Cisco ASA and Apple IOS VPN with Certificates

[dave-lew99]

Hello all,

I don't post as often as I should but now I need some help,

We have been banging our collective heads together for over a week now on this. We're trying to setup a certificate authenticated IPSEC VPN between Apple IOS devices and a Cisco ASA.

The certificates are created using a dedicated OpenSSL CA managed by us and the ASA is managed by an external hosting company (so there is a lot of slow back and forth).

Has anyone got this configuration working? The aim is to be able to use the IOS VPN on-demand feature which requires certificate based authentication.

Connecting from the iPhone results in 'unable to verify the server certificate' (or words to that effect and connecting from OSX causes the racoon daemon to die without error.

Connecting using the Cisco client is fine so it must be the way the Racoon/Unix implementation of ISAKMP/IPSEC works for cert auth.

if I turn verify off for racoon on OSX then the connection does work but this isn't an option for the iPhone (it also defeats the object of having certificates in the first place).

The CA cert has been imported on both the device and in OSX. The server cert has a DNS based subjectAltName but we've also tried with IP.

The server cert is in a different OU to the clients but I wouldn't have thought this would matter.

My gut feeling is that it's something in the certificate generation so if anyone could dump an X509 certificate (without keys obviously, just to show the make up of the subjectName and what other parameters are in it) that would be really useful.

Thanks in advance!

 

[adencool]

With the asa and mobile devices, you need the mobile licence and use the cisco app from the store which extends the built in vpn function are these in place?

 

[dave-lew99]

I haven't seen anything anywhere about a mobile licence for the ASA, it's fully licensed for VPN purposes, is this different?

We are using the standard built in IPSEC client, we're not trying to use AnyConnect/SSL so as far as I can tell we don't need another app.

Should the CN of the server certificate be hostname only and not FQDN? Or should it be the actual as-configured hostname of the ASA and not the DNS hostname that the users will connect as (e.g vpn.example.com) which is how we've generated the certificates now.

 

[adencool]

http://itunes.apple.com/gb/app/cisco-anyconnect/id392790924?mt=8

quote :The ASA requires an AnyConnect Mobile license (L-ASA-AC-M-55XX=), as well as either an AnyConnect Essentials (L-ASA-AC-E-55XX=) or AnyConnect Premium Clientless SSL VPN Edition (L-ASA-AC-SSL-YYYY=) license

 

[dave-lew99]

Well we got it working, we're not using the AnyConnect SSL method, we are using the built-in IPSEC method, do no licence required.

It turns out that Apple do not trust certificates which have an MD5 based signature, we had to re-generate them with a SHA1 signature, after that it started working.

Took some time to track down though, I couldn't find it mentioned in the enterprise deployment guide for iOS devices.

 

[DRZ]

We're using AnyConnect but we're heavily buying into Apple for portable devices and this sort of info will come in very useful in the near future!

Thanks