ืคืึธืจืืขืฆื ืื ืกืขืจืืข ืคืื โโืึทืจืืืงืืขื ืืืืฃ ืืขืจ ืืขืืข ืคืื โโืึธืจืืึทื ืืืึทืฆืืข ืืืืึทื ืึทืงืกืขืก ืืืคึผื ืึทืงืกืขืก ืืื ืงืขื ื ืืฉื ืืขืืคึฟื ืึธืืขืจ ืืืืื ืืืื ืืฉืืงืึทืืืข ืืืคึผืืืืืึทื ื ืืขืจืคืึทืจืื ื ืืขืืกื ืืืืขืจ VPN ืงืึทื ืคืืืืขืจืืืฉืึทื. ื ื ืื-ื ืื-ื ืืืืืืึทื ืึทืจืืขื ืืื ืืขืืืขื ืืขืจืืื ืื ืืืจื ืืืื ืงืื ื (ืขืก ืืขื ืขื ืื ืืืขื ืืึธืจืก ืืื ืจืืกืืฉืข ืืขืจืคืขืจ), ืึธืืขืจ ืื ืืฉืึทืืึทื ืืืฉ ืืื ืืขืืืขื ืื ืืขื ืืืขื ืืื ืงืจืืืืืืืืื ืืืคึผืืึทืืขื ืึทื. ืืขืจ ืจืขืืืืืึทื ืืื ืึท ืืฉืืงืึทืืืข ืืึทืืจืืฃ ืืื ืื ืคืืืืขื ืืข ืงืขืจืึทืงืืขืจืืกืืืงืก:
- ืขืืืขืืข ืกืืืืช ืคืื ืฉืืฅ ืงืขืื ืกืึทืืกืืืืืฉืึทื ืคืื ืื ืืืึธืงืืึทื ืืืื (ืืื ืฉืืจืขื ื ืืืื ืืื ื ืฆื ืืขืจ ืืึทื ืืฆืขืจ);
- ืึทืกืกืขืกืก ืื ืืขืกืงืขื ืคืื ืื ืืึทื ืืฆืขืจ 'ืก ืคึผืืกื ืืื ืื ืึทืกืืื ื UDID ืคืื ืื ืขืจืืืืื ืคึผืืกื ืืื ืื ืึธืืขื ืืึทืงืืืฉืึทื ืืึทืืึทืืืืก;
- ืืื MFA ื ืืฆื ืื PC UDID ืคึฟืื ืื ืืึทืืืืึทืื ืคึฟืึทืจ ืฆืืืืืืืง ืึธืืขื ืืึทืงืืืฉืึทื ืืืจื Cisco DUO (ืืืจ ืงืขื ืขื ืฆืืืฉืขืคึผืขื ืงืืื ืกืึทืื / ืจืึทืืืืก ืงืึทืืคึผืึทืืึทืืึทื ืืืื ืขืจ);
- ืืืืื-ืคืึทืงืืึธืจ ืึธืืขื ืืึทืงืืืฉืึทื:
- ืืึทื ืืฆืขืจ ืืึทืืืืึทืื ืืื ืคืขืื ืืืขืจืึทืคืึทืงืืืฉืึทื ืืื ืฆืืืืืืืง ืึธืืขื ืืึทืงืืืฉืึทื ืงืขืื ืืืื ืขืจ ืคืื ืืื;
- ืืึธืืื (ืึทื ืืฉืืื ืืืฉืึทืืึทื, ืืขื ืืืขื ืคืื ืื ืืึทืืืืึทืื) ืืื ืคึผืึทืจืึธื;
- ืึธืคึผืฉืึทืฆื ืื ืฉืืึทื ืคืื ืื ืงืึทื ืขืงืืื ื ืืึทืืขืืึธืก (ืืึทืืื ืืื)
ืืืืืื ื ืงืึทืืคึผืึธืื ืึทื ืฅ ืืขื ืืฆื:
- Cisco ASA (VPN Gateway);
- Cisco ISE (ืึธืืขื ืืึทืงืืืฉืึทื / ืืขืจืืืืืขื ืืฉ / ืึทืงืึทืื ืืื ื, ืฉืืึทื ืขืืืึทืืืึทืืืึธื, CA);
- Cisco DUO (ืืืืื-ืคืึทืงืืึธืจ ืึธืืขื ืืึทืงืืืฉืึทื) (ืืืจ ืงืขื ืขื ืฆืืืฉืขืคึผืขื ืงืืื ืกืึทืื / ืจืึทืืืืก ืงืึทืืคึผืึทืืึทืืึทื ืืืื ืขืจ);
- Cisco AnyConnect (ืืืืื-ืฆืื ืึทืืขื ื ืคึฟืึทืจ ืืืขืจืงืกืืืืฉืึทื ื ืืื ืจืืจืขืืืืืง ืึทืก);
ืืึธืืืจ ืึธื ืืืืื ืืื ืื ืจืขืงืืืืจืขืืขื ืฅ ืคืื ืืขืจ ืงืื ื:
- ืืขืจ ืืึทื ืืฆืขืจ ืืืื, ืืืจื ืืืื ืืึธืืื / ืคึผืึทืจืึธื ืึธืืขื ืืึทืงืืืฉืึทื, ืงืขื ืขื ืฆื ืึธืคึผืืึธืืืจื ืื AnyConnect ืงืืืขื ื ืคึฟืื ืื VPN ืืืืืืืื; ืึทืืข ื ืืืืืง AnyConnect ืืึทืืืฉืืื ืืืื ืืืื ืืื ืกืืึทืืืจื ืืืืืึธืืึทืืืฉ ืืื ืืืื ืืื ืืขืจ ืืึทื ืืฆืขืจ ืก ืคึผืึธืืืืืง;
- ืืขืจ ืืึทื ืืฆืขืจ ืืึธื ืงืขื ืขื ืืืืืึธืืึทืืืฉ ืึทืจืืืกืืขืื ืึท ืืึทืืืืึทืื (ืคึฟืึทืจ ืืืื ืขืจ ืคืื ืื ืกืื ืขืจืืึธืื, ืืขืจ ืืืืคึผื ืกืฆืขื ืึทืจ ืืื ืืึทื ืืึทื ืืฉืืึทื ืก ืืื ืืคึผืืึธืึทืืื ื ืืืืฃ ืึท ืคึผืืกื), ืึธืืขืจ ืืื ืืืคึผืืึทืืขื ืึทื ืึธืืึทืืึทืืืง ืึทืจืืืกืืขืื ืคึฟืึทืจ ืืขืืึทื ืกืืจืืืฉืึทื (ืขืก ืืื ืงืืื ืืึธื ืฆื ืฉืคึผืขื ืฆื ืืึทืืืึทืืืงื ืขืก).
- ืืงืขืจืืืง ืึธืืขื ืืึทืงืืืฉืึทื ืืืื ื ืขืืขื ืึธืจื ืืื ืขืืืขืืข ืกืืึทืืขืก, ืขืจืฉืืขืจ ืขืก ืืื ืืึทืืืืึทืื ืึธืืขื ืืึทืงืืืฉืึทื ืืื ืึทื ืึทืืืกืืก ืคืื ืื ื ืืืืืง ืคืขืืืขืจ ืืื ืืืืขืจ ืืืึทืืืขืก, ืืขืจื ืึธื ืืึธืืื / ืคึผืึทืจืึธื, ื ืึธืจ ืืึธืก ืืึธื ืื ืืึทื ืืฆืขืจ ื ืึธืืขื ืกืคึผืขืกืืคืืขื ืืื ืื ืืึทืืืืึทืื ืคืขืื ืืืื ืืืื ืื ืกืขืจืืึทื ืืื ืื ืืึธืืื ืคึฟืขื ืฆืืขืจ. ืืขืืข ื ืึธืืขื (CN) ืึธื ืื ืคืืืืงืืึทื ืฆื ืจืขืืึทืืืจื.
- ืืืจ ืืึทืจืคึฟื ืฆื ืืึทืื ืืืืขืจ ืึทื ืื ืืืื ืคืื ืืืึธืก ืืืจ ืืึธืืื ื ืืื ืืื ืื ืคึฟืืจืืข ืืึทืคึผืืึทืคึผ ืืจืืืก ืฆื ืืขืจ ืืึทื ืืฆืขืจ ืคึฟืึทืจ ืืืืึทื ืึทืงืกืขืก, ืืื ื ืืฉื ืขืคึผืขืก ืึทื ืืขืจืฉ. (ืขืืืขืืข ืึธืคึผืฆืืขืก ืืขื ืขื ืืขืืืื ืฆื ืืึทืคืจืืืืงื ืืขื ืคืึธืืขืจืื ื)
- ืื ืฉืืึทื ืคืื ืื ืงืึทื ืขืงืืื ื ืืืื (ืืื ืืขื ืืื ืข ืคึผืืกื) ืืึธื ืืืื ืึทืกืกืขืกืกืขื ืืื ืึท ืืฉืขืง ืคืื ืึท ืืึทื ืฅ ืืขืคืื ืืืฉ ืคืื ืงืื ื ืืืืขืจืคืขื ืืฉื (ืกืึทืืขืจืืืืื ื):
- ืืขืงืขืก ืืื ืืืืขืจ ืคึผืจืึธืคึผืขืจืืืขืก;
- ืจืขืืืกืืจื ืืืื ืกื;
- ืึทืก ืคึผืึทืืฉืึทื ืคืื ืื ืฆืืืขืฉืืขืื ืจืฉืืื (ืฉืคึผืขืืขืจ SCCM ืื ืึทืืจืืืฉืึทื);
- ืึทืืืึทืืืึทืืืืืื ืคืื ืึทื ืื-ืืืืจืืก ืคืื ืึท ืกืคึผืขืฆืืคืืฉ ืคืึทืืจืืงืึทื ื ืืื ืื ืฉืืืืืช ืคืื ืกืืื ืึทืืฉืขืจื;
- ืึทืงืืืืืืืขื ืคืื ืืืืขืจ ืืึทืืื ืื ืืก;
- ืึทืืืึทืืืึทืืืืืื ืคืื ืืืืขืจ ืืื ืกืืึทืืืจื ืืืืื;
ืฆื ืึธื ืืืืื ืืื, ืืื ืคึฟืึธืจืฉืืึธืื ืืืจ ืืืฉืืืื ืงืืง ืืื ืื ืืืืืขื ืืขืืึทื ืกืืจืืืฉืึทื ืคืื ืื ืจืืืึทืืืื ื ืืืคึผืืึทืืขื ืืืืฉืึทื ืืืืฃ ืืึธืืืืืข (5 ืืื ืื).
ืืืฆื ืืื ืคืึธืจืฉืืึธืื ืฆื ืืึทืืจืึทืืื ืื ืืืคึผืืึทืืขื ืืืืฉืึทื ืืขืืึทืืืก ืืืึธืก ืืขื ืขื ื ืืฉื ืงืึทืืืขืจื ืืื ืื ืืืืืขื ืงืืขืืขืจื.
ืืึธืืืจ ืฆืืืจืืืื ืื AnyConnect ืคึผืจืึธืคืื:
ืืื ืืึธื ืคืจืืขืจ ืืขืืขืื ืึท ืืืืฉืคึผืื ืคืื ืงืจืืืืืื ื ืึท ืคึผืจืึธืคืื (ืืื ืืขืจืืื ืขื ืคืื ืึท ืืขื ืื ื ืืืขืจ ืืื ASDM) ืืื ืืืื ืึทืจืืืงื ืืืขืื ืืึทืฉืืขืืืงื . ืืืฆื ืืื ืืืึธืื ืืื ืฆื ืืืืขืจืงื ืื ืึธืคึผืฆืืขืก ืืืึธืก ืืืจ ืืึทืจืคึฟื:
ืืื ืืขื ืคึผืจืึธืคืื, ืืืจ ืืืขืื ืึธื ืืืืึทืื ืื VPN ืืืืืืืื ืืื ืื ืคึผืจืึธืคืื ื ืึธืืขื ืคึฟืึทืจ ืงืึทื ืขืงืืื ื ืฆื ืื ืกืืฃ ืงืืืขื ื:
ืืึธืืืจ ืงืึทื ืคืืืืขืจ ืื ืึธืืึทืืึทืืืง ืืฉืืึทื ืก ืคืื ืึท ืืึทืืืืึทืื ืคืื ืื ืคึผืจืึธืคืื ืืืึทื, ืื ืืึทืงืืืืื ื, ืืื ืืึทืืื ืืขืจ, ืื ืืึทืืืืึทืื ืคึผืึทืจืึทืืขืืขืจืก ืืื, ืงืขืจืึทืงืืขืจืืกืืืงืื, ืืคืืขืจืงืืึทืืงืืื ืฆื ืื ืคืขืื ืืื ืืฆืืืื (ืืื), ืืื ืึท ืกืคึผืขืฆืืคืืฉ ืืืขืจื ืืื ืืึทื ืืืึทืื ืืจืืื UIDID ืคึผืจืืืืจื ืืึทืฉืื (ืืืื ืืงืืขื ืืืื ืืืืขื ืืืืขื ืืืึธืก ืืื ืืืฉืขื ืขืจืืืืึทื ืืืจื ืื Cisco AnyConnect ืงืืืขื ื).
ืืึธ ืืื ืืืืื ืฆื ืืึทืื ืึท ืืืจืืงืึทื ืืืืจืขืฉืึทื, ืืืืึทื ืืขืจ ืึทืจืืืงื ืืืฉืจืืืื ืืขื ืืึทืืจืืฃ; ืคึฟืึทืจ ืืขืืึทื ืกืืจืืืฉืึทื ืฆืืืขืงื, ืื UDID ืคึฟืึทืจ ืึทืจืืืกืืขืื ืึท ืืึทืืืืึทืื ืืื ืืจืืื ืืื ืื ืืื ืืฆืืืื ืคืขืื ืคืื ืื AnyConnect ืคึผืจืึธืคืื. ืคืื ืงืืจืก, ืืื ืคืึทืงืืืฉ ืืขืื, ืืืื ืืืจ ืืึธื ืืึธืก, ืึทืืข ืงืืืืึทื ืฅ ืืึทืงืืืขื ืึท ืืึทืืืืึทืื ืืื ืืขืจ ืืขืืืืงืขืจ UDID ืืื ืืขื ืคืขืื ืืื ืืึธืจื ืืฉื ืืืขื ืึทืจืืขืื ืคึฟืึทืจ ืืื, ืืืืึทื ืืื ืืึทืจืคึฟื ืื UDID ืคืื ืืืืขืจ ืกืคึผืขืฆืืคืืฉ ืคึผืืกื. ืึทื ืืงืึธื ื ืขืงื, ืืืืืขืจ, ืืื ื ืืฉื ื ืึธื ืื ืกืืจืืืขื ื ืกืึทืืกืืืืืฉืึทื ืคืื ืื UDID ืคืขืื ืืื ืื ืืึทืืืืึทืื ืืขืื ืคึผืจืึธืคืื ืืืจื ืึท ืกืืืืืืข ืืืึทืืขืืืืืง, ืืื ืขืก ืืื, ืืืฉื, ืืื ืึท ืืืึทืืขืืืืืง. %USER%.
ืขืก ืืื ืืืื ืฆื ืืืืขืจืงื ืึทื ืืขืจ ืงืื ื (ืคืื ืืขื ืกืฆืขื ืึทืจ) ืืืืืขืก ืคึผืืึทื ื ืฆื ืื ืืืคึผืขื ืืึทื ืืื ืึทืจืืืกืืขืื ืกืขืจืืืคืืงืึทืฅ ืืื ืึท ืืขืืขืื UDID ืืื ืืึทื ืืึทื ืืึธืืข ืฆื ืึทืืึท ืคึผืจืึธืืขืงืืขื ืคึผืืกื, ืืืึธืก ืืื ื ืืฉื ืึท ืคึผืจืึธืืืขื ืคึฟืึทืจ ืืื. ืึธืืขืจ, ืคึฟืึทืจ ืจืืึฟ ืคืื ืืื ืื ืืืจ ืืืขืื ืึธืืึทืืืืฉืึทื (ื ื, ืืึธืก ืืื ืืืช ืคึฟืึทืจ ืืืจ =)).
ืืื ืืึธืก ืืื ืืืึธืก ืืื ืงืขื ืขื ืคืึธืจืฉืืึธืื ืืื ืืขืจืืื ืขื ืคืื ืึธืืึทืืืืฉืึทื. ืืืื AnyConnect ืืื ื ืึธื ื ืืฉื ืืืืืืช ืฆื ืึทืจืืืกืืขืื ืึท ืืึทืืืืึทืื ืืืืืึธืืึทืืืฉ ืืืจื ืืื ืึทืืืงืึทืืื ืคืึทืจืืืึทืื ืื UDID, ืขืก ืืื ืื ืื ืืขืจ ืืืขื ืืืึธืก ืืืขื ืืึทืจืคื ืึท ืืืกื ืฉืขืคืขืจืืฉ ืืขืืึทื ืง ืืื ืืขืจืืืฉ ืืขื ื - ืืื ืืืขื ืืึธืื ืืืจ ืืขื ืืึทืืจืืฃ. ืขืจืฉืืขืจ, ืืึธืืืจ ืืขื ืืื ืื UDID ืืื ืืืฉืขื ืขืจืืืืึทื ืืืืฃ ืคืึทืจืฉืืืขื ืข ืึธืคึผืขืจืืืืื ื ืกืืกืืขืืขื ืืืจื ืื AnyConnect ืึทืืขื ื:
- ืคึฟืขื ืฆืืขืจ - SHA-256 ืืึทืฉ ืคืื ืื ืงืึธืืืื ืึทืฆืืข ืคืื โโืื DigitalProductID ืืื Machine SID ืจืขืืืกืืจื ืฉืืืกื
- ืึธืกืงืก โ SHA-256 hash PlatformUUID
- ืืื ืืงืก - SHA-256 ืืึทืฉ ืคืื ืื UUID ืคืื ืื ืืืึธืจืฆื ืฆืขืืืืืื ื.
- ืขืคึผื ืืึธืก โ SHA-256 hash PlatformUUID
- ืึทื ืืจืืื โ ืืขื ืืึธืงืืืขื ื ืืืืฃ
ืึทืงืงืึธืจืืื ืืื, ืืืจ ืืึทืื ืึท ืฉืจืืคื ืคึฟืึทืจ ืืื ืืืขืจ ืคึฟืืจืืข Windows ืึทืก, ืืื ืืขื ืฉืจืืคื ืืืจ ืืึธืืงืึทืื ืจืขืืขื ืขื ืื UDID ื ืืฆื ืืึทืืืืกื ืื ืคึผืืฅ ืืื ืคืึธืจืขื ืึท ืืงืฉื ืฆื ืึทืจืืืกืืขืื ืึท ืืึทืืืืึทืื ืืืจื ืึทืจืืึทื ืืขื UDID ืืื ืื ืคืืจืืื ืื ืคืขืื, ืืืจื ืืขื ืืืขื, ืืืจ ืงืขื ื ืืืื ื ืืฆื ืึท ืืึทืฉืื ืืึทืืืืึทืื ืืจืืืก ืืืจื AD (ืืืจื ืึทืืื ื ืืึธืคึผื ืึธืืขื ืืึทืงืืืฉืึทื ื ืืฆื ืึท ืืึทืืืืึทืื ืฆื ืื ืกืืขืืข ืงืืืคื ืกืขืจืืืคืืงืึทื).
ืืึธืืืจ ืฆืืืจืืืื ืื ืกืขืืืื ืืก ืืืืฃ ืื Cisco ASA ืืืึทื:
ืืึธืืืจ ืืึทืื ืึท TrustPoint ืคึฟืึทืจ ืื ISE CA ืกืขืจืืืขืจ, ืขืก ืืืขื ืืืื ืืขืจ ืืืึธืก ืืืขื ืึทืจืืืกืืขืื ืกืขืจืืืคืืงืึทืฅ ืฆื ืงืืืืึทื ืฅ. ืืื ืืืขื ื ืืฉื ืืึทืืจืึทืืื ืื ืฉืืืกื-ืงืืื ืึทืจืืึทื ืคืืจ ืคึผืจืึธืฆืขืืืจ; ืึท ืืืืฉืคึผืื ืืื ืืืกืงืจืืืื ืืื ืืืื ืึทืจืืืงื ืืืืฃ ืกืขืืึทืคึผ .
crypto ca trustpoint ISE-CA
enrollment terminal
crl configureืืืจ ืงืึทื ืคืืืืขืจ ืคืึทืจืฉืคึผืจืืืืื ื ืืืจื ืืื ืขื-ืืจืืคึผืข ืืืืืจื ืืืืฃ ืึผืืืื ืืื ืืืื ืืื ืื ืคืขืืืขืจ ืืื ืื ืืึทืืืืึทืื ืืืึธืก ืืื ืืขื ืืฆื ืคึฟืึทืจ ืึธืืขื ืืึทืงืืืฉืึทื. ืื AnyConnect ืคึผืจืึธืคืื ืืืจ ืืขืืืื ืืื ืื ืคืจืืขืจืืืงืข ืืื ืข ืืื ืืืื ืงืึทื ืคืืืืขืจื ืืึธ. ืืืืข ืืึธื ืึทื ืืื ื ืืฆื ืื ืืืขืจื SECUREBANK-RA, ืฆื ืึทืจืืืขืจืคืืจื ืืกืขืจืก ืืื ืึท ืืจืืืก ืืึทืืืืึทืื ืฆื ืึท ืืื ืขื ืืจืืคึผืข ืืืืขืจ-BANK-VPN, ืืืืข ืืึธื ืึทื ืืื ืืึธืื ืืขื ืคืขืื ืืื ืื AnyConnect ืคึผืจืึธืคืื ืืึทืืืืึทืื ืืขืื ืืืึทื.
tunnel-group-map enable rules
!
crypto ca certificate map OU-Map 6
subject-name attr ou eq securebank-ra
!
webvpn
anyconnect profiles SECUREBANK disk0:/securebank.xml
certificate-group-map OU-Map 6 SECURE-BANK-VPN
!ืืึทืฉืืขืืืงื ืึธืืขื ืืึทืงืืืฉืึทื ืกืขืจืืืขืจืก. ืืื ืืืื ืคืึทื, ืืึธืก ืืื ISE ืคึฟืึทืจ ืืขืจ ืขืจืฉืืขืจ ืืื ืข ืคืื โโืึธืืขื ืืึทืงืืืฉืึทื ืืื DUO (Radius Proxy) ืืื MFA.
! CISCO ISE
aaa-server ISE protocol radius
authorize-only
interim-accounting-update periodic 24
dynamic-authorization
aaa-server ISE (inside) host 192.168.99.134
key *****
!
! DUO RADIUS PROXY
aaa-server DUO protocol radius
aaa-server DUO (inside) host 192.168.99.136
timeout 60
key *****
authentication-port 1812
accounting-port 1813
no mschapv2-capable
!ืืืจ ืฉืึทืคึฟื ืืจืืคึผืข ืคึผืึทืืึทืกืื ืืื ืืื ืขื ืืจืืคึผืขืก ืืื ืืืืขืจ ืึทืืืืืืขืจื ืงืึทืืคึผืึธืื ืึทื ืฅ:
ืืื ืขื ืืจืืคึผืข DefaultWEBVPNGroup ืืืขื ืืืื ืืขืืืืื ื ืืคึฟืจื ืฆื ืึธืคึผืืึธืืืจื ืื AnyConnect VPN ืงืืืขื ื ืืื ืึทืจืืืกืืขืื ืึท ืืึทื ืืฆืขืจ ืืึทืืืืึทืื ื ืืฆื ืื SCEP-Proxy ืคืื ืงืฆืืข ืคืื โโโโืื ASA; ืคึฟืึทืจ ืืขื ืืืจ ืืึธืื ืื ืงืึธืจืึทืกืคึผืึทื ืืื ื ืึธืคึผืฆืืขืก ืึทืงืืืืืืืืื ืืืืืข ืืืืฃ ืื ืืื ืขื ืืจืืคึผืข ืืื ืืื ืืืืฃ ืื ืคึฟืึทืจืืื ืื ืืจืืคึผืข ืคึผืึธืืืืืง AC-Download, ืืื ืืืืฃ ืื ืืึธืืืื AnyConnect ืคึผืจืึธืคืื (ืคืขืืืขืจ ืคึฟืึทืจ ืึทืจืืืกืืขืื ืึท ืืึทืืืืึทืื, ืืื"ื ื). ืืืื ืืื ืืขื ืืจืืคึผืข ืคึผืึธืืืืืง ืืืจ ืึธื ืืืืึทืื ืื ื ืืื ืฆื ืึธืคึผืืึธืืืจื ISE ืคึผืึธืกืืืจืข ืืึธืืืืข.
ืืื ืขื ืืจืืคึผืข ืืืืขืจ-BANK-VPN ืืขืจ ืงืืืขื ื ืืืขื ืืืืืึธืืึทืืืฉ ื ืืฆื ืืืขื ืึธืืขื ืืึทืงืืืฉืึทื ืืื ืื ืืจืืืก ืกืขืจืืืคืืงืึทื ืืื ืื ืคืจืืขืจืืืงืข ืืื ืข, ืืืืึทื, ืืื ืืืื ืืื ืื ืกืขืจืืืคืืงืึทื ืืึทืคึผืข, ืื ืงืฉืจ ืืืขื ืคืึทืื ืกืคึผืึทืกืืคืืงืื ืืืืฃ ืืขื ืืื ืขื ืืจืืคึผืข. ืืื ืืืขื ืืึธืื ืืืจ ืืืขืื ืืฉืืงืึทืืืข ืึธืคึผืฆืืขืก ืืึธ:
- ืฆืืืืืืืง-ืึธืืขื ืืึทืงืืืฉืึทื-ืกืขืจืืืขืจ-ืืจืืคึผืข ืืืึธ # ืฉืืขืื ืฆืืืืืืืง ืึธืืขื ืืึทืงืืืฉืึทื ืืืืฃ ืื DUO ืกืขืจืืืขืจ (ืจืึทืืืืก ืคึผืจืึธืงืกื)
- ื ืืืขื-ืคืื-CertificateCN # ืคึฟืึทืจ ืขืจืฉืืืง ืึธืืขื ืืึทืงืืืฉืึทื, ืืืจ ื ืืฆื ืื CN ืคืขืื ืคืื ืื ืืึทืืืืึทืื ืฆื ืืจืฉืขื ืขื ืื ืืึทื ืืฆืขืจ ืืึธืืื
- ืฆืืืืืืืง ื ืืืขื-ืคืื-Certificate I # ืคึฟืึทืจ ืฆืืืืืืืง ืึธืืขื ืืึทืงืืืฉืึทื ืืืืฃ ืื DUO ืกืขืจืืืขืจ, ืืืจ ื ืืฆื ืื ืืงืกืืจืึทืงืืื ื ืืืขื ืืื ืื ืืื ืืฆืืืื (ืืื) ืคืขืืืขืจ ืคืื ืื ืืึทืืืืึทืื.
- ืคืึทืจ-ืคืืื-ืืึทื ืืฆืขืจ ื ืึธืืขื ืงืืืขื ื # ืืึทืื ืื ื ืืืขื ืคืึทืจ-ืึธื ืืขืคืืื ืืื ืื ืึธืืขื ืืึทืงืืืฉืึทื ืคึฟืขื ืฆืืขืจ ืึธื ืื ืคืืืืงืืื ืฆื ืืืืฉื
- ืฆืืืืืืืง-ืคืึทืจ-ืคืืื-ืืึทื ืืฆืขืจ ืงืืืขื ื ืืึทืืึทืืื ื ืืฆื-ืคึผืจืึธืกื ืคึผืึทืจืึธื ืฉืืืคึผื # ืืืจ ืืึทืืึทืืื ืื ืืึธืืื / ืคึผืึทืจืึธื ืึทืจืืึทื ืฉืจืืึทื ืคึฟืขื ืฆืืขืจ ืคึฟืึทืจ ืฆืืืืืืืง ืึธืืขื ืืึทืงืืืฉืึทื DUO ืืื ื ืืฆื ืื ืึธื ืืึธื ืืืคึฟื (ืกืืก / ืฉืืืคึผื / ืืขืืขืคืึธื) - ืืึธืง ืฆื ืืขืื ืึธืืขื ืืึทืงืืืฉืึทื ืึทื ืฉืืึธื ืคืื ืื ืคึผืึทืจืึธื ืคืขืื
!
access-list posture-redirect extended permit tcp any host 72.163.1.80
access-list posture-redirect extended deny ip any any
!
access-list VPN-Filter extended permit ip any any
!
ip local pool vpn-pool 192.168.100.33-192.168.100.63 mask 255.255.255.224
!
group-policy SECURE-BANK-VPN internal
group-policy SECURE-BANK-VPN attributes
dns-server value 192.168.99.155 192.168.99.130
vpn-filter value VPN-Filter
vpn-tunnel-protocol ssl-client
split-tunnel-policy tunnelall
default-domain value ashes.cc
address-pools value vpn-pool
webvpn
anyconnect ssl dtls enable
anyconnect mtu 1300
anyconnect keep-installer installed
anyconnect ssl keepalive 20
anyconnect ssl rekey time none
anyconnect ssl rekey method ssl
anyconnect dpd-interval client 30
anyconnect dpd-interval gateway 30
anyconnect ssl compression lzs
anyconnect dtls compression lzs
anyconnect modules value iseposture
anyconnect profiles value SECUREBANK type user
!
group-policy AC-DOWNLOAD internal
group-policy AC-DOWNLOAD attributes
dns-server value 192.168.99.155 192.168.99.130
vpn-filter value VPN-Filter
vpn-tunnel-protocol ssl-client
split-tunnel-policy tunnelall
default-domain value ashes.cc
address-pools value vpn-pool
scep-forwarding-url value http://ise.ashes.cc:9090/auth/caservice/pkiclient.exe
webvpn
anyconnect ssl dtls enable
anyconnect mtu 1300
anyconnect keep-installer installed
anyconnect ssl keepalive 20
anyconnect ssl rekey time none
anyconnect ssl rekey method ssl
anyconnect dpd-interval client 30
anyconnect dpd-interval gateway 30
anyconnect ssl compression lzs
anyconnect dtls compression lzs
anyconnect modules value iseposture
anyconnect profiles value SECUREBANK type user
!
tunnel-group DefaultWEBVPNGroup general-attributes
address-pool vpn-pool
authentication-server-group ISE
accounting-server-group ISE
default-group-policy AC-DOWNLOAD
scep-enrollment enable
tunnel-group DefaultWEBVPNGroup webvpn-attributes
authentication aaa certificate
!
tunnel-group SECURE-BANK-VPN type remote-access
tunnel-group SECURE-BANK-VPN general-attributes
address-pool vpn-pool
authentication-server-group ISE
secondary-authentication-server-group DUO
accounting-server-group ISE
default-group-policy SECURE-BANK-VPN
username-from-certificate CN
secondary-username-from-certificate I
tunnel-group SECURE-BANK-VPN webvpn-attributes
authentication aaa certificate
pre-fill-username client
secondary-pre-fill-username client hide use-common-password push
group-alias SECURE-BANK-VPN enable
dns-group ASHES-DNS
!ืืืืึทืืขืจ ืืืจ ืืึทื ืืืืฃ ืฆื ISE:
ืืืจ ืงืึทื ืคืืืืขืจ ืึท ืืืืข ืืึทื ืืฆืขืจ (ืืืจ ืงืขื ืขื ื ืืฆื AD/LDAP/ODBC, ืืื"ื ื), ืคึฟืึทืจ ืคึผืึทืฉืืขืก, ืืื ืืืฉืืคื ืึท ืืืืข ืืึทื ืืฆืขืจ ืืื ISE ืืื ืืื ืึทืกืืื ื ืขืก ืืื ืืขื ืคืขืื ืืึทืฉืจืืึทืืื ื UDID PC ืคืื ืืืึธืก ืขืจ ืืื ืขืจืืืืื ืฆื ืงืืึธืฅ ืืื ืืืจื VPN. ืืืื ืืื ื ืืฆื ืืืืข ืึธืืขื ืืึทืงืืืฉืึทื ืืืืฃ ISE, ืืื ืืืขื ืืืื ืืืืืืขื ืฆื ืืืืื ืืืื ืืืื, ืืืืึทื ืขืก ืืขื ืขื ื ืืฉื ืคืืืข ืคืขืืืขืจ, ืึธืืขืจ ืืื ืืจืื-ืคึผืึทืจืืื ืึธืืขื ืืึทืงืืืฉืึทื ืืึทืืึทืืืืกืื ืืื ืืืขื ื ืืฉื ืืึธืื ืึทืืึท ืจืืกืืจืืงืฉืึทื ื.
ืืื ืก ืงืืง ืืื ืื ืืขืจืืืืืขื ืืฉ ืคึผืึธืืืืืง, ืขืก ืืื ืฆืขืืืืื ืืื ืคืืจ ืงืึทื ืขืงืฉืึทื ืกืืึทืืขืก:
- Stage 1 - ืคึผืึธืืืืืง ืคึฟืึทืจ ืืึทืื ืืึธืืืื ื ืื AnyConnect ืึทืืขื ื ืืื ืึทืจืืืกืืขืื ืึท ืืึทืืืืึทืื
- Stage 2 - ืขืจืฉืืืง ืึธืืขื ืืึทืงืืืฉืึทื ืคึผืึธืืืืืง ืืึธืืื (ืคึฟืื ืืึทืืืืึทืื) / ืคึผืึทืจืึธื + ืกืขืจืืืคืืงืึทื ืืื UDID ืืืึทืืึทืืืืฉืึทื
- Stage 3 - ืฆืืืืืืืง ืึธืืขื ืืึทืงืืืฉืึทื ืืืจื Cisco DUO (MFA) ื ืืฆื UDID ืืื ื ืืืขื + ืฉืืึทื ืึทืกืกืขืกืกืืขื ื
- Stage 4 - ืืขืฆื ืืขืจืืืืืขื ืืฉ ืืื ืืื ืื ืฉืืึทื:
- ืืขืืึธืจืืืง;
- UDID ืืืึทืืึทืืืืฉืึทื (ืคึฟืื ืืึทืืืืึทืื + ืืึธืืื ืืืื ืืื ื),
- ืกืืกืงืึธ ืืืึธ ืืคืึท;
- ืึธืืขื ืืึทืงืืืฉืึทื ืืืจื ืืึธืืื;
- ืกืขืจืืืคืืงืึทื ืึธืืขื ืืึทืงืืืฉืึทื;
ืืึธืืืจ ืงืืงื ืืืืฃ ืึท ืืฉืืงืึทืืืข ืฆืืฉืืึทื ื UUID_VALIDATED, ืขืก ื ืึธืจ ืงืืงื ืืื ืืขืจ ืึธืืขื ืืึทืงืืืืื ื ืืึทื ืืฆืขืจ ืึทืงืฉืื ืืขืงืืืขื ืคึฟืื ืึท ืคึผืืกื ืืื ืึท ืขืจืืืืื UDID ืคึฟืึทืจืืื ืื ืืื ืืขื ืคืขืื ืืึทืฉืจืืึทืืื ื ืืฉืืื, ืื ืืืืื ืืื ืืขื ืงืืงื ืืื ืืึธืก:
ืืขืจ ืืขืจืืืืืขื ืืฉ ืคึผืจืึธืคืื ืืขื ืืฆื ืืื ืกืืึทืืขืก 1,2,3 ืืื ืืื ืืืื:
ืืืจ ืงืขื ืขื ืงืึธื ืืจืึธืืืจื ืคึผืื ืงื ืืื ืื UDID ืคึฟืื ืื AnyConnect ืงืืืขื ื ืงืืื ืฆื ืืื ืื ืืืจื ืงืืงื ืืื ืื ืงืืืขื ื ืกืขืกืืข ืืขืืึทืืืก ืืื ISE. ืืื ืืขืืึทื ืืืจ ืืืขืื ืืขื ืึทื AnyConnect ืืืจื ืื ืืขืงืึทื ืืืึทื ืึทืกืืืขืงืก ืกืขื ืื ื ืื ืืืืื ืืื ืคึฟืึธืจืืึทืฆืืข ืืืขืื ืื ืคึผืืึทืืคืึธืจืืข, ืึธืืขืจ ืืืื ืื UDID ืคืื ืื ืืืื ืืื ืกืืกืงืึธ-ืึทืื-ืคึผืึทืืจ:
ืืื ืก ืืึทืฆืึธืื ืืคืืขืจืงืืึทืืงืืึทื ืฆื ืื ืืึทืืืืึทืื ืืจืืืก ืฆื ืืขืจ ืืึทื ืืฆืขืจ ืืื ืื ืคืขืื ืืื ืืฆืืืื (ืืื), ืืืึธืก ืืื ืืขื ืืฆื ืฆื ื ืขืืขื ืขืก ืืื ืึท ืืึธืืื ืคึฟืึทืจ ืฆืืืืืืืง ืืคืึท ืึธืืขื ืืึทืงืืืฉืึทื ืืืืฃ Cisco DUO:
ืืืืฃ ืื DUO Radius Proxy ืืืึทื ืืื ืื ืงืืึธืฅ ืืืจ ืงืขื ืขื ืงืืืจ ืืขื ืืื ืื ืึธืืขื ืืึทืงืืืฉืึทื ืืขืื ืืื ืืขืืืื, ืขืก ืงืืื ืืื UDID ืืื ืื ื ืืืขื:
ืคึฟืื ืื DUO ืืืืขืจ ืืืจ ืืขื ืึท ืืขืจืึธืื ืึธืืขื ืืึทืงืืืฉืึทื ืืขืฉืขืขื ืืฉ:
ืืื ืืื ืื ืืึทื ืืฆืขืจ ืคึผืจืึธืคึผืขืจืืืขืก ืืื ืืึธืื ืขืก ืฉืืขืื ืขืืืึทืก, ืืืึธืก ืืื ืืขืืืืื ื ืคึฟืึทืจ ืืึธืืื, ืืื ืงืขืจ, ืืึธืก ืืื ืื UDID ืคืื ืื ืคึผืืกื ืขืจืืืืื ืคึฟืึทืจ ืืึธืืื:
ืืื ืึท ืจืขืืืืืึทื ืืืจ ืืึธืื:
- ืืืืื-ืคืึทืงืืึธืจ ืืึทื ืืฆืขืจ ืืื ืืืื ืึธืืขื ืืึทืงืืืฉืึทื;
- ืฉืืฅ ืงืขืื ืกืคึผืึธืึธืคืื ื ืคืื ืื ืืึทื ืืฆืขืจ 'ืก ืืืื;
- ืึทืกืกืขืกืก ืื ืฆืืฉืืึทื ื ืคืื ืื ืืืื;
- ืคึผืึธืืขื ืฆืืขื ืคึฟืึทืจ ืืขืืืืงืกื ืงืึธื ืืจืึธื ืืื ืคืขืื ืืึทืฉืื ืืึทืืืืึทืื, ืขืืง;
- ืคืืืฉืืขื ืืืง ืฉืืฅ ืคืื ืืืืึทื ืืืขืจืงืคึผืืืืก ืืื ืืืืืึธืืึทืืืฉ ืืืคึผืืืื ืืืืขืจืืืื ืืึทืืืฉืืื;
ืคึฟืึทืจืืื ืืื ืืขื ืฆื Cisco VPN ืกืขืจืืข ืึทืจืืืงืืขื:
ืืงืืจ: www.habr.com