1

longtime reader, first-time poster.

I'm currently working in a small shop and I am new to the Sys Admin role. We pay our ISP a lot for our VPN and we are looking for a different provider. We are currently very low on funds and the VPN is one of the hooks I need to reel in before we can jump ship.

We have a Cisco ASA 5520 and I've been researching "rolling our own" VPN since it seems like the hardware should be fully capable. After reading I think what we need is IPsec VPN for users to connect from home offices and it seems like Cisco's AnyConnect answers that need. Looking on the flash memory of the firewall I see an AnyConnect 3.1 pkg in there. It may have been set up at some point, but I don't any tells in ASDM.

The more I research, the more I read about AnyConnect licensing (Essentials package etc). Most questions regarding this topic are 5+ years old so I'm curious if anything has changed. This firewall is EOL and I think even the licensing for AnyConnect 3.x is as well.

My question is, do we need to (or can we even) buy AnyConnect licensing in order to set up a VPN? What will happen if I try to set it up in the Wizard without? We will have less than 5/10 concurrent users at any given time for the foreseeable future. I don't know the cost of this licensing, but Cisco service is typically very expensive and as I said we are not a wealthy shop. What are my options?

Thanks in advance for any help!

Edit: Further research tells me that IPsec VPN is free if I opt to pass on the SSL AnyConnect client thing. Am I correct in assuming this is the way I should go? I'm going to have to find some tutorials on how to set this up if that's the only free angle.

graybeam
  • 21
  • 3
  • Please show the output of "sh version" – ewwhite Apr 22 '16 at 19:02
  • AnyConnect is a licensed function of the ASA. But if you already own the 5520, then buying the licenses probably isn't outrageously expensive. The IPSec VPN you're reading about is for site-to-site connections, which is not what you're needing. – Mark Henderson Apr 22 '16 at 19:49
  • It is interesting that you say that; in my research last week I read/heard that you can use IPSec to accomplish site-to-site as well as remote access connections. The main difference between the two being that SSL (AnyConnect) is remote-access-only, but communicates over a more "widely-open" set of ports (eg: TCP 443), where IPSec can fail over primitive or poorly-configured remote connections because it uses ESP packets and a combination of UDP ports (500, 4500) that requires purposeful configuration allowances. Is this incorrect? – graybeam Apr 25 '16 at 19:45

0 Answers0