2.9 Configure and verify site-to-site and remote access VPN
📘CompTIA Security+ (SY0-701)
1. What is Remote Access VPN?
A Remote Access VPN allows individual users to securely connect to a company’s internal network from outside (like from home, hotel, or any public Wi-Fi).
- Unlike site-to-site VPN, which connects two offices, remote access VPN connects a user’s device to the corporate network.
- Provides encryption and authentication to protect sensitive data.
- Users can access internal resources like file servers, applications, or internal websites securely.
2. Cisco AnyConnect Secure Mobility Client
Cisco AnyConnect is the software client used for remote access VPN.
Key Features
- Works on Windows, macOS, Linux, and mobile devices.
- Supports multiple VPN protocols:
- SSL (Secure Sockets Layer) VPN – most common, works over HTTPS (port 443), bypasses most firewalls.
- IPsec IKEv2 VPN – more secure, used when SSL isn’t suitable.
- Integrates endpoint security checks (HostScan):
- Checks if the client has antivirus, firewall, OS patches, etc.
- Supports split tunneling:
- Only traffic destined for the corporate network goes through the VPN.
- Internet traffic goes directly to the internet (reduces bandwidth load on corporate network).
3. How Remote Access VPN Works with AnyConnect
Step 1: Client Installation
- User installs Cisco AnyConnect on their device.
- Connects to the corporate VPN gateway (typically Cisco ASA or Cisco Firepower device).
Step 2: Authentication
- AnyConnect prompts for credentials:
- Username/password.
- Optionally, multi-factor authentication (MFA) like a push notification, SMS code, or token.
- The VPN gateway verifies credentials against AAA servers (RADIUS, TACACS+, or Active Directory).
Step 3: VPN Tunnel Establishment
- If authenticated, a secure tunnel is created between the client and the VPN gateway:
- SSL/TLS or IPsec IKEv2 tunnel encrypts all traffic.
- Gateway assigns a VPN IP address from a VPN pool to the client.
- Traffic routing is configured:
- Full Tunnel – all traffic goes through VPN.
- Split Tunnel – only corporate network traffic goes through VPN.
Step 4: Accessing Corporate Resources
- Client can now access:
- Internal file shares.
- Corporate intranet sites.
- Remote applications.
- Traffic is encrypted and secure, even over public Wi-Fi.
4. VPN Policies and Options
a. Authentication Methods
- Local AAA (on VPN device itself).
- RADIUS / TACACS+ (for central user database).
- Certificate-based authentication:
- Users present a digital certificate for verification.
- Often used with IPsec IKEv2.
b. Access Policies
- VPN Group Policy defines:
- Which internal subnets the user can access.
- Split tunneling settings.
- Security posture checks (HostScan).
- Any specific client features (like blocking file transfers).
c. HostScan & Posture Assessment
- Cisco AnyConnect can verify endpoint security:
- Is antivirus running?
- Is firewall enabled?
- Are OS patches up-to-date?
- Access can be granted or denied based on these checks.
d. Encryption and Security
- SSL VPN (TLS):
- Uses port 443, easy to pass through NAT/firewalls.
- Encrypts all data in transit.
- IPsec IKEv2:
- Stronger encryption, better for mobile devices with VPN client support.
- Encryption algorithms:
- AES-256 for strong encryption.
- SHA for integrity.
5. Verifying Remote Access VPN
When preparing for the exam, you should know how to verify and troubleshoot:
a. Verification Commands on Cisco ASA / FTD
- Check connected VPN clients:
show vpn-sessiondb remote - Verify assigned IPs and user info:
show vpn-sessiondb detail anyconnect - Check VPN statistics:
show vpn-sessiondb summary
b. Verification on Client Side
- Cisco AnyConnect client shows:
- Connection status (Connected/Disconnected).
- Assigned VPN IP.
- Tunnel type (SSL/IPsec).
- You can test access to internal resources using
pingor accessing internal websites.
6. Common Exam Topics to Remember
- AnyConnect features: SSL VPN, IPsec IKEv2, HostScan, split tunneling.
- Authentication methods: AAA, RADIUS, TACACS+, certificates.
- VPN configuration elements:
- Tunnel group
- Group policy
- Access policies
- VPN IP pool
- Verification commands:
show vpn-sessiondb, client status. - Security checks: Endpoint posture assessment.
- Differences between full tunnel vs split tunnel.
7. Practical IT Example
In a corporate environment:
- An employee in a hotel connects their laptop via AnyConnect.
- They authenticate using username/password + MFA.
- AnyConnect establishes SSL VPN tunnel to the Cisco ASA.
- The employee can access internal file servers and corporate apps safely.
- Internet browsing goes directly to the hotel’s network (if split tunneling is enabled).
✅ Exam Tip: Cisco exam often asks about:
- VPN protocols (SSL vs IPsec).
- Authentication methods and AAA integration.
- Split tunnel vs full tunnel.
- Verifying VPN sessions.
- Features like HostScan for endpoint security.
