Certificates on a Cisco ASA serving AnyConnect (Cisco Secure Client) traffic do two related but distinct jobs. First, the ASA presents an identity certificate to the client during the TLS or IKEv2 handshake; the client validates that cert before sending
Dynamic Access Policies (DAP) on the Cisco ASA are the runtime override layer for VPN sessions. They evaluate at login time, can match against AAA attributes plus endpoint posture (HostScan / Cisco Secure Endpoint) plus connection attributes, and they can override
Authentication, Authorization, and Accounting (AAA) on a Cisco ASA decides three things for every VPN session: who is the user, what are they allowed to do, and what activity should be logged. The three protocols you can wire into the
Two of the most overloaded terms in Cisco ASA VPN configuration are group-policy and tunnel-group. They sound similar, they are configured in the same area, and they both apply attributes to a connecting client. The difference between them
Split tunneling controls which traffic from a connected VPN client traverses the encrypted tunnel and which traffic exits to the internet directly. Get it wrong and you either backhaul Netflix traffic across your WAN (paying for bandwidth and adding latency)
AnyConnect (Cisco Secure Client) supports two transport options when connecting to an ASA: SSL/TLS over TCP/443 and IKEv2/IPsec over UDP/500 + UDP/4500. SSL is the default for most deployments because it traverses captive-portal networks the
AnyConnect SSL VPN (rebranded as Cisco Secure Client) is the most common remote-access VPN you will configure on a Cisco ASA. It tunnels TLS over TCP/443, which gets through nearly every hotel, airport, and customer-site firewall, and
Most "the ACL is broken" tickets are not really broken ACLs. They are misunderstood ACLs: a packet you thought matched line 3 actually matched line 1 and got denied; a deny line further down absorbed traffic the user
Most Cisco ASA NAT outages are not "the rule does not work". They are "the rule works, but the wrong rule fires first". The ASA evaluates NAT rules in a fixed order, and once a packet
Identity NAT, sometimes called NAT exemption or "no-NAT", is the rule you write when you specifically do not want to translate a flow. The most common reason: site-to-site IPsec or remote-access VPN traffic. The
Twice NAT is the rule type you reach for when one source-only or destination-only translation is not enough. The classic case: when source 10.10.10.0/24 talks to destination 172.20.0.0/24 (a partner
Static NAT is the rule that lets the rest of the internet reach a server you own. The classic case is a public-facing web server in the DMZ: it lives on a private IP, but customers reach it via