How To Connect Ubuntu Linux to Cisco VPN with openconnect (anyconnect-capable alternative)
For Ubuntu Linux, Cisco provides the anyconnect VPN client. But why not connect with the simplistic, FOSS, and Network-Manager-integrated, "openconnect" and "network-manager-openconnect" packages from the "universe" repository instead? I've used this method with much success for quite some time now.
Special Note - these instructions are for connecting to the VPN using the open source alternative to Cisco AnyConnect client (openconnect). If you are looking for instructions related to using the open source alternative to the Cisco Systems VPN client (vpnc), have a look at my post entitled: How To: Cisco Systems VPN with Ubuntu 11.10 / 10.10 GNU/Linux
You can install these packages easily with using either of the two methods below. Also, you may need to enable the universe FOSS repository first (see the "****" note below for enabling the "universe" repository):
Method A.) From the Ubuntu Software Center (see image below).
Simply click Applications, Ubuntu Software Center, then search for and install "openconnect", "network-manager-openconnect" (see image below).
Update 1/6/15: For newer Ubuntu, e.g., 14.04 add: "network-manager-openconnect-gnome"
Method B.) From the Terminal(hit alt+f2, type or enter "gnome-terminal", hit enter), type or paste in these commands:
sudo apt-get update && sudo apt-get install openconnect && sudo apt-get install network-manager-openconnect
Update: 1/6/15: For newer Ubuntu, e.g., 14.04, use:
sudo apt-get update && sudo apt-get install openconnect && sudo apt-get install network-manager-openconnect && sudo apt-get install network-manager-openconnect-gnome
After you install the required packages, reboot your computer to finalize the settings. When you login again, you should see the "VPN Connections" setting to appear on the Network Manager applet(same place where the other network connections are found). Next, click the Network Manager, VPN Connections, Configure VPN, Add. (see image below)
Next, select "Cisco AnyConnect Compatible VPN (openconnect)" and click Create. (see image below)
Then enter the gateway IP address or DNS name to connect to (this comes from your IT dept), Enter a name for the connection, check "Connect automatically", (optional depending on your company network) Enter the internal DNS servers and Search Domains for your company network(IT dept for this) on the IPv4 Settings Tab. (see image below)
(optional)For split tunneling (allows you to go out of your regular connection to the Internet as opposed to through the VPN) From the IPv4 tab, click Routes, check "Use this connection only for resources on its network", click OK, click Save, click Close (to close Network Connections) and voila, you're all set.
To connect, establish your regular Internet connection first, then click the Network Manager, mouse over "VPN Connections", click the name of the VPN you created. If all went well, you'll be presented with place to enter your anyconnect username/password and you can connect. Whey you see a small lock in the Network Manager - that means VPN is connected and you should have access to your network.
**** To enable the universe repositories:
Launch the Applications, "Ubuntu Software Center", click Edit, click "Software Sources" (see image below)
Then from the "Software Sources" dialog box: Click System, Software Sources (authenticate), In the software Sources dialog, check "Community-maintained Open Source software", oh and now's a good time to select a faster repository source, set "Download from:" to something like samaritan.ucmerced.edu, or ubuntu.osuosl.org(example only) (or use the tool there to find the fastest server near you). The default source of "Main Server" is typically slower than what's available elsewhere.) Click close, reload the sources (this is the same as sudo apt-get update) and now you'll have the universe repository enabled and available for use. (see image below)
Feel free to leave a comment if you like.
1/6/15: Many Thanks to +Tonya Ohrel in the comments for replying with the additional manager-openconnect-gnome being needed for the newer Ubuntu.
Cheers!
Shannon VanWagner
Special Note - these instructions are for connecting to the VPN using the open source alternative to Cisco AnyConnect client (openconnect). If you are looking for instructions related to using the open source alternative to the Cisco Systems VPN client (vpnc), have a look at my post entitled: How To: Cisco Systems VPN with Ubuntu 11.10 / 10.10 GNU/Linux
You can install these packages easily with using either of the two methods below. Also, you may need to enable the universe FOSS repository first (see the "****" note below for enabling the "universe" repository):
Method A.) From the Ubuntu Software Center (see image below).
Simply click Applications, Ubuntu Software Center, then search for and install "openconnect", "network-manager-openconnect" (see image below).
Update 1/6/15: For newer Ubuntu, e.g., 14.04 add: "network-manager-openconnect-gnome"
Method B.) From the Terminal(hit alt+f2, type or enter "gnome-terminal", hit enter), type or paste in these commands:
sudo apt-get update && sudo apt-get install openconnect && sudo apt-get install network-manager-openconnect
Update: 1/6/15: For newer Ubuntu, e.g., 14.04, use:
sudo apt-get update && sudo apt-get install openconnect && sudo apt-get install network-manager-openconnect && sudo apt-get install network-manager-openconnect-gnome
After you install the required packages, reboot your computer to finalize the settings. When you login again, you should see the "VPN Connections" setting to appear on the Network Manager applet(same place where the other network connections are found). Next, click the Network Manager, VPN Connections, Configure VPN, Add. (see image below)
Next, select "Cisco AnyConnect Compatible VPN (openconnect)" and click Create. (see image below)
Then enter the gateway IP address or DNS name to connect to (this comes from your IT dept), Enter a name for the connection, check "Connect automatically", (optional depending on your company network) Enter the internal DNS servers and Search Domains for your company network(IT dept for this) on the IPv4 Settings Tab. (see image below)
(optional)For split tunneling (allows you to go out of your regular connection to the Internet as opposed to through the VPN) From the IPv4 tab, click Routes, check "Use this connection only for resources on its network", click OK, click Save, click Close (to close Network Connections) and voila, you're all set.
To connect, establish your regular Internet connection first, then click the Network Manager, mouse over "VPN Connections", click the name of the VPN you created. If all went well, you'll be presented with place to enter your anyconnect username/password and you can connect. Whey you see a small lock in the Network Manager - that means VPN is connected and you should have access to your network.
**** To enable the universe repositories:
Launch the Applications, "Ubuntu Software Center", click Edit, click "Software Sources" (see image below)
Feel free to leave a comment if you like.
1/6/15: Many Thanks to +Tonya Ohrel in the comments for replying with the additional manager-openconnect-gnome being needed for the newer Ubuntu.
Cheers!
Shannon VanWagner
Thank you very much. Now I know what to do next time.
ReplyDeleteusa vpn
If you are looking for instructions related to using the open source alternative to the Cisco Systems VPN client, look for Cisco Systems VPN with Ubuntu 11.10 / 10.10 GNU/Linux.
ReplyDeleteThis is why I love Ubuntu or any Linux operating system. Their easy to use and almost have everything you need on their large array of opensource programs.
ReplyDeleteIs there an add-on package that needs to be installed before you gain VPN connection in your system?
ReplyDeleteWeb Hosting UK
Thanks, Shannon. I've been using the native Cisco installation up to now (Fedora, Red Hat), but hit a wall with Ubuntu. Rather than hack at it, I just followed the OpenConnect road :)
ReplyDeleteWorks Successfully. No Failures and Stable.
ReplyDeleteYou saved me from a lot of driving! I can telecommute again! :-) One quick typo though.
ReplyDeleteYou posted:
sudo apt-get network-manager-openconnect
Should be:
sudo apt-get install network-manager-openconnect
Thank you so much for this!!
@Doug - Awesome.. Thanks for noticing, and for commenting about it! I really appreciate it! I've corrected the posting.
ReplyDeleteperfect! - thank you so much!
ReplyDeleteYou saved my Life!!!
ReplyDeleteThank you very much!
This is awesome and with the RDP viewer it is allowing me to work from home as well.
ReplyDeleteThank you
Awesome ! thank you!
ReplyDeleteI'm so glad it worked. Thanks a lot. I wish you longevity and happiness.
ReplyDeleteWoked... Thanks a ton!!
ReplyDeleteThis worked beautifully on 12.04 as well. Thank you!
ReplyDeleteGreat post. Thank you for this.
ReplyDeleteI had a lot of problem with cisco anyconnect. This works great!! Thanks a lot!
ReplyDeleteMuch appreciated, cheers.
ReplyDeleteVery nicely explained; thank you! (my work's it services pointed me here when the cisco client ran into some inexplicable - for them - problems)
ReplyDeleteVery helpful.It saved my day :)
ReplyDeleteAwesome. Your post helped a lot. Thanks tons!
ReplyDeleteHello, I get this message:
ReplyDeleteCertificate from VPN server "ucfvpn-1.vpn.ucf.edu" failed verification.
Reason: unable to get local issuer certificate
Do you want to accept it?
What should I do?
OpenConnect works really nicely.
ReplyDeleteHowever my Ubuntu 12.04 LTS is stuck with OpenConnect version 3.15.
Unfortunately 'openconnect --no-proxy' crashes in this version.
Is there an easy Ubuntu way how to get a newer openconnect package?
As the Ubuntu Software Center says that Canonical does not provide updates
for this package... Does that mean I am stuck forever with version 3.15?
Thanks for any advice.
@Ivosh - You can get version 4.05 from "Adam Stokes" untrusted PPA as follows:
ReplyDeleteThe newer version depends on vpnc-scripts.. install that from here first:
http://ppa.launchpad.net/kubuntu-ppa/backports/ubuntu/pool/main/v/vpnc-scripts/vpnc-scripts_0.1~git20120602-2~precise1~ppa1_all.deb
#Info page at http://www.ubuntuupdates.org/package/kubuntu-ppa_backports/precise/main/base/vpnc-scripts
Then, add "Adam Stokes" PPA (I do not know this person but he's been on launchpad since 2005):
sudo add-apt-repository ppa:adam-stokes/openconnect
Then install the upgraded packages:
sudo apt-get update && sudo apt-get install openconnect network-manager-openconnect --reinstall
I tested the package above and it works for me.
If you're concerned about rolling back - you might want to insert this as step 1: sudo apt-get install ppa-purge
Good Luck!
I had the same problem as @iloveX
ReplyDeleteReason: unable to get local issuer certificate
Any thoughts?
@iLoveX, @Alex B. Hill... It sounds like the place you're trying to connect to has some kind of funky Intermediate cert or something:
ReplyDeleteHere's what Firefox web browser shows for the error:
ucfvpn-1.vpn.ucf.edu uses an invalid security certificate.
The certificate is not trusted because no issuer chain was provided.
(Error code: sec_error_unknown_issuer)
Maybe you could ask the administrator at the site as to why their certificate causes the error noted above. They will probably say to go ahead and trust it, but who knows.
If you're looking for a more technical answer - maybe this can help:
http://stackoverflow.com/questions/12041512/openssl-unable-to-get-local-issuer-certificate-unless-cafile-is-explicitly-speci
Very helpful article - thanks
ReplyDeleteOnce in while you get to be a little lucky running Ubuntu (besides the general state of luckiness or even happiness it brings); My VPN on my Ubuntu 13.04 was up an running 60 seconds after I found this post. My colleague running Windows has now been waiting for a client for most of the day, since you need a Cisco login to download the Anyconnect client for Windows.
ReplyDeleteI am using 12.04. Where do I give the group and user passwords?
ReplyDeleteThanks for the great tutorial.
ReplyDeleteThank you for this post.
ReplyDeleteThanks a lot!
ReplyDeleteAfter a successful installation, any comments on how the VPN connection can be started from the command line without having to click the Login button?
Thanks in advance!
You da man! Thanks a lot.
ReplyDeleteAllow me to repeat like so many before me ... You da man! Thanks a lot.
ReplyDeleteThanks a lot... great tutorial.
ReplyDeleteI am able to connect via Cisco Any Connect however i am unable to access the network. Also, no error is thrown
ReplyDeleteThank you so much . . I am able to connect to VPN without worrying about instructions for installing anyconnect client
ReplyDelete