LGfL Freedom2Roam - Cisco AnyConnect

[Koldov]

 

I have 2 issues that I need sorting out urgently as remote workers cannot log in (see screenshot).

Firstly, Cisco AnyConnect has updated again... and failed again... so that's left my remote workers with a broken install that cannot be remedied. I have previously asked for this feature to be removed, or allow it to be a manual process, or at the very least for us to be informed when this is going to happen as it always breaks the install if not done by an administrator.

Secondly, I have asked my staff to try the web access but we just get an error that the RDP server is currently unreachable. I've looked through the settings but cannot see what's wrong.

 

I'm really concerned with opening RDP access anyway via the web, even with 2FA/OTP so I'd rather not have to use this option, but currently nobody can work remotely.

 

@PaddyNewman - Ref 654373 (if you're about?) ☺️

[PaddyNewman]

I will take a look, but 2 things break that RDP via F2R, NLA enabled or Windows firewall can whitelist the sources to lock it down more if you want.

 

Afraid Cyber Essentials requirement forced the update, it had a serious CVE which fails Cyber Essentials. Have heard some devices getting in a fiddle though when non-admin!

[Koldov]

Thanks Paddy,

Yeah it happens every time. We have more and more staff working in other schools that remote back, IP sources at least would be pretty random. IIRC I asked for an update a few years ago due to finding out there was a CVE...

Looks like the web is a bust for us then, we do have NLA enabled... isn't NLA for RDP a key step in meeting Cyber Essentials requirements... and RDP only recommended for internal networks.

[PaddyNewman]

Technically it is internal, its an internal server talking to another. You can limit sources on Windows firewall and remove NLA, problem with NLA and a remote source such as F2R, you are required to store credentials.. which feels a bit worse to me!