anyconnect 外部控制管理vpn连接

之前公司所有人都使用iPhone,为了方便微信网页测试,用AnyConnect来实现DNS推送,将微信的网页域名指向不同开发、测试环境的IP。

iOS可以使用Apple Configurator生成mobileconfig文件来配置AnyConnect。最早使用这份配置的时候,发现如果使用密码认证,即便配置文件里写了用户名和密码,iOS的AnyConnect还是会需要用户再输入一次密码。所以一直以来用AnyConnect做的各种解决方案都是使用证书的方式,将用户证书和CA证书一并集成到mobileconfig文件里。

不幸的是去年下半年的某天,突然就发现iOS的AnyConnect连上了VPN,但是DNS不生效了。
那会儿,iOS升级到10.2之后的某个版本,AnyConnect在iOS平台推出了新版客户端,老的改名Legacy了。

换了新版,同样的配置文件下发方式,这回问题更大了,直接连不上。日志里看到的内容大概是客户端不知道该用哪份证书进行身份验证。

研究了cisco的文档,发现可以用 anyconnect://connect 直接呼起客户端的连接操作,而这个链接iOS和Android都可用。

链接类似如下:
anyconnect://connect/?name=Int&host=vpn-internal.sskaje.me:8433&prefill_username=user&prefill_password=password&onsuccess=http%3A%2F%2Fsskaje.me%2Fsuccess

不过由于安全原因,AnyConnect默认将“外部控制”的功能关闭了。(其实,我之前一直以为这个是服务器可以推送客户端执行命令的功能,所以很敏感)
在设置中改为提示 或者 启用。

而,之前dns不生效的功能,现在只能开启 split-dns 了。

anyconnect 外部控制管理vpn连接 by @sskaje: https://sskaje.me/2018/02/anyconnect-%e5%a4%96%e9%83%a8%e6%8e%a7%e5%88%b6%e7%ae%a1%e7%90%86vpn%e8%bf%9e%e6%8e%a5/

Ocserv IPv6

I’m using AnyConnect both on iOS and OS X, you can read previously posted article on my blog: anyconnect, openconnect, ocserv.

You can find ipv6-network and ipv6-prefix in ocserv’s sample.config:

which means ocserv should be compatible with IPv6.
And, in AnyConnect for iOS, ipv6 can be found somewhere, seems ipv6 is also compatible here.

My VPN is hosted on Linode VPS. Linode provides free IPv6 address pool. Open a ticket and ask for an address pool, you’ll get your own pool routed to your VPS’s ipv6 address.
After that, set the ipv6-network and ipv6-prefix.

Ocserv 0.8.9 does not send correct headers to AnyConnect for iOS, but 0.9.0-dev does.
I can now get a correct ipv6 address on my iPhone but with no connectivity. As it’s said, X-CSTP-Split-Include/Exclude is not well handled by AnyConnect for IPv6 addresses.
After that, I tried the latest AnyConnect for OSX, you can download it here: http://dl.sskaje.me/anyconnect/4.0/4.0.00051/

IPv6 is also assigned to my MBP, also with route, but still not working.

Ocserv IPv6 by @sskaje: https://sskaje.me/2015/01/ocserv-ipv6/

Incoming search terms:

OCServ with AnyConnect on OSX

I tried a lot to make Cisco Anyconnect Secure Mobility Client work with OCServ, on OSX, on Windows, all failed.
But the AnyConnect for iOS works fine.
You can download the latest clients from: Cisco AnyConnect Clients 3.1.05170 download, 3.1.05182 is also provided.

AnyConnect for OSX always says:

In /var/log/system.log:

I read the chapter ‘False Captive Portal Detection‘ from Cisco’s official documentation, nothing useful.

I saw someone said that AnyConnect 3.1 added extra certificate verification than 3.0, which makes 3.1 not compatible with ocserv.
The latest version of AnyConnect for iOS is 3.0.12119, but for PC/Mac 3.1.05182.
I tried to find clients of AnyConnect 3.0.11042/3.0.11046, only two can be found, and MD5 checksum are same no matter where I downloaded.

You can find files here: http://dl.sskaje.me/anyconnect/3.0/3.0.11042/

I tested the OSX one, the PKG file requires me change security level of application installing, it really works, the bad news is, there’s nowhere to choose client certificate but clicking allow/decline of private key usage.

QQ20141013-1

QQ20141013-2

BTW, DO NOT INSTALL WEB SECURITY MODULE!!!

OCServ with AnyConnect on OSX by @sskaje: https://sskaje.me/2014/10/ocserv-anyconnect-osx/

Incoming search terms:

OpenConnect DNS Only + Google Only

I’m using 4G by China Mobile, but the DNS it provides really sucks. Changing DNS from Cellular Data on a not-jailbroken iPhone is impossible so far as I know (I tried mobileconfig but can find any working options).

The first idea is pushing DNS from a PPTP server, which I wrote: Notes: PPTP/L2TP Server on Ubuntu.
I can create two connections on my iOS, one set default route, one not. All users share a same setting from PPTPd, it’s almost impossible if I want to use a different DNS in these two connections, changing default pptp port from 1723 to others is not as easy as it is on windows.
Don’t forget that PPTP is what GF*W likes.
Continue reading “OpenConnect DNS Only + Google Only” »

OpenConnect DNS Only + Google Only by @sskaje: https://sskaje.me/2014/06/openconnect-dns-google/

Incoming search terms:

Cisco AnyConnect Clients 3.1.05170 download

Available for OS X, Windows, Linux, but unfortunately I didn’t figure out how to use it with OpenConnect when using public key authentication.
OpenConnect Public Key Authentication
Open Connect Server Configuration (Working for iOS)
OpenConnect on Ubuntu

OCServ with AnyConnect on OSX

Download: http://dl.sskaje.me/anyconnect/

Continue reading “Cisco AnyConnect Clients 3.1.05170 download” »

Cisco AnyConnect Clients 3.1.05170 download by @sskaje: https://sskaje.me/2014/06/cisco-anyconnect-clients-3-1-05170-download/

Incoming search terms: