the primary authentication source. You can optionally select the local database as fallback identity source.

   
   

   

   
   

4. Configure the address pool.

   For this example, click +, then select Create New Network in the IPv4 address pool and create an object for the 172.18.1.0/24 network, then select the object. Clients are assigned an address from this pool. Leave the IPv6 pool blank. The address pool cannot be on the same subnet as the IP address for the outside interface.

   The object should look like the following:

   
   

   

   
   

   The pool specification should look like the following:

   
   

   

   
   

5. Click Next, then select an appropriate group policy.

   Check the summary information about the policy you select. Ensure that the DNS servers are configured. If they are not, edit the policy now and configure DNS.

6. Click Next, and in global settings, select the Bypass Access Control policy for decrypted traffic (sysopt permit-vpn) option, and configure the NAT Exempt options.

   For NAT Exempt, you need to configure the following options. Note that if you have other connection profiles defined, you need to add to the existing settings, as the configuration applies to all connection profiles.

   • Inside Interfaces—Select the inside interface. These are the interfaces for the internal networks remote users will be accessing. NAT rules are created for these interfaces.

   • Inside Networks—Select the SiteAInside network object. These are the network objects that represent internal networks remote users will be accessing.

   
   

   

   
   

7. Upload the AnyConnect Client packages for the platforms you support.

8. Click Next and verify the settings.

   First, verify that the summary is correct.

   Then, click Instructions to see what end users need to do to initially install the AnyConnect Client software and test that they can complete a VPN connection. Click Copy to copy these instructions to the clipboard, and paste them in a text file or email.

9. Click Finish.

Click the Deploy Changes icon in the upper right of the web page.

Click the Deploy Now button and wait for deployment to complete successfully.

Configure the extended access control list (ACL) for restricting RA VPN traffic.

1. Choose Objects > Networks, and create the required object.

   For example, name the object ContractNetwork. The object should look similar to the following:

   
   

   

   
   

2. Choose Device > Advanced Configuration > Smart CLI > Objects.

3. Click + to create a new object.

4. Enter a name for the ACL. For example, ContractACL.

5. For CLI Template, select Extended Access List.

6. Configure the following in the Template body:

   • configure access-list-entry action = permit

   • source-network = any-ipv4

   • destination-network = ContractNetwork object

   • configure permit port = any

   • configure logging = default

   The ACE should look like the following:

   
   

   

   
   

7. Click OK.

   This ACL will be configured the next time you deploy changes. You do not need to use the object in any other policy to force deployment.

Create a group policy that uses the ACL.

1. Choose Device > RA VPN > Group Policies.

2. Click + to create a new group policy.

3. On the General page, enter a name for the policy, such as ContractGroup.

4. Click Traffic Filters in the table of contents.

5. For Access List Filter, select the ContractACL object.

   For this example, leave the VLAN option empty. Note that you could alternatively set up a VLAN for filtering purposes, and configure a subinterface for the VLAN.

   
   

   

   
   

6. Click OK to save the group policy.

Configure the connection profile for contractors.

1. On the RA VPN page, click Connection Profiles in the table of contents.

2. Click + to create a new connection profile.

3. Complete step 1 of the wizard and click Next.

   Enter a name for the profile, for example, Contractors.

   Configure the rest of the options as normal. This includes selecting the appropriate authentication source for the contractors, and defining an address pool.

4. Select the group policy you configured for contractors and click Next.

   
   

   

   
   

5. In the global settings, select the Bypass Access Control policy for decrypted traffic (sysopt permit-vpn) option, and configure the NAT Exempt options.

   For NAT Exempt, you need to configure the following options. Note that if you have other connection profiles defined, you need to add to the existing settings, as the configuration applies to all connection profiles.

   • Inside Interfaces—Select the inside2 interface. These are the interfaces for the internal networks remote users will be accessing. NAT rules are created for these interfaces.

   • Inside Networks—Select the ContractNetwork network object. These are the network objects that represent internal networks remote users will be accessing.

   
   

   

   
   

6. Upload the AnyConnect Client packages for the platforms you support.

7. Click Next and verify the settings.

   First, verify that the summary is correct.

   Then, click Instructions to see what end users need to do to initially install the AnyConnect Client software and test that they can complete a VPN connection. Click Copy to copy these instructions to the clipboard, and paste them in a text file or email.

8. Click Finish.

Configure the route leak from the Global virtual router to VR1.

1. Choose Device > Routing > View Configuration.

2. Click the view icon () for the Global virtual router.

3. On the Static Routing tab for the Global router, click + and configure the route:

   • Name—Any name will do, such as ravpn-leak-vr1.

   • Interface—Select vr1-inside.

   • Protocol—Select IPv4.

   • Networks—Select an object that defines the 192.168.1.0/24 network. Click Create New Network to create the object now if necessary.

     
     

     

     
     

   • Gateway—Leave this item blank. When leaking a route into another virtual router, you do not select the gateway address.

   The dialog box should look similar to the following:

   
   

   

   
   

4. Click OK.

Configure the route leak from VR1 to the Global virtual router.

1. Choose VR1 from the virtual routers drop-down list to switch to the VR1 configuration.

2. On the Static Routing tab for the VR1 virtual router, click + and configure the route:

   • Name—Any name will do, such as ravpn-traffic.

   • Interface—Select outside.

   • Protocol—Select IPv4.

   • Networks—Select the object you created for the VPN pool, for example, vpn-pool.

   • Gateway—Leave this item blank. When leaking a route into another virtual router, you do not select the gateway address.

   The dialog box should look similar to the following:

   
   

   

   
   

3. Click OK.

Upload the image files to each FTD device that is acting as an RA VPN headend that should use the customized icons and logos.

1. Log into the device CLI using an SSH client.

2. In the CLI, enter the system support diagnostic-cli command to enter diagnostic CLI mode.

   
   > system support diagnostic-cli
   Attaching to Diagnostic CLI ... Press 'Ctrl+a then d' to detach.
   Type help or '?' for a list of available commands.
   
   ftdv1>
   

   Note	Read the message! You must press Ctrl+a, then d, to get out of the diagnostic CLI and back into the normal FTD CLI mode.

3. Note the command prompt. The normal CLI uses > only, whereas the diagnostic CLI’s user EXEC mode uses the hostname plus >. In this example, ftdv1>. You need to get into privileged EXEC mode, which uses # as the ending character, for example, ftdv1#. If your prompt already has #, skip this step. Otherwise, enter the enable command, and simply press Enter at the password prompt without entering a password.

   
   ftdv1> enable
   Password:
   ftdv1#
   

4. Use the copy command to copy each file from the hosting server to the FTD device’s disk0. You can place them in a subdirectory, such as disk0:/anyconnect-images/. You can create a new folder using the mkdir command.

   For example, if the TFTP server’s IP address is 10.7.0.80, and you want to create a new directory, the commands would be similar to the following. Note that responses to the copy command are omitted after the first example.

   
   ftdv1# mkdir disk0:anyconnect-images 
   
   Create directory filename [anyconnect-images]? yes 
   
   Created dir disk0:/anyconnect-images
   
   ftdv1# copy /noconfirm tftp://10.7.0.80/app_logo.png 
   disk0:/anyconnect-images/app_logo.png 
   
   Accessing tftp://10.7.0.80/app_logo.png...!!!!!!
   Writing file disk0:/anyconnect-images/app_logo.png...
   !!!!!!
   12288 bytes copied in 1.000 secs (12288 bytes/sec)
   
   ftdv1# copy /noconfirm tftp://10.7.0.80/company_logo.png 
   disk0:/anyconnect-images/company_logo.png 
   ftdv1# copy /noconfirm tftp://10.7.0.80/company_logo_alt.png 
   disk0:/anyconnect-images/company_logo_alt.png 
   

Use the import webvpn command in the diagnostic CLI to instruct the AnyConnect Client to download these images when installing itself on client machines.

ftdv1# import webvpn AnyConnect-customization type resource platform win 
name app_logo.png disk0:/anyconnect-images/app_logo.png 

ftdv1# import webvpn AnyConnect-customization type resource platform win 
name company_logo.png disk0:/anyconnect-images/company_logo.png 

ftdv1# import webvpn AnyConnect-customization type resource platform win 
name company_logo_alt.png disk0:/anyconnect-images/company_logo_alt.png 

Verify the configuration: