Cisco ASA Series User Manual

1-63
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring Connection Profiles, Group Policies, and Users
Group Policies
The following example disables client bypass protocol:
hostname(config-group-policy)# client-bypass-protocol disable
hostname(config-group-policy)#
The following example removes an enabled or disabled client bypass protocol setting:
hostname(config-group-policy)# no client-bypass-protocol enable
hostname(config-group-policy)#
Step 8 If you have configured Load Balancing between your ASAs, specify the FQDN of the ASA in order to
resolve the ASA IP address used for re-establishing the VPN session. This setting is critical to support
client roaming between networks of different IP protocols (such as IPv4 to IPv6).
You cannot use the ASA FQDN present in the AnyConnect profile to derive the ASA IP address after
roaming. The addresses may not match the correct device (the one the tunnel was established to) in the
load balancing scenario.
If the device FQDN is not pushed to the client, the client will try to reconnect to whatever IP address the
tunnel had previously established. In order to support roaming between networks of different IP
protocols (from IPv4 to IPv6), AnyConnect must perform name resolution of the device FQDN after
roaming, so that it can determine which ASA address to use for re-establishing the tunnel. The client
uses the ASA FQDN present in its profile during the initial connection. During subsequent session
reconnects, it always uses the device FQDN pushed by ASA (and configured by the administrator in the
group policy), when available. If the FQDN is not configured, the ASA derives the device FQDN (and
sends it to the client) from whatever is set under Device Setup > Device Name/Password and Domain
Name.
If the device FQDN is not pushed by the ASA, the client cannot re-establish the VPN session after
roaming between networks of different IP protocols.
Use the gateway-fqdn command to configure the FQDN of the ASA. This is the command syntax:
gateway-fqdn value {FQDN_Name | none}
no gateway-fqdn
The following example defines the FQDN of the ASA as ASAName.example.cisco.com
hostname(config-group-policy)# gateway-fqdn value ASAName.example.cisco.com
hostname(config-group-policy)#
The following example removes the FQDN of the ASA from the group policy. The group policy then
inherits this value from the Default Group Policy.
hostname(config-group-policy)# no gateway-fqdn
hostname(config-group-policy)#
The following example defines the FQDN as an empty value. The global FQDN configurd using
hostname and domain-name commands will be used if available.
hostname(config-group-policy)# gateway-fqdn none
hostname(config-group-policy)#

Cisco ASA Series Specifications

General

Model	ASA 5505
Interfaces	Varies by model (Fast Ethernet, Gigabit Ethernet, 10 Gigabit Ethernet, etc.)
High Availability	Active/Standby or Active/Active (varies by model)
Power Supply	Varies by model
Form Factor	Varies by model
Operating System	Cisco ASA Software
IPsec VPN	Supported
SSL VPN	Supported
IPS Throughput	Varies by model