Filter
Top Products
1-17
Cisco ASA 5500 Series Configuration Guide using ASDM
Chapter 1 Introduction to the Cisco ASA 5500 Series
New Features
L2TP/IPsec Support on
Android Platforms
We now support VPN connections between Android mobile devices and ASA 5500 series
devices, when using the L2TP/IPsec protocol and the native Android VPN client. Mobile
devices must be using the Android 2.1, or later, operating system.
Also available in Version 8.2(5).
UTF-8 Character Support
for AnyConnect Passwords
AnyConnect 3.0 used with ASA 8.4(1), supports UTF-8 characters in passwords sent using
RADIUS/MSCHAP and LDAP protocols.
IPsec VPN Connections with
IKEv2
Internet Key Exchange Version 2 (IKEv2) is the latest key exchange protocol used to establish
and control Internet Protocol Security (IPsec) tunnels. The ASA now supports IPsec with
IKEv2 for the AnyConnect Secure Mobility Client, Version 3.0(1), for all client operating
systems.
On the ASA, you enable IPsec connections for users in the group policy. For the AnyConnect
client, you specify the primary protocol (IPsec or SSL) for each ASA in the server list of the
client profile.
IPsec remote access VPN using IKEv2 was added to the AnyConnect Essentials and
AnyConnect Premium licenses.
Site-to-site sessions were added to the Other VPN license (formerly IPsec VPN). The Other
VPN license is included in the Base license.
We modified the following screens:
Configure > Site-to-Site VPN > Connection Profiles
Configure > Remote Access > Network (Client) Access > AnyConnect Connection Profiles
Network (Client) Access > Advanced > IPsec > IKE Parameters > IKE Policies
Network (Client) Access > Advanced > IPsec > IKE Parameters > IKE Parameters
Network (Client) Access > Advanced > IPsec > IKE Parameters > IKE Proposals
SSL SHA-2 digital signature This release supports the use of SHA-2 compliant signature algorithms to authenticate SSL
VPN connections that use digital certificates. Our support for SHA-2 includes all three hash
sizes: SHA-256, SHA-384, and SHA-512. SHA-2 requires AnyConnect 2.5.1 or later (2.5.2 or
later recommended). This release does not support SHA-2 for other uses or products. This
feature does not involve configuration changes.
Caution: To support failover of SHA-2 connections, the standby ASA must be running the
same image. To support this feature, we added the Signature Algorithm field to the show
crypto ca certificate command to identify the digest algorithm used when generating the
signature.
SCEP Proxy SCEP Proxy provides the AnyConnect Secure Mobility Client with support for automated
third-party certificate enrollment. Use this feature to support AnyConnect with zero-touch,
secure deployment of device certificates to authorize endpoint connections, enforce policies
that prevent access by non-corporate assets, and track corporate assets. This feature requires
an AnyConnect Premium license and will not work with an Essentials license.
Table 1-6 New Features for ASA Version 8.4(1)/ASDM Version 6.4(1) (continued)
Feature Description