Cisco 5505 - ASA Firewall Edition Bundle, Cli Configuration Manual

Page: 1696 / 2164

1-62
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring Connection Profiles, Group Policies, and Users
Group Policies
Step 5
You can ensure that an AnyConnect connection through a proxy, firewall, or NAT device remains open,
even if the device limits the time that the connection can be idle by adjusting the frequency of keepalive
messages using the
anyconnect ssl keepalive comand:
anyconnect ssl keepalive {none | seconds }
Adjusting keepalives also ensures the AnyConnect client does not disconnect and reconnect when the
remote user is not actively running a socket-based application, such as Microsoft Outlook or Microsoft
Internet Explorer.
The following example configures the security appliance to enable the AnyConnect client to send
keepalive messages, with a frequency of 300 seconds (5 minutes):
hostname(config-group-webvpn)# anyconnect ssl keepalive 300
hostname(config-group-webvpn)#
Step 6
To enable the AnyConnect client to perform a re-key on an SSL session, use the anyconnect ssl rekey
command:
anyconnect ssl rekey { method { ssl | new-tunnel } | time minutes | none }}
By default, re-key is disabled.
Specifying the method as new-tunnel specifies that the AnyConnect client establishes a new tunnel
during SSL re-key. Specifying the method as
none disables re-key. Specifying the method as ssl specifies
that SSL renegotiation takes place during re-key. Instead of specifying the method, you can specify the
time; that is, the number of minutes from the start of the session until the re-key takes place, from 1
through 10080 (1 week).
The following example configures the AnyConnect client to renegotiate with SSL during re-key and
configures the re-key to occur 30 minutes after the session begins:
hostname(config-group-webvpn)# anyconnect ssl rekey method ssl
hostname(config-group-webvpn)#
anyconnect ssl rekey time 30
hostname(config-group-webvpn)#
Step 7
The Client Protocol Bypass feature allows you to configure how the ASA manages IPv4 traffic when it
is expecting only IPv6 traffic or how it manages IPv6 traffic when it is expecting only IPv4 traffic.
When the AnyConnect client makes a VPN connection to the ASA, the ASA could assign it an IPv4,
IPv6, or both an IPv4 and IPv6 address. If the ASA assigns the AnyConnect connection only an IPv4
address or only an IPv6 address, you can now configure the Client Bypass Protocol to drop network
traffic for which the ASA did not assign an IP address, or allow that traffic to bypass the ASA and be
sent from the client unencrypted or “in the clear”.
For example, assume that the ASA assigns only an IPv4 address to an AnyConnect connection and the
endpoint is dual stacked. When the endpoint attempts to reach an IPv6 address, if Client Bypass Protocol
is disabled, the IPv6 traffic is dropped; however, if Client Bypass Protocol is enabled, the IPv6 traffic is
sent from the client in the clear.
Use the client-bypass-protocol command to enable or disable the client bypass protocol feature. This is
the command syntax:
client-bypass-protocol {enable | disable}
The following example enables client bypass protocol:
hostname(config-group-policy)# client-bypass-protocol enable
hostname(config-group-policy)#