LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Distributions > CentOS
User Name
Password
CentOS This forum is for the discussion of CentOS Linux. Note: This forum does not have any official participation.

Notices


Reply
  Search this Thread
Old 10-27-2021, 12:53 PM   #1
anon198
LQ Newbie
 
Registered: Oct 2021
Posts: 1

Rep: Reputation: Disabled
Problems with anyconnect vpn under CentOS8 (IPsec protocol)


In my institution we can use VPN to get access to our servers. For that we got a PKCS #12 certificate, let's name it johndoe.p12 and an anyconnect profile, let's name this johndoe.xml, and it looks like that:

<?xml version="1.0" encoding="UTF-8"?>
<AnyConnectProfile xmlns="http://schemas.xmlsoap.org/encoding/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://schemas.xmlsoap.org/encoding/ AnyConnectProfile.xsd">
<ClientInitialization>
<UseStartBeforeLogon UserControllable="false">false</UseStartBeforeLogon>
<AutomaticCertSelection UserControllable="true">true</AutomaticCertSelection>
<ShowPreConnectMessage>false</ShowPreConnectMessage>
<CertificateStore>All</CertificateStore>
<CertificateStoreOverride>false</CertificateStoreOverride>
<ProxySettings>Native</ProxySettings>
<AllowLocalProxyConnections>false</AllowLocalProxyConnections>
<AuthenticationTimeout>12</AuthenticationTimeout>
<AutoConnectOnStart UserControllable="false">false</AutoConnectOnStart>
<MinimizeOnConnect UserControllable="true">false</MinimizeOnConnect>
<LocalLanAccess UserControllable="false">false</LocalLanAccess>
<ClearSmartcardPin UserControllable="true">true</ClearSmartcardPin>
<AutoReconnect UserControllable="true">true
<AutoReconnectBehavior UserControllable="false">DisconnectOnSuspend</AutoReconnectBehavior>
</AutoReconnect>
<AutoUpdate UserControllable="false">true</AutoUpdate>
<RSASecurIDIntegration UserControllable="false">Automatic</RSASecurIDIntegration>
<WindowsLogonEnforcement>SingleLocalLogon</WindowsLogonEnforcement>
<WindowsVPNEstablishment>LocalUsersOnly</WindowsVPNEstablishment>
<AutomaticVPNPolicy>false</AutomaticVPNPolicy>
<PPPExclusion UserControllable="false">Disable
<PPPExclusionServerIP UserControllable="false"></PPPExclusionServerIP>
</PPPExclusion>
<EnableScripting UserControllable="false">false</EnableScripting>
<CertificateMatch>
<DistinguishedName>
<DistinguishedNameDefinition Operator="Equal" Wildcard="Disabled" MatchCase="Enabled">
<Name>O</Name>
<Pattern>University Hospital Jena</Pattern>
</DistinguishedNameDefinition>
<DistinguishedNameDefinition Operator="Equal" Wildcard="Disabled" MatchCase="Enabled">
<Name>OU</Name>
<Pattern>UKJatHome</Pattern>
</DistinguishedNameDefinition>
<DistinguishedNameDefinition Operator="Equal" Wildcard="Disabled" MatchCase="Enabled">
<Name>CN</Name>
<Pattern>ukj@home</Pattern>
</DistinguishedNameDefinition>
</DistinguishedName>
</CertificateMatch>
<EnableAutomaticServerSelection UserControllable="false">false
<AutoServerSelectionImprovement>20</AutoServerSelectionImprovement>
<AutoServerSelectionSuspendTime>4</AutoServerSelectionSuspendTime>
</EnableAutomaticServerSelection>
<RetainVpnOnLogoff>false
</RetainVpnOnLogoff>
</ClientInitialization>
<ServerList>
<HostEntry>
<HostName>JohnDoeatHome</HostName>
<HostAddress>vpnathome.organisation.de</HostAddress>
<UserGroup>JohnDoeatHome</UserGroup>
<PrimaryProtocol>IPsec</PrimaryProtocol>
</HostEntry>
</ServerList>
</AnyConnectProfile>


I use CentOS release 8.4.2105 and Anyconnect 4.10.000093. Everytime i want to connect i get these two messages (i guess the second one relates to the first one):

First: Certificate Validation Failure
Second: The IPsec VPN Connection was terminated due to an authentication failure or timeout...


I searched all informations about certificates, but nothing worked. I tried to include the certificate to the firefox bundle (i read it in some forum) which is no problem, but i didn't work for anyconnect.

Then i tired to add the certificate to CentOS, i converted the *p12 to a *.pem format and copied it to

/etc/pki/ca-trust/source/anchors/
/usr/share/pki/ca-trust-source/

together with the command: update-ca-trust

The certificate is part of the created bundles, but it didn't help with anyconnect.


My last try was openconnect.
openconnect --protocol=anyconnect --xmlconfig=johndoe.xml --authgroup=JohnDoeatHome -k PKCS12 -c JohnDoe.p12 -u SECRET vpnathome.organisation.de

Did not work "Login failed"



I have no clue how to proceed further, thanks for all hints. How can i include the certificate into anyconnect. The profile is no problem. Can the IPsec protocol be a problem?
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
how to install a vpn by cisco anyconnect in debian stretch Jenniferli Linux - Networking 1 11-19-2018 06:43 AM
Cannot connect to VPN via Cisco AnyConnect Client mattca Slackware 1 10-17-2014 01:28 PM
Cisco AnyConnect VPN high CPU (system) usage wastingtime Linux - Software 0 06-16-2011 09:39 AM
cisco anyconnect VPN client installation?? zing_4u Linux - Networking 0 09-01-2010 09:14 AM
vpn-ipsec : Failed to parse config setup portion of ipsec.conf hari85 Linux - Newbie 1 07-17-2010 08:12 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Distributions > CentOS

All times are GMT -5. The time now is 01:51 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration