ASA SSL VPN
SSL VPN reliable, efficient and safe option for traffic from internet users on e-commerce sites where there may be user sessions 2000 per second from all over the world.
Thank you.
In my opionon - SSL is reliable, efficient and safe if not all banks around the world would not use it for online banking.
HTH >
Tags: Cisco Security
Similar Questions
-
ASA SSL VPN with RSA authentication
All those implemented SSL VPN on a device of the ASA using remote Securid tokens? The technical sheets indicate native RSA can be used for authentication, but this works with SSL VPN?
Thank you
Try this link
http://www.Cisco.com/en/us/products/ps6120/prod_release_note09186a0080688004.html
-
Same license for different ASA SSL VPN
Hello
I have run ASA5510 SSL VPN is installed with a license. I want to replace it with the new ASA5510 without SSL VPN license. Is it possible to copy the license from my old ASA? Can I order different license for my new box?
THX
Iwan
A new license is required.
License key is created based off the serial number of the device.
Gilbert
-Rate, if it helps-
-
DHCP relay for users (ASA) SSL VPN
I have ASA 5520 vpn endpoint. Before asa, there are firewalls which translates the public ip address to the private sector and to pass SSL traffic to ASA. I have configured DHCP relay to get the IP address for the DHCP in Windows Server users:
dhcprelay Server 10.100.2.101 on the inside
dhcprelay activate vpn
dhcprelay setroute vpn
and it does not work. with the local pool, it works fine. Should I do something else? When I turn on debugging it has not any activity.
You try to assign the IP address to the SSL vpn client using the DHCP server?
If so, you don't need these commands contained in your message.
Basically, you need to set dhcp server in tunnel-group and dhcp-network-scope in group policy.
Here is an example of Ipsec client. Setup must be the same.
-
Cisco ACS 5.1 and ASA SSL VPN change or notify the expired password
Hello
Now, my ACS and ASA related to RADIUS (MSCHAPv2). I've set up password life on GBA and password management on SAA. But Cisco ASA did prompt change or whatever it is to notify when the user tries to log on with Clientless SSL VPN. Could you advice me everything to change, or notify the expired password?
PS.
I check change password on the first login of th on ACS this confirmation of the ASA to change password dialog box. But I want change or warn when the expired password
Thank you
The default password is marked as disabled after expiry
I think that there is an improvement for this in the 5.2.0.26.2 patch and above, which includes the following:
CSCtk32168: Add an option to change the password when the password expires (T + and Radius)
After you install this hotfix, you get an option to the user authentication settings is:
-Disable the user account
-Expire the password
When the expiration period is exceeded
If password is expired then user will be asked to change password next authentication
Note this latest patch for 5.2 is 5.2.0.26.4. All patches are cumulative
-
Multi frame ASA SSL VPN Question
Hello
We have a pair of firewalls, we do multiple contexts on clients. We have recently updated their and have been using the newly Anyconnect customer support. This all works fine but I feel I'm missing something. If the customer does not have the anyconnect client already how do get? Normally, you go to the web page and it will download the client, but all I get is "Clientless VPN is not supported in context mode Multiple." which is good, but how is the customer supposed to to get the customer in the first place?
Any information would be helpful.
Chris L.
Hi Chris,
The AnyConnect WebLaunch feature is not supported in ASA running on multi-contexte mode.
There is a demand of improvement that has been opened to allow this as other characteristics while ASA in multi mode context. Here is the link, you can refer:
https://Tools.Cisco.com/bugsearch/bug/CSCuw19758/?reffering_site=dumpcr
Kind regards
Aditya
Please evaluate the useful messages and mark the correct answers.
-
ASA SSL VPN problem with 8.2 (2)
Hello everyone,
I have a couple of ASA 5520 image 8.2 (1) running in active failover mode / standby.
A few months ago, I downloaded the 8.2 (2) on the cisco website and charge to the ASA.
After loading the new image, they called me for problems
functioning of the application of webvpn.The web app seems to work, but in a mode of read-only, because you could not
change the content of the files.
I couldn't find a way to make it work, so I decided to downgrade to 8.2 (1).
and as I loaded it the old image, the problem disappeared.Now I see that it is available the image 8.2 (3).
To avoid the risk of hard work I tetsted on a piece of spare 5510, and with the disappoint, I found
the problem was the same.Everyone is facing such a problem or can suggest me how to solve?
Thanks in advance.
Marco.
Can you please provide more details about what application does not work through WebVPN interface without client? Have you tried to activate Smart Tunneling for this application?
-
Cisco ASA (SSL VPN)-based user portal?
Hi all
I am looking for a solution, different portals (WEBVPN) that can be assigned to different users.
For example:
-'test1' user and see the portal "-1".
-user "test2", "test3" connect and see the portal "-2".
I know, it can be done with the alias for each portal entry, but I want a transparent solution for the user (such as Juniper SA2000).
In addition, it should be possible to authenticate via RADIUS (no local authentication on the SAA).Who did such a set upward?
Thank you
Norbert
Hello
The attribute 25 (it's called 'Class') and set its value to UO = MyVPNGroupPolicy where MyVPNGroupPolicy is the name of your group strategy in the SAA.
I hope this helps.
Kind regards
Anisha
P.S.: Please mark this thread as answered if you feel that your query is resolved. Note the useful messages.
-
Hello
Here is the configuration:
(Location A) - Internet users - ASA (ssl vpn) - location
situation users use ssl vpn over the Internet to connect to resources in the location b. is successful.
However, A users location need access to their own network resources internal to A while they are still connected to the SSL VPN.
So if a user of location is connected to the ssl vpn, they can ping to ip addresses in the location B, but their own network internal ip is second to pings.
ASA worm is 8.0 (4)
Please help, how it can be done, and if there is a different Setup for this. Do we need to use the tunnel.
Thanks in advance.
Correct, so instead of tunneling ALL traffic, you only tunnel 154.65.0.0/22
sslvpnsplittunnel standard access list ip 154.65.0.0 allow 255.255.252.0
Apply the ACL to the SSL VPN group policy
-
ASA from Site to Site and SSL VPN stop working
Thanks in advance for any advice
We have an ASA 5510, users were able to connect via to all connect without any problems. We opened a new office with an ASA 5505 and decided to give VPN site-to-site on IPSec. We used the basic wizard and everything went smoothly at both ends. However, users who always used SSL VPN says so that they can connect to the original site, they are no longer in their RDP virtual machines or get anywhere on the network. I don't know why something like this can happen.
You can change the SSL VPN DHCP scope to give a different subnet for IP addresses. Maybe try 192.168.10.0 255.255.255.0. Let me know if you can and if that corrects the issue.
Sent by Cisco Support technique iPhone App
-
Cisco ASA AnyConnect SSL VPN - certificates + token?
Hello
I'm looking for an answer is it possible such configuration:
The Cisco AnyConnect SSL VPN service with two-factor - first method is the Microsoft CA certificate local and second method - a token solution Symantec VIP password?
I don't know if two-factor authentication is user/password from Active Directory + OTP by Symantec VIP there is no problem, because you can send the user + pass with Radius, but with certificates I do not really understand who will check the validity of the certificate, which certificate, we will send you to the RADIUS for the validation server and how the configuration of the point of view of ASA will look like.
Thank you very much for the help!
Hi Alex,
I don't see a problem with having certificate + token to connect to the VPN. Certificate authentication must be performed on the SAA, see an example below:
https://supportforums.Cisco.com/blog/152941/AnyConnect-certificate-based-authentication
Authentication token can be specified as primary/secondary (authentication SDI) on the SAA, an example below:
It may be useful
-Randy-
-
Cannot access internal network so AnyConnect SSL VPN, ASA 9.1 (6)
Hello Cisco community support,
I have a lab which consists of two virtual environments connected to a 3750-G switch that is connected to a 2901 router which is connected to an ASA 5512 - X which is connected to my ISP gateway. I configured SSL VPN using AnyConnect and can establish a VPN to the ASA from the outside but once connected, I can't access internal network resources or access the internet. My information network and ASA configuration is listed below. Thank you for any assistance you can offer.
ISP network gateway: 10.1.10.0/24
ASA to the router network: 10.1.40.0/30
Pool DHCP VPN: 10.1.30.0/24
Network of the range: 10.1.20.0/24
Development network: 10.1.10.0/24
: Saved
:
: Serial number: FCH18477CPT
: Material: ASA5512, 4096 MB RAM, CPU Clarkdale 2793 MHz, 1 CPU (2 cores)
:
ASA 6,0000 Version 1
!
hostname ctcndasa01
activate bcn1WtX5vuf3YzS3 encrypted password
names of
cnd-vpn-dhcp-pool 10.1.30.1 mask - 255.255.255.0 IP local pool 10.1.30.200
!
interface GigabitEthernet0/0
nameif inside
security-level 100
IP 10.1.40.1 255.255.255.252
!
interface GigabitEthernet0/1
nameif outside
security-level 0
address IP X.X.X.237 255.255.255.248
!
interface GigabitEthernet0/2
Shutdown
No nameif
no level of security
no ip address
!
interface GigabitEthernet0/3
Shutdown
No nameif
no level of security
no ip address
!
interface GigabitEthernet0/4
Shutdown
No nameif
no level of security
no ip address
!
interface GigabitEthernet0/5
Shutdown
No nameif
no level of security
no ip address
!
interface Management0/0
management only
nameif management
security-level 100
IP 192.168.1.1 255.255.255.0
!
boot system Disk0: / asa916-1-smp - k8.bin
boot system Disk0: / asa912-smp - k8.bin
passive FTP mode
permit same-security-traffic intra-interface
network of the NETWORK_OBJ_10.1.30.0_24 object
10.1.30.0 subnet 255.255.255.0
network obj_any object
network obj_10.1.40.0 object
10.1.40.0 subnet 255.255.255.0
network obj_10.1.30.0 object
10.1.30.0 subnet 255.255.255.0
outside_access_in list extended access permitted ip object NETWORK_OBJ_10.1.30.0_24 all
FREE access-list extended ip 10.1.40.0 NAT allow 255.255.255.0 10.1.30.0 255.255.255.0
access-list 101 extended allow any4 any4-answer icmp echo
access-list standard split allow 10.1.40.0 255.255.255.0
pager lines 24
Enable logging
asdm of logging of information
Within 1500 MTU
Outside 1500 MTU
management of MTU 1500
ICMP unreachable rate-limit 1 burst-size 1
ICMP allow any inside
ICMP allow all outside
ASDM image disk0: / asdm - 743.bin
don't allow no asdm history
ARP timeout 14400
no permit-nonconnected arp
NAT (inside, outside) source obj_10.1.40.0 destination obj_10.1.40.0 static static obj_10.1.30.0 obj_10.1.30.0 non-proxy-arp-search to itinerary
NAT (inside, outside) static source any any static destination NETWORK_OBJ_10.1.30.0_24 NETWORK_OBJ_10.1.30.0_24 non-proxy-arp-search to itinerary
Access-group outside_access_in in interface outside
!
Router eigrp 1
Network 10.1.10.0 255.255.255.0
Network 10.1.20.0 255.255.255.0
Network 10.1.30.0 255.255.255.0
Network 10.1.40.0 255.255.255.252
!
Route outside 0.0.0.0 0.0.0.0 10.1.10.1 1
Timeout xlate 03:00
Pat-xlate timeout 0:00:30
Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
Floating conn timeout 0:00:00
dynamic-access-policy-registration DfltAccessPolicy
without activating the user identity
identity of the user by default-domain LOCAL
Enable http server
http 192.168.1.0 255.255.255.0 management
http 192.168.1.0 255.255.255.0 inside
http X.X.X.238 255.255.255.255 outside
No snmp server location
No snmp Server contact
Crypto ipsec pmtu aging infinite - the security association
Crypto ca trustpoint ASDM_Launcher_Access_TrustPoint_0
registration auto
full domain name no
name of the object CN = 10.1.30.254, CN = ctcndasa01
ASDM_LAUNCHER key pair
Configure CRL
trustpool crypto ca policy
string encryption ca ASDM_Launcher_Access_TrustPoint_0 certificates
certificate c902a155
308201cd 30820136 a0030201 020204c 0d06092a 864886f7 0d 010105 9 02a 15530
0500302b 31133011 06035504 03130 has 63 61736130 31311430 12060355 74636e64
0403130 31302e31 2e33302e 32353430 1e170d31 35303731 32303530 3133315a b
170d 3235 30373039 30353031 33315 has 30 2 b 311330 0403130a 11060355 6374636e
64617361 30313114 30120603 55040313 0b31302e 312e3330 2e323534 30819f30
0d06092a 864886f7 010101 05000381 8 d 0d 003081 89028181 00a47cfc 6b5f8b9e
9b106ad6 857ec34c 01028f71 d35fb7b5 6a61ea33 569fefca 3791657f eeee91f2
705ab2ea 09207c4f dfbbc18a 749b19ae d3ca8aa7 3370510b a5a96fd4 f9e06332
4355 db1a4b88 475f96a1 318f7031 40668a4d afa44384 819d fa164c05 2e586ccc
3ea59b78 5976f685 2abbdcf6 f3b448e5 30aa96a8 1ed4e178 0001300 020301 4 d d
06092a 86 01010505 00038181 0093656f 639e138e 90b69e66 b50190fc 4886f70d
42d9b4a8 11828da4 e0765d9c 52d84f8b 8e70747e e760de88 c43dc5eb 1808bd0f
fd2230c1 53f68ea1 00f3e956 97eb313e 26cc49d7 25b927b5 43d8d3fa f212fcaf
59eb8104 98e3a1d9 e05d3bcb 428cd7c6 61b530f5 fe193d15 ef8c7f08 37ad16f5
d8966b50 917a88bb f4f30d82 6f8b58ba 61
quit smoking
Telnet timeout 5
SSH stricthostkeycheck
SSH timeout 5
SSH group dh-Group1-sha1 key exchange
Console timeout 0
VPN-addr-assign local reuse / 360 time
management of 192.168.1.2 - dhcpd address 192.168.1.254
enable dhcpd management
!
a basic threat threat detection
Statistics-list of access threat detection
no statistical threat detection tcp-interception
Trust ASDM_Launcher_Access_TrustPoint_0 vpnlb-ip SSL-point
SSL-trust outside ASDM_Launcher_Access_TrustPoint_0 point
WebVPN
allow outside
AnyConnect image disk0:/anyconnect-linux-3.1.09013-k9.pkg 4
AnyConnect image disk0:/anyconnect-macosx-i386-3.1.09013-k9.pkg 5
AnyConnect image disk0:/anyconnect-win-3.1.09013-k9.pkg 6
AnyConnect enable
tunnel-group-list activate
internal GroupPolicy_cnd-vpn group policy
GroupPolicy_cnd-vpn group policy attributes
WINS server no
value of server DNS 8.8.8.8
client ssl-VPN-tunnel-Protocol
by default no
xxxx GCOh1bma8K1tKZHa username encrypted password
type tunnel-group cnd - vpn remote access
tunnel-group global cnd-vpn-attributes
address-cnd-vpn-dhcp-pool
strategy-group-by default GroupPolicy_cnd-vpn
tunnel-group cnd - vpn webvpn-attributes
activation of the alias group cnd - vpn
!
ICMP-class class-map
match default-inspection-traffic
class-map inspection_default
match default-inspection-traffic
!
!
type of policy-card inspect dns preset_dns_map
parameters
maximum message length automatic of customer
message-length maximum 512
Policy-map icmp_policy
icmp category
inspect the icmp
Policy-map global_policy
class inspection_default
inspect the preset_dns_map dns
inspect the ftp
inspect h323 h225
inspect the h323 ras
inspect the rsh
inspect the rtsp
inspect esmtp
inspect sqlnet
inspect the skinny
inspect sunrpc
inspect xdmcp
inspect the sip
inspect the netbios
inspect the tftp
Review the ip options
inspect the icmp
!
global service-policy global_policy
service-policy icmp_policy outside interface
context of prompt hostname
no remote anonymous reporting call
Cryptochecksum:261228832f3b57983bcc2b4ed5a8a9d0
: end
ASDM image disk0: / asdm - 743.bin
don't allow no asdm historyCan you confirm that this is correct, your diagram shows your IP address public on ASA as 30 while you have assinged on 'outside' interface like 29?
-
SSL VPN - ASA - Active Directory LDAP
Hello
Scenario: ASA 8.0 (3) running SSL VPN for remote users. LDAP also authenticates access and connect to the ASA.
For some reason any (we had a power failure, but the problem may be caused by other reasons as well), I can not connect to the ASA, as my login ID does not work, and remote users get connection error when trying to authenticate via SSL VPN web gui.
I have rebooted the ASA and AD without any change in the situation. This service worked very well before and the problem happened suddenly. No one has all the changes for the configs. Customer do not have a backup configuration. Any suggestion on what would be the best next action to solve this problem? I'm not expert on the Microsoft LDAP configuration, and if anyone knows where I can check in Microsoft windows server 2003 for the possible LDAP problem, that would be greatly appreciated.
Thank you
rdianat
the ldap bind account is just a normal user account. He didn't need even administrative permissions. If you want to use ldap for password changes he needs to password change permissions, but otherwise just a normal user account - make sure it cannot be locked in AD or the password never expires none of this things. you will see the name of the ldap account in the config of the SAA.
LDAP-login-password *.
LDAP-connection-dn *.
-
SSL VPN using ASA 5520 mode cluster - several problems
I configured 2 ASA 5520 s in the load balancing cluster mode. I connect using anyconnect and I download the customer the first time and everything works well except outlook. I don't know why outlook does not work.
The second problem is after the anyconnect client is installed on your machine, he remembers that ASA (say ASA2) he first connected and the GUI shows the address IP of ASA2 instead of the virtual IP address of the cluster. I want users always connect using the virtual IP address.
The third problem I have is there is a default group of SSL VPN and I want all users to use this group. In the initial web page, there is a drop down menu which shows that this group, but I still want to disable this menu drop-down.
Any suggestions?
To disable the drop-down menu, you can turn it off with the command
WebVPN
no activation of tunnel-group-list
This will take care of your last issue.
***************************
You can create a profile of the Anyconnect client with the name of the server you want to connect with and that make the ASA that will solve your problem of virtual IP.
**************************
Regarding Outlook, do you use specific ports which allows inspection of the ASA. Take a look at the list of inspection on the SAA and perhaps try to disable inspection and see if it works.
*****************************
-
ASA VPN positive = SSL VPN?
Hello
I have a pair of FO, I need to exchange an ASA5520 who owns a license of VPN over 750
Can I use an ASA5520 with ASA5500-SSL-750 instead
Regards Tony
Yes, it is always available on order. Part number: ASA5520-VPN-PL =
In addition, this more ASA VPN would be much much cheaper than the SSL VPN license.
Thank you
Kiran
Maybe you are looking for
-
I recently downloaded version 10.0.2 Apple software update on my 5 and the battery drains too quickly. It never happened until this update. How to fix this problem?
-
Why do I get blank bubbles in SMS
When receiving emoticons by text from people on another carrier, he sends me an empty bubble. How can I fix it?
-
Display does not work on Satellite P500-1DZ
Hello P500-1dz screen went black. No sign of anything whatsoever on the screen so haven't tried a new screen. Still no display.Equip new inverter. Still no display. Replaced the Ribbon to the back of the monitor cable.Still nothing. Hooked on the VGA
-
Hello I'm a teacher-assistant manager of a few sessions in the laboratory where mechanical engineering students use the MyDAQ modules to learn more about the measures. In one experiment, we use both the 5V and +/-15V power sources a wheatstone bridge
-
Window error when you export the mp3 file
I have used audacity for awhile with no problems... now all of a sudden I can't export to a cd. What has changed or gone wrong?