Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Disclaimer: I am not a network admin so I may be wrong here but I thought asking here would help. I'm a developer mainly on the .net framework as well as helping get a mobile intranet app working.

Because this app is only allowed to be used on our network I can easily run this app on our wireless network connection within our building. All is fine and dandy but we'd also like to be able to run this mobile app at say a customer plant using VPN software.

I thought surely this could be easy as we exclusively use Samsung s4 phones so I thought I'd download Cisco's Samsung any connect software to allow us to VPN...its right on the play store.

Sure enough it doesn't work. I mention it to our network admin who says not possible since we have old technology that doesn't support SSL. He mentions we'd have to upgrade all of our hardware, the firewall, etc. to get this to work.

We really need VPN on our phones not only for this app but other internal apps, etc.

He did mention the following:

We can’t upgrade the software on our ASA, because we don’t have enough memory for the new version.  (the asa is very old).  We can’t add more memory, so we would have to get a new firewall, which I have been told I cannot do.

In addition he also mentioned:

The Samsung AnyConnect client uses SSL to connect.  With the current (old) version of software that our firewall is running, the SSL connections are unreliable.  We need different hardware in order to upgrade our firewall, which we are unable to attain at this time.  This is the same reason that Windows 8 clients are not able to connect.

I am curious hence me asking. vpns seem to be fairly simple to setup. What other options do I have aside from making this a public site or web service that consumes this data over the internet as this is a complete no no.

What can we do to make this work without that much effort or cost.

share|improve this question
How many users would need this VPN simultaneously? – ewwhite Aug 14 '14 at 22:24
Ewwhite not many simultaneously maybe five to ten max (if even that). – JonH Aug 14 '14 at 22:26
How did this play out? – ewwhite Aug 23 '14 at 10:31
Well for now i used the native client to get it to work until i can get over all the politics of something that to me shouldnt be a political topic. But your answer is awesome and thorough. – JonH Aug 23 '14 at 14:28
up vote 3 down vote accepted

Cisco ASA firewalls all support SSL VPN.

Depending on the edition and version of the firewall (Cisco ASA 5505, 5510, 5520, etc.), there's a limit to the number of simultaneous SSL VPN users that can connect.

Please see this Cisco licensing reference guide.

  • Please find out which version of Cisco ASA firewall you have.
  • RAM for Cisco firewalls is relatively cheap.
  • If this is an ASA 5505, you'll want 512MB RAM.
  • If not, a newer ASA5505 unit will be ~$500 and should have the requisite RAM for your 5-10 user needs.
  • The ballpark price of the necessary licensing for an ASA 5505 is under $200 (maximum 12, I think).
  • If you have an ASA 5510, you have more than enough RAM for this.
  • Ballpark price for a group of Anyconnect SSL VPN licenses (250) is $250 for an ASA 5510 - L-ASA-AC-E-5510= and L-ASA-AC-M-5510=


The barrier to entry here is low, and it's really a matter of getting assistance from someone who's familiar with this. You ASA software can be updated. I don't think there are any ASA5510 units out there that are incapable of running version 8.4 of the ASA software. Going to the newer 9.x software may require RAM modification on your specific unit, but again, the cost is low.

AnyConnect Licensing for Dummies...

enter image description here

share|improve this answer
From your answer it seems this is rather cheap and not too much work involved? – JonH Aug 15 '14 at 0:04
@JonH it's relatively inexpensive, regardless of the version of the ASA firewall version. The work is a little involved, but it sounds like your internal IT is putting up a barrier because they probably don't know how to configure AnyConnect. I'm guilty of having done this in the past. And then I learned how to deal with it. At this point it does become a political battle. Your IT person doesn't want to do this. Hopefully the above information helps add a voice of reason. Don't be afraid to request outside help or suggest an expert to assist your efforts. This is less than an hour's work. – ewwhite Aug 15 '14 at 0:12
Thank you this is an awesome answer. – JonH Aug 15 '14 at 0:23
ewwhite its a Cisco 5510 does that make it easier? – JonH Aug 15 '14 at 0:40
@JonH A Cisco ASA 5510 is fully capable of the SSL VPN load you're describing. – ewwhite Aug 15 '14 at 1:00

If there is an existing Cisco non-ssl VPN, then your Samsung S4's probbaly already support it natively. It should be an IPSec Xauth PSK. You'll have to ask them for the appropriate group name and PreShared Key.

settings->WIRELESS & NETWORKS->More...->VPN->+->Type: IPSec Xauth PSK

share|improve this answer
This worked as well, thank you so much. – JonH Aug 15 '14 at 14:51

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.