Connecting to Anyconnect SSL VPN from Linux

[Dieselboy]

Recently developed a Linux workstation build to replace Windows laptops for developers. One of the requirements is ability to connect to the SSL VPN we have for working remotely. My first choice was the Cisco Anyconnect installer for the Anyconnect client. Then I noticed that Anyconnect SSL is supported in Linux without the official Cisco software and with open sauce software .

Tested on both Ubuntu 18 and CentOS 7, I used

Code Select Expand

openconnect

Code Select Expand


sudo yum install openconnect -y

Code Select Expand

sudo apt install openconnect -y

Then to connect:

Code Select Expand

sudo openconnect your.vpn.url/portal

And then follow the prompts.

Or you can use the gui network VPN settings menu. However, the CentOS 7 build has a bug and is missing a library file. To fix this, install

Code Select Expand

NetworkManager-openconnect-gnome which includes the missing lib.

[deanwebb]

Wow, that's easy-peasy! Since it's an SSL VPN, you take whatever parameters come from the server.

Is there a way to set up an IPSEC VPN as easily on Linux?

[Dieselboy]

Yes - use the gui In the network settings area there is a specific VPN option, go in there and add the gubbins like group name, password etc.

One other benefit of using `openconnect` is that it will be updated when running a system update, unlike Anyconnect which will require you to manually download and run the installer, which is not usually accessible to the end-user.

[deanwebb]

Does openconnect also work on MacOS stuff?

[Dieselboy]

Good point, although Mac is supported, sort of.. I say sort of because our last upgrade resulted in the anyconnect client on the mac being unable to uninstall itself (so it could install the newer version) and leaving the end user stuck. They had to manually run the .sh script from /opt/cisco/something/something/yes/it/was/long

Quick look online found me a how-to guide for a university for mac and openconnect, so does look like it will work. It installs using homebrew on mac, which I have only heard about from colleagues but never used it.
http://kb.mit.edu/confluence/pages/viewpage.action?pageId=152588205

[deanwebb]

That is helpful and handy to know! Good stuff, DB!

[Dieselboy]

Following on from the OP I have 2 updates:

1. I tested openconnect on mac. It was installed through http://brew.sh. Couldnt install any gui, it said not found. But the openconnect CLI works fine. To disconnect you `ctrl+c` the CLI window.

2. Second - there is an openconnect server. I think this should mimick the ASA SSL VPN or iOS SSL VPN server http://ocserv.gitlab.io/www/index.html

I havent tried it yet.