Cisco

Showing posts with label Cisco. Show all posts

How to enable (and hack) Cisco AnyConnect VPN through Remote Desktop

Tuesday, April 14, 2020

If you get the following error when connecting to a Cisco AnyConnect VPN from Windows, it's because the VPN establishment capability in the client profile doesn't allow connections from a remote desktop session.

VPN establishment capability for a remote user is disabled. A VPN connection will not be established.

The client profile is an XML file that gets pushed out to the AnyConnect client every time the VPN is established. The correct way to fix this is by configuring the Citrix VPN profile on the ASA. Usually this is done by the ASA administrator using the Cisco Adaptive Security Device Manager (ASDM). If you're the ASA administrator read this article for instructions how to configure this.

But what if you're not the ASA administrator or the admin can't/won't to make this change for some reason? We can hack it! I don't normally write blog posts like this, but I honestly can't think of a single good reason to block VPN access from a remote desktop, so I don't consider this bypassing a security setting. Here's how to get around it.

First, open the client profile XML file in Notepad. It's located in the C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client\Profile folder.

Edit the <WindowsVPNEstablishment> tag to use AllowRemoteUsers instead of LocalUsersOnly.

For example, change:

<WindowsVPNEstablishment>LocalUsersOnly</WindowsVPNEstablishment>

To:

<WindowsVPNEstablishment>AllowRemoteUsers</WindowsVPNEstablishment>

Now save the profile to your Desktop or another location with a .BAK extension. For example, if the original profile name is ContosoVPN.xml, save it as ContosoVPN.bak.

Move the modified .BAK file to the C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client\Profile folder. This will normally require admin rights. You should now have two client profile files there, for example ContosoVPN.xml and ContosoVPN.bak.

Now open Event Viewer and navigate to Applications and Services Logs > Cisco AnyConnect Secure Mobility Client. Search for Event ID 3021 from source acvpnui. It should be near the top of the Cisco logs if you just tried to connect to the AnyConnect VPN.

Right-click that event and select Attach Task To This Event. The Create Basic Task Wizard will open.

Click Next.

Click Next again.

Configure the program to run using the settings below, then click Next.

Program/script:

C:\Windows\System32\cmd.exe

Arguments:

/c cd "C:\ProgramData\Cisco\Cisco AnyConnect Secure Mobility Client\Profile" && copy *.bak *.xml /y

This task tells Windows to copy the modified .BAK profile over the .XML file that the AnyConnect client downloads from the ASA whenever acvpnui logs event ID 3021.

Check the box to open the properties for the task when finished and click Finish.

The task properties will open in a new window.

Now test it out. You should be able to connect to the AnyConnect VPN using a remote desktop (RDP).

Be aware that if things change (ports, IPs, etc.) they will be lost/overwritten by the static BAK file. If that happens you can simply delete the BAK file, attempt a connection, and edit the new XML file with the new settings again.

Cisco Offers Free Nexus 1000V Integrated Switch for Hyper-V

Thursday, June 20, 2013

Hyper-V 3.0 on Windows Server 2012 offers a new feature called an extensible virtual switch. This feature allows you to replace the Windows integrated virtual switch in Hyper-V with a third-party switch, such as the Cisco 1000V. You can get a quick overview of Hyper-V extensible virtual switches here.

The Cisco 1000V virtual switch provides many advanced capabilities to Hyper-V VMs such as advanced switching (private VLANs, ACLs, PortSecurity, and Cisco vPath), security, monitoring, and manageability.

The following information comes from Cisco's Cisco Nexus 1000V Switch for Microsoft Hyper-V website:

Features and Capabilities

The Cisco Nexus 1000V Switch for Microsoft Hyper-V:

Offers consistent operational experience across physical, virtual, and mixed hypervisor environments
Reduces operational complexity through dynamic policy provisioning and mobility-aware network policies
Improves security through integrated virtual services and advanced Cisco NX-OS features

The following table summarizes the capabilities and benefits of the Cisco Nexus 1000V Switch for Microsoft Hyper-V.
Capabilities	Features	Operational Benefits
Advanced Switching	Private VLANs, Quality of Service (QoS), access control lists (ACLs), portsecurity, and Cisco vPath	Get granular control of virtual machine-to-virtual machine interaction.
Security	Dynamic Host Configuration Protocol (DHCP) Snooping, Dynamic Address Resolution Protocol Inspection, and IP Source Guard	Reduce common security threats in data center environments.
Monitoring	NetFlow, packet statistics, Switched Port Analyzer (SPAN), and Encapsulated Remote SPAN	Gain visibility into virtual machine-to-virtual machine traffic to reduce troubleshooting time.
Manageability	Simple Network Management Protocol, NetConf, syslog, and other troubleshooting command-line interfaces	Use existing network management tools to manage physical and virtual environments

The Cisco Nexus 1000V won the Best of Microsoft TechEd 2013 award in the Virtualization category.

If you're interested in learning more about the Nexus 1000V extensible switch, I encourage you to view the following 2 hour session on CiscoLive365: BRKVIR-2017. - The Nexus 1000V on Microsoft Hyper-V: Expanding the Virtual Edge (2013 London). Free registration is required. Bennial also posted the PowerPoint slide deck for this session on ScribD here.

Best of all it's free to download here! The download itself is for a 60 day trial. I received confirmation from Cisco that after 60 days you have to get a license, but it is free:

Go to www.cisco.com/go/license
Select the License Wizard, Check Product Category, Select Nexus 1000v, Select Add a License to Rehost
Enter the Nexus 1000v Serial Number (obtained from the virtual switch) or the existing PAK (Prod Auth Key)
A license file (PAK) will be generated and emailed to you
Just apply the new license file

Inbox Rules Do Not Work on Unity Connections 8.5.1 Messages

Friday, May 31, 2013

I ran into this with a customer recently and wanted to document what I found. The customer is using Cisco Unity Connections 9.1 for voicemail with Single Inbox and Exchange 2010 SP3.

Cisco's Single Inbox provides a UM experience similar to Exchange Unified Messaging, where voicemails are delivered to the user's Inbox as emails with attached WAV files. The voicemail messages are linked by Unity Connections so that if a user deletes a voicemail in Unity, the email message is also deleted. Likewise, if the user deletes the voicemail email message in Exchange the voicemail is deleted in Unity.

Unity Connections 8.5.x and later uses Exchange Web Services (EWS) for connectivity to Exchange 2007 and Exchange 2010 mailboxes using a service account. How Unity programmatically does this is a mystery since it is not documented anywhere in Cisco's documentation.

The issue here is that the way Unity Connections Single Inbox creates the message in the recipient's mailbox bypasses the rules table associated with the mailbox. The result is that rules don't fire for these messages. For example, it's common for users to create an Inbox rule that moves messages from Unity Connections to a custom folder like "Voicemails". If you manually run the rule it works as expected.

This issue is documented somewhat in the Cisco Community Forums here: https://supportforums.cisco.com/docs/DOC-17854. A comment in this forum post implies this is an Exchange bug, but I've confirmed that Inbox rules fire correctly when messages are sent via EWS in a normal manner. Fellow Exchange MCM, Mike Pfeiffer, has a great post on Sending Email with PowerShell and the EWS Managed API. I used this PowerShell function to send emails using EWS and test Inbox rules, which worked perfectly.

I've tried every creative trick I know to work around this issue, to no avail. In the end, there's really nothing that can be done to fix this until Cisco changes to the way it sends Single Inbox messages using EWS.