RSS
 

Cisco IPSec VPN

Configure Workspace ONE UEM so that managed Apple and select Android devices can connect to an enterprise network through Cisco IPsec using a certificate for authentication.

Certificate authentication is handled from the point where the user’s device enrolls into Workspace ONE UEM to when the user has VPN access to the protected enterprise network. 1. After the device enrolls, Workspace ONE UEM sends the device a profile that contains the user’s identity certificate and Cisco IPSec VPN configuration settings. 2. When the device uses VPN, the device sends the identity certificate to ASA’s VPN endpoint for authentication. 3. ASA verifies that the device identity certificate came from the same CA as its own identity certificate and both were signed with the CA’s certificate. 4. Optionally, if CRL Checking is enabled, the ASA regularly receives, parses, and caches the CA’s CRL to validate the device identity certificate has not been revoked. 5. ASA grants the device VPN access. The device can now securely access internal enterprise resources.

This flow shows managed mobile devices connected to Workspace ONE UEM authenticating through Cisco IPsec to access the enterprise network.

Prerequisites

  • Use an external CA server. The CA must be an external Enterprise CA as opposed to a standalone CA. A standalone CAs doe not allow for the configuration and customization of templates.
  • For IPSec, you must have a Cisco Adaptive Security Appliance (ASA) connected to your network.

Procedure

  1. Deactivate the local CA on the ASA firewall to ensure that certificates are authenticated against the external CA.

    1. Log into the Cisco Adaptive Security Device Manager (ASDM) to configure your ASA firewall.
    2. Navigate to Configuration > Remote Access VPN > Certificate Management > Local Certificate Authority > CA Server.

    3. Select Disable.
      The Cisco Adaptive Security Devices Manager shows where to disable local CA.

    4. Select OK.

  2. Configure IPsec VPN.

    1. Create a CSR on the ASA firewall and send it to the external CA. This is because the ASA needs an Identity Certificate signed by the external CA. For assistance, follow Cisco’s instructions for Generating a CSR on the ASA firewall.
      After you have completed all the steps, a CER file (for example, cert_client_id.cer) downloads to your local machine that was obtained from the external CA.
    2. Download the certificate from the external CA and install it on the ASA firewall to authenticate that the external CA is a trusted source.
      Follow Cisco’s instructions on how to install the external CA’s certificate.
    3. Configure the IKE policies, tunnel properties and policies, group policies, available VPN client IP addresses (pool), user accounts and group assignments, and associate these configurations to create an IPSec profile used by the VPN clients.
      Visit the Cisco website for instructions on creating a remote access connection profile and tunnel group on the ASA for IPSec VPN clients. Complete the steps necessary to configure the external CA and ASA firewall to create a trust using certificates and configure a remote access connection profile and tunnel group so that IPSec VPN certificate authentication can be used by your VPN clients to gain access into your enterprise network.

  3. Integrate Workspace ONE UEM with the external CA so that Workspace ONE UEM can request and deploy Identity Certificates. Configure the CA and the request template in the Workspace ONE UEM console.

    1. Configure the CA.
      1. Log in to the Workspace ONE UEM console as a user with Workspace ONE UEM Administrator privileges, at minimum.
      2. Navigate to Devices > Certificates > Certificate Authorities.
      3. Select Add and complete the settings.
        Setting Description
        Authority Type Microsoft ADCS
        Protocol ADCS

        If you select SCEP, then there are different text boxes and selections available not covered by this documentation.
        Server Hostname Enter the host name of the CA server.
        Authority Name Enter the actual CA name.

        This value is the name of the CA to which the AD CS endpoint is connected. This value can be found by launching the Certification Authority application on the CA server.
        Authentication Select Service Account so the device user enters credentials.
        User name This value is the user name of the AD CS Admin Account which has sufficient access to allow Workspace ONE UEM to request and issue certificates.
        Password This value is the password of the AD CS Admin Account which has sufficient access to allow Workspace ONE UEM to request and issue certificates.
        Additional Options None
      4. Select Save.

  4. Deploy a device profile from Workspace ONE UEM console with IPSec VPN and Certificate payloads to devices. This device profile deploys an Identity Certificate and IPSec VPN settings to configure all assigned devices.

    1. Navigate to Devices > Profiles > List View from the Workspace ONE UEM console main menu.
    2. Select Add.
    3. Select the applicable device platform to open the Add a New Profile screen.
    4. Configure the General settings for the profile. The General settings determine how the profile is deployed and who receives it and other overall settings.
    5. Select Credentials from the profile options at left and then select Configure.
    6. Select Defined Certificate Authority from the Credential Source drop-down menu.
    7. Select the external CA created previously from the Certificate Authority drop-down menu.
    8. Select the certificate template created previously from the Certificate Template drop-down menu.
    9. Select VPN from the profile options at left and then select Configure.
      Credentials profile settings must be configured before the VPN profile settings because the VPN configuration refers to the credential that was just configure. Also, some of the configuration settings described here are not applicable to all device platforms.
    10. Configure the following VPN profile settings.
      Setting Description
      Connection Type IPSec (Cisco)
      Connection Name Enter a name that helps identify this specific VPN.
      Server Enter the URL that users connect to for establishing their VPN connection.
      Account If your VPN has been configured to apply user credentials in addition to a certificate for authentication, then specify an account to pass to the VPN endpoint. To pass Workspace ONE UEM User Account names to the VPN endpoint, use the {EnrollmentUser} lookup value.
      Machine Authentication Certificate
      Identity Certificate Select the credential configured for the certificate.
      Include User PIN Ensure this is not selected. Unselect this option.
      Enable VPN On Demand Ensure this is not selected. Unselect this option.
    11. Select Save or Save & Publish to push the profile to a device.

What to do next

You can confirm that the VPN certificate is operational by pushing a profile to the device and testing whether or not the device is able to connect and sync to the configured ASA firewall. If the device is not connecting and shows a message that the certificate cannot be authenticated or the account cannot connect to the ASA firewall, then there is a problem in the configuration. * Make sure that a certificate is being issued by the external CA to the device by checking the following information. * Go to the external CA’s server, launch the certification authority application, and browse to the “issued certificates” section.

* Find the last certificate that was issued and it should have a subject that matches the one created in the certificate template section earlier in this documentation.  
If there is no certificate then there is an issue with the external CA, client access server (e.g., ADCS), or with the Workspace ONE UEM connection to the client access server.

* Check that the permissions of the client access server (e.g., ADCS) Admin Account are applied correctly to the external CA and the template on the external CA.
* Check that the account information is entered correctly in the Workspace ONE UEM configuration.

  • If the certificate is being issued, make sure that it is in the Profile payload and on the device.

    • Navigate to Devices > Profiles > List View. In the Device Profiles screen for the user’s device, select Actions and then, select </ > View XML to view the profile XML. There is certificate information that appears as a large section of text in the payload.

    • On the device, go to the profiles list, select details and see if the certificate is present.

  • If the certificate is on the device and contains the correct information, then the problem is most likely with the security settings on the ASA firewall.
    Confirm that the address of the VPN endpoint is correct in the Workspace ONE UEM profile and that all the security settings have been adjusted for allowing certificate authentication on the firewall.

  • A very good test to run is to manually configure a single device to connect to IPSec VPN using certificate authentication. This should work outside of Workspace ONE UEM and until this works properly, Workspace ONE UEM will not be able to configure a device to connect to IPSec VPN with a certificate.

check-circle-line exclamation-circle-line close-line
Scroll to top icon