Trouble with ASAv anyconnect radius login

[faghouri83]

Hi Everyone

I'm using a trial version of ASAv and i believe it has full functionality but is limited in 100kbps. I'm trying to set up remote access anyconnect vpn which authenticates to our NPS radius server. As you can see in the radius debug, it seems to be connecting to the radius successfully. The radius server goes to an AD server to authenticate the user:

rad_procpkt: ACCEPT
radius.c 1374: status = 1
MSChapv2 authenticator received.
Added decoded MS MPPE recv key for RADIUS
Added decoded MS MPPE send key for RADIUS
RADIUS_ACCESS_ACCEPT: normal termination
RADIUS_DELETE
remove_req 0x00007fc812693f60 session 0x2b54 id 111
free_rip 0x00007fc812693f60
radius: send queue empty

The problem is that the authentication fails on the anyconnect.  Now i've checked the licence on my trial ASAv and it is showing:

Firewall throughput limited to 100 Kbps

Licensed features for this platform:
Maximum VLANs : 200
Inside Hosts : Unlimited
Fail over : Active/Active
Encryption-DES : Enabled
Encryption-3DES-AES : Enabled
Security Contexts : 2
Carrier : Disabled
AnyConnect Premium Peers : 0
AnyConnect Essentials : Disabled
Other VPN Peers : 750
Total VPN Peers : 750
AnyConnect for Mobile : Disabled
AnyConnect for Cisco VPN Phone : Disabled
Advanced Endpoint Assessment : Disabled
Shared License : Disabled
Total TLS Proxy Sessions : 0
Botnet Traffic Filter : Enabled
Cluster : Enabled


It is showing anyconnect as disabled. Am i mistaken into thinking the anyconnect feature should work in the trial or do i have an issue between the ASAv and radius server or the radius server and the AD domain server?


Thanks

[Marvin Rhoads]

Did you get a token and configure smart licensing?

https://www.cisco.com/c/en/us/td/docs/security/asa/asa98/configuration/general/asa-98-general-config/intro-license-smart.html#ID-2149-000001f1

[tvotna]

@faghouri83, "anyconnect enable" won't help you until you resolve the issue with the license, as @Marvin Rhoads pointed out.

[tvotna]

This could change at some point. Simple google search shows that typical number of AnyConnect Premium licenses on the unlicensed ASAv is 2.

https://www.google.com/search?q=%22AnyConnect+Premium+Peers+%3A+2%22+%22ASAv+Platform+License+State%3A+Unlicensed%22&sca_esv=65b627a4699ea87d&sca_upv=1&ei=MwUhZozzB4mB9u8PrcWxuAY&ved=0ahUKEwjM2N3M1cuFAxWJgP0HHa1iDGcQ4dUDCA8&uact=5&oq=%22AnyConnect+Pr...

[MHM Cisco World]

debug aaa shim 255

debug aaa comm 127

share these two debug 

thanks 

MHM

[MHM Cisco World]

any update ?

MHM

[faghouri83]

Sorry for not getting back. Had an issue with activating the account for smart licensing.  I have that sorted now and i've pulled off a token but still no luck. I have entered the webvpn - anyconnect enable command too. 

Once i entered the token i did the command sh license summary and it still came up with not registered. I have then entered the token again but this time with the force command at the end. I now get: 

ciscoasa/act/pri# sh license summary

Smart Licensing is ENABLED

Registration:
Status: REGISTERING - REGISTRATION IN PROGRESS
Export-Controlled Functionality: NOT ALLOWED
Next Registration Attempt: Apr 30 2024 10:46:46 UTC

License Authorization:
Status: EVAL MODE
Evaluation Period Remaining: 89 days, 23 hours, 4 minutes, 0 seconds

License Usage:
License Entitlement Tag Count Status
-----------------------------------------------------------------------------
(ASAv-STD-1G) 1 EVAL MODE

when i do sh ver:

License mode: Smart Licensing
ASAv Platform License State: Unlicensed
Active entitlement: ASAv-STD-1G, enforce mode: Eval period
Firewall throughput limited to 100 Kbps

Licensed features for this platform:
Maximum VLANs : 200
Inside Hosts : Unlimited
Fail over : Active/Active
Encryption-DES : Enabled
Encryption-3DES-AES : Enabled
Security Contexts : 2
Carrier : Disabled
AnyConnect Premium Peers : 0
AnyConnect Essentials : Disabled
Other VPN Peers : 750
Total VPN Peers : 750
AnyConnect for Mobile : Disabled
AnyConnect for Cisco VPN Phone : Disabled
Advanced Endpoint Assessment : Disabled
Shared License : Disabled
Total TLS Proxy Sessions : 0
Botnet Traffic Filter : Enabled
Cluster : Enabled

I can get out to the internet so the firewall should successfully be able to register. I can see the config: 
call-home
profile License
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
destination transport-method http

So it's in evaluation mode but seems i don't have the ability to connect via cisco anyconnect still. 

[MHM Cisco World]

The two command I share before show us if it license issue or not 

Run it and share output 

MHM

[faghouri83]

I have managed to get the firewall talking to the cisco portal by adding a default DNS server.  It has registered and is now showing a number of anyconnect licences. However i'm still failing authentication and i now get:

Reason: This connection is group locked to <CORP_VPN>.

[MHM Cisco World]

Good'

Share anyconnect config

MHM