Impossible for users of vpn SSL ping
I have install several ASA with Anyconnect SSL VPN function, but I have never been able to ping to an IP address that has been assigned to the remote user. I'd be able to ping the remote user? Do I need to configure anything in any political group or the user to activate this?
Triton
Triton,
Absolutely, you will be able to ping the RA client when it connects, if the customer is able to ping your internal resources, but the connection does not work the other way, then most likely the RA client firewall blocking the packets. Most of the software including Windows Firewall Firewall delete unsolicited incoming traffic that does not match a traffic sent in response to a request of the computer (solicited traffic) or unsolicited traffic that has been specified as allowed (except traffic).
Kind regards.
Tags: Cisco Security
Similar Questions
-
Downloadable ACLs for users of VPN
Hello
I replaced the old pix with ASA (7.2). There were groups configured for the remote VPN users authenticated through the ACS and ACS download a specific ACL for each group to the PIX. After the replacement, users cannot establish the VPN connection. After troubleshooting, I discovered that the downloadable ACLs were not working very well. When I disabled this option the established tunnel. When I get back to the old pix with the same configuration, it works very well with downloadable ACL option. I opened a TAC case and he said the v3.0 ACS (I) are not compatible with the ASA. He did not really convince me and he asked to try to use the option to pair AV. I tried option pair AV with ASA and it did not work also. can you please advice.
Hello
Check out this point,
In addition, 3.0 is very old, and I guess that in this version, we have "Downloadable PIX ACL" and not "downloadable IP ACL", on ASA download able ACL will work but with "Downloadable IP ACL" but not with "Downloadable PIX ACL".
Kind regards
Prem
-
Group-lock for users of vpn with acs
Hello
Is it possible to controll what VPN profile, a user is allowed to use by Cisco ACS or the router?
2811 router IOS 12.4 worm, ACS 4.1 using
I just want to be sure that the VPN allows the user only the Client Profile assigned to them and no other profile groups.
Example:
User123abc gets their hands on a profile of co-wokers.
HR_User_Profile.pcf
SALES_User_Profile.pcf
User123abc belongs to the Department of human resources and should be able to authenticate with HR_User_Profile. If User123abc is trying to authenticate by using the access SALES_User_Profile should be rejected.
Any documentation explaining how to set up?
The ASA will be your option. This should be controlled by the values of tunnel-group and class-group policy, group-lock, ACS and ASA
-
blocking of websites for users of vpn ipsec offline
Hello
We use asa 5520's as our firewalls and our vendors sign in via ipsec vpn client v5. with our previous checkpoint firewall and clients, we could add a default policy, which would be active while the client was not connected which would limit that sellers sites could visit not connected to the firewall.
with our new configuration of cisco, we are able to restrict what Web sites they visit while they are connected, but once they log off of the firewall they have unlimited access to the Internet. Is there a way to be limited to a list of pre-defined business related sites?
Thank you
Sam
Sorry for the late reply.
I don't think that you can inject a rule of firewall policy customized to the VPN client when they are not connected.
You can use the stateful always on the firewall, but you can't customize it AFAIK.
Apply a proxy on laptops you describe could be a better solution.
Federico.
-
For users remote if RADIUS or ldap services available VPN servers are not there?
Dear people,
I have ASA Adaptive Security Appliance 5510 with below features.
Now, what is the best way to setup VPN for remote users to securely, if I have no services LDAP or Radius server.
HOFW # sh flash:
path-# - length - time -.
181 14137344 March 3, 2003 08:36 asa804 - k8.bin
195 436 sep 2012 01 16:28:05 bar.emf
75 4096 November 10, 2011 18:41:26 login
192 1335 November 10, 2011 18:41:26 log/recovery-event.388.20111110.131127
79 4096 19 January 2009 16:12:34 crypto_archive
182 7562988 19 January 2009 16:14:06 asdm - 613.bin
184 4863904 19 January 2009 16:15:44 securedesktop_asa_3_3_0_129.pkg.zip
185 4096 19 January 2009 16:15:46 sdesktop
194 1462 19 January 2009 16:15:46 sdesktop/data.xml
186 2153936 19 January 2009 16:15:46 anyconnect-victory - 2.2.0133 - k9.pkg
187 3446540 19 January 2009 16:15:48 anyconnect-macosx-powerpc - 2.2.0133 - k9.p
kg
188 3412549 19 January 2009 16:15:50 anyconnect-macosx-i386 - 2.2.0133 - k9.pkg
189 3756345 19 January 2009 16:15:52 anyconnect-linux - 2.2.0133 - k9.pkg HOFW # sh flash:
path-# - length - time -.
181 14137344 March 3, 2003 08:36 asa804 - k8.bin
195 436 sep 2012 01 16:28:05 bar.emf
75 4096 November 10, 2011 18:41:26 login
192 1335 November 10, 2011 18:41:26 log/recovery-event.388.20111110.131127
79 4096 19 January 2009 16:12:34 crypto_archive
182 7562988 19 January 2009 16:14:06 asdm - 613.bin
184 4863904 19 January 2009 16:15:44 securedesktop_asa_3_3_0_129.pkg.zip
185 4096 19 January 2009 16:15:46 sdesktop
194 1462 19 January 2009 16:15:46 sdesktop/data.xml
186 2153936 19 January 2009 16:15:46 anyconnect-victory - 2.2.0133 - k9.pkg
187 3446540 19 January 2009 16:15:48 anyconnect-macosx-powerpc - 2.2.0133 - k9.p
kg
188 3412549 19 January 2009 16:15:50 anyconnect-macosx-i386 - 2.2.0133 - k9.pkg
189 3756345 19 January 2009 16:15:52 anyconnect-linux - 2.2.0133 - k9.pkgConcerning
Vesta
"Everybody is genius." But if you judge a fish by its ability to climb on a tree, he will live his entire life, believing that this is stupid. "With the ASA you will be somewhat limited in what you can do for remote-access-VPN.
There are two ways to set that up:
(1) using the SSL - VPN with the AnyConnect Client
To do this, you must license Premium AnyConnect quite expensive for the amount of competitor users you plan to accept or AnyConnect Essentials cheap license which will give you 250 AnyConnect users which is the platform limit.
But for the essential AnyConnect license, you need upgrade your ASA RAM because you need an ASA - latest operating system for it.
But going this path will be the best option.
(2) with the IPSec Client inherited (EasyVPN). The customer is EOL/EOS announced and not all development will get more. But for now, it could be a way to go until you upgrade your ASA.
Here is an example of how to configure your ASA for the old CLient IPSec:
http://www.Cisco.com/en/us/products/ps6120/products_configuration_example09186a008060f25c.shtml
--
Don't stop once you have upgraded your network! Improve the world by lending money to low-income workers:
http://www.Kiva.org/invitedBy/karsteni -
How to use ACS 5.2 to create a static ip address user for remote access VPN
Hi all
I have the problem. Please help me.
Initially, I use ACS 4.2 to create the static ip address for VPN remote access user, it's easy, configuration simply to the user defined > address assignment IP Client > assign the static IP address, but when I use ACS 5.2 I don't ' t know how to do.
I'm trying to add the IPv4 address attribute to the user to read "how to use 5.2 ACS", it says this:
1Ajouter step to attribute a static IP address to the user attribute dictionary internal:
Step 2select System Administration > Configuration > dictionaries > identity > internal users.
Step 3click create.
Static IP attribute by step 4Ajouter.
5selectionnez users and identity of the stage stores > internal identity stores > users.
6Click step create.
Step 7Edit static IP attribute of the user.
I just did, but this isn't a job. When I use EasyVPN client to connect to ASA 5520, user could the success of authentication but will not get the static IP I set up on internal users, so the tunnel put in place failed. I'm trying to configure a pool of IP on ASA for ACS users get the IP and customer EasyVPN allows you to connect with ASA, everything is OK, the user authenticates successed.but when I kill IP pool coufigurations and use the "add a static IP address to the user 'configurations, EzVPN are omitted.
so, what should I do, if anyboby knows how to use ACS 5.2 to create a user for ip address static for remote access VPN, to say please.
Wait for you answer, no question right or not, please answer, thank you.
There are a few extra steps to ensure that the static address defined for the user is returned in the Access-Accept. See the instuctions in the two slides attached
-
Peer AnyConnect VPN cannot ping, RDP each other
I have an ASA5505 running ASA 8.3 (1) and ASDM 7.1 (1). I have a remote access VPN set up and remote access users are able to connect and access to network resources. I can ping the VPN peers between the Remote LAN. My problem counterparts VPN cannot ping (RDP, CDR) between them. Ping a VPN peer of reveals another the following error in the log of the SAA.
Asymmetrical NAT rules matched for flows forward and backward; Connection for icmp outside CBC: 10.10.10.8 outside dst: 10.10.10.9 (type 8, code 0) rejected due to the failure of reverse NAT.
Here's my ASA running-config:
ASA Version 8.3 (1)
!
ciscoasa hostname
domain dental.local
activate 9ddwXcOYB3k84G8Q encrypted password
2KFQnbNIdI.2KYOU encrypted passwd
names of
!
interface Vlan1
nameif inside
security-level 100
IP 192.168.1.1 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
IP address dhcp setroute
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
passive FTP mode
clock timezone CST - 6
clock to summer time recurring CDT
DNS lookup field inside
DNS server-group DefaultDNS
192.168.1.128 server name
domain dental.local
permit same-security-traffic inter-interface
permit same-security-traffic intra-interface
network obj_any object
subnet 0.0.0.0 0.0.0.0
network of the RAVPN object
10.10.10.0 subnet 255.255.255.0
network of the NETWORK_OBJ_10.10.10.0_28 object
subnet 10.10.10.0 255.255.255.240
network of the NETWORK_OBJ_192.168.1.0_24 object
subnet 192.168.1.0 255.255.255.0
access-list Local_LAN_Access note VPN Customer local LAN access
Local_LAN_Access list standard access allowed host 0.0.0.0
DefaultRAGroup_splitTunnelAcl list standard access allowed 192.168.1.0 255.255.255.0
Note VpnPeers access list allow peer vpn ping on the other
permit access list extended ip object NETWORK_OBJ_10.10.10.0_28 object NETWORK_OBJ_10.10.10.0_28 VpnPeers
pager lines 24
Enable logging
asdm of logging of information
logging of information letter
address record [email protected] / * /
exploitation forest-address recipient [email protected] / * / level of information
record level of 1 600 6 rate-limit
Outside 1500 MTU
Within 1500 MTU
mask 10.10.10.5 - 10.10.10.10 255.255.255.0 IP local pool VPNPool
ICMP unreachable rate-limit 1 burst-size 1
ASDM image disk0: / asdm - 711.bin
don't allow no asdm history
ARP timeout 14400
NAT (inside, all) static source all electricity static destination RAVPN RAVPN
NAT (inside, outside) static static source NETWORK_OBJ_10.10.10.0_28 destination NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_10.10.10.0_28
NAT (inside, outside) static source all all NETWORK_OBJ_10.10.10.0_28 of NETWORK_OBJ_10.10.10.0_28 static destination
!
network obj_any object
NAT dynamic interface (indoor, outdoor)
network of the RAVPN object
dynamic NAT (all, outside) interface
Timeout xlate 03:00
Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-registration DfltAccessPolicy
Enable http server
http 192.168.1.0 255.255.255.0 inside
No snmp server location
No snmp Server contact
Community SNMP-server
Server enable SNMP traps snmp authentication linkup, linkdown cold start
Crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
Crypto ipsec transform-set ESP-DES-SHA esp - esp-sha-hmac
Crypto ipsec transform-set esp-SHA-ESP-3DES-3des esp-sha-hmac
Crypto ipsec transform-set ESP-DES-MD5 esp - esp-md5-hmac
Crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
Crypto ipsec transform-set ESP-3DES-MD5-esp-3des esp-md5-hmac
Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac
Crypto ipsec transform-set ESP-AES-128-SHA aes - esp esp-sha-hmac
Crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
Crypto ipsec transform-set ESP-AES-128-MD5-esp - aes esp-md5-hmac
Crypto ipsec transform-set ESP-AES-128-SHA-TRANS-aes - esp esp-sha-hmac
Crypto ipsec transform-set ESP-AES-128-SHA-TRANS mode transit
Crypto ipsec transform-set ESP-DES-SHA-TRANS esp - esp-sha-hmac
Crypto ipsec transform-set ESP-DES-SHA-TRANS mode transit
Crypto ipsec transform-set ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
Crypto ipsec transform-set ESP-AES-192-SHA-TRANS mode transit
Crypto ipsec transform-set ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
Crypto ipsec transform-set ESP-AES-256-SHA-TRANS mode transit
Crypto ipsec transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
Crypto ipsec transform-set ESP-3DES-SHA-TRANS mode transit
life crypto ipsec security association seconds 28800
Crypto ipsec kilobytes of life - safety 4608000 association
Crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 value transform-set ESP ESP-AES-128-SHA ESP - AES - 192 - SHA ESP - AES - 256 - SHA ESP - 3DES - SHA - OF - SHA ESP - AES - 128 - SHA - TRANS ESP - AES - 192 - SHA - TRANS ESP - AES - 256 - SHA - ESP ESP - 3DES - SHA - TRANS TRANS-DES - SHA - TRANS
outside_map card crypto 65535-isakmp dynamic ipsec SYSTEM_DEFAULT_CRYPTO_MAP
outside_map interface card crypto outside
trustpoint crypto ca-CA-SERVER ROOM
LOCAL-CA-SERVER key pair
Configure CRL
Crypto ca trustpoint ASDM_TrustPoint0
registration auto
name of the object CN = ciscoasa
billvpnkey key pair
Proxy-loc-transmitter
Configure CRL
crypto ca server
CDP - url http://ciscoasa/+CSCOCA+/asa_ca.crl
name of the issuer CN = ciscoasa
SMTP address [email protected] / * /
crypto certificate chain ca-CA-SERVER ROOM
certificate ca 01
* hidden *.
quit smoking
string encryption ca ASDM_TrustPoint0 certificates
certificate 10bdec50
* hidden *.
quit smoking
crypto ISAKMP allow outside
crypto ISAKMP policy 10
authentication crack
aes-256 encryption
sha hash
Group 2
life 86400
crypto ISAKMP policy 20
authentication rsa - sig
aes-256 encryption
sha hash
Group 2
life 86400
crypto ISAKMP policy 30
preshared authentication
aes-256 encryption
sha hash
Group 2
life 86400
crypto ISAKMP policy 40
authentication crack
aes-192 encryption
sha hash
Group 2
life 86400
crypto ISAKMP policy 50
authentication rsa - sig
aes-192 encryption
sha hash
Group 2
life 86400
crypto ISAKMP policy 60
preshared authentication
aes-192 encryption
sha hash
Group 2
life 86400
crypto ISAKMP policy 70
authentication crack
aes encryption
sha hash
Group 2
life 86400
crypto ISAKMP policy 80
authentication rsa - sig
aes encryption
sha hash
Group 2
life 86400
crypto ISAKMP policy 90
preshared authentication
aes encryption
sha hash
Group 2
life 86400
crypto ISAKMP policy 100
authentication crack
3des encryption
sha hash
Group 2
life 86400
crypto ISAKMP policy 110
authentication rsa - sig
3des encryption
sha hash
Group 2
life 86400
crypto ISAKMP policy 120
preshared authentication
3des encryption
sha hash
Group 2
life 86400
crypto ISAKMP policy 130
authentication crack
the Encryption
sha hash
Group 2
life 86400
crypto ISAKMP policy 140
authentication rsa - sig
the Encryption
sha hash
Group 2
life 86400
crypto ISAKMP policy 150
preshared authentication
the Encryption
sha hash
Group 2
life 86400
enable client-implementation to date
Telnet 192.168.1.1 255.255.255.255 inside
Telnet timeout 5
SSH timeout 5
Console timeout 0
management-access inside
dhcpd outside auto_config
!
dhcpd address 192.168.1.50 - 192.168.1.99 inside
dhcpd allow inside
!
a basic threat threat detection
threat detection statistics
a statistical threat detection tcp-interception rate-interval 30 burst-400-rate average rate 200
SSL-trust outside ASDM_TrustPoint0 point
WebVPN
allow outside
SVC disk0:/anyconnect-win-3.1.04072-k9.pkg 1 image
SVC profiles DellStudioClientProfile disk0: / dellstudioclientprofile.xml
enable SVC
tunnel-group-list activate
internal-password enable
chip-tunnel list SmartTunnelList RDP mstsc.exe windows platform
internal DefaultRAGroup group strategy
attributes of Group Policy DefaultRAGroup
Server DNS 192.168.1.128 value
Protocol-tunnel-VPN l2tp ipsec
Split-tunnel-policy tunnelspecified
value of Split-tunnel-network-list DefaultRAGroup_splitTunnelAcl
Dental.local value by default-field
WebVPN
SVC value vpngina modules
internal DefaultRAGroup_1 group strategy
attributes of Group Policy DefaultRAGroup_1
Server DNS 192.168.1.128 value
Protocol-tunnel-VPN l2tp ipsec
Dental.local value by default-field
attributes of Group Policy DfltGrpPolicy
Server DNS 192.168.1.128 value
VPN - 4 concurrent connections
Protocol-tunnel-VPN IPSec l2tp ipsec svc webvpn
value of group-lock RAVPN
value of Split-tunnel-network-list Local_LAN_Access
Dental.local value by default-field
WebVPN
the value of the URL - list DentalMarks
SVC value vpngina modules
SVC value dellstudio type user profiles
SVC request to enable default webvpn
chip-tunnel enable SmartTunnelList
wketchel1 5c5OoeNtCiX6lGih encrypted password username
username wketchel1 attributes
VPN-group-policy DfltGrpPolicy
WebVPN
SVC value DellStudioClientProfile type user profiles
username privilege 15 encrypted password 5c5OoeNtCiX6lGih wketchel
username wketchel attributes
VPN-group-policy DfltGrpPolicy
WebVPN
modules of SVC no
SVC value DellStudioClientProfile type user profiles
jenniferk 5.TcqIFN/4yw0Vq1 of encrypted password privilege 0 username
jenniferk username attributes
VPN-group-policy DfltGrpPolicy
WebVPN
SVC value DellStudioClientProfile type user profiles
attributes global-tunnel-group DefaultRAGroup
address pool VPNPool
LOCAL authority-server-group
IPSec-attributes tunnel-group DefaultRAGroup
pre-shared key *.
tunnel-group DefaultRAGroup ppp-attributes
PAP Authentication
ms-chap-v2 authentication
eap-proxy authentication
type tunnel-group RAVPN remote access
attributes global-tunnel-group RAVPN
address pool VPNPool
LOCAL authority-server-group
tunnel-group RAVPN webvpn-attributes
enable RAVPN group-alias
IPSec-attributes tunnel-group RAVPN
pre-shared key *.
tunnel-group RAVPN ppp-attributes
PAP Authentication
ms-chap-v2 authentication
eap-proxy authentication
type tunnel-group WebSSLVPN remote access
tunnel-group WebSSLVPN webvpn-attributes
enable WebSSLVPN group-alias
!
class-map inspection_default
match default-inspection-traffic
!
!
type of policy-card inspect dns preset_dns_map
parameters
maximum message length automatic of customer
message-length maximum 512
Policy-map global_policy
class inspection_default
inspect the preset_dns_map dns
inspect the ftp
inspect h323 h225
inspect the h323 ras
inspect the rsh
inspect the rtsp
inspect esmtp
inspect sqlnet
inspect the skinny
inspect sunrpc
inspect xdmcp
inspect the sip
inspect the netbios
inspect the tftp
Review the ip options
!
global service-policy global_policy
173.194.64.108 SMTP server
context of prompt hostname
HPM topN enable
Cryptochecksum:3304bf6dcf6af5804a21e9024da3a6f8
: end
Hello
Seems to me that you can clean the current NAT configuration a bit and make it a little clearer.
I suggest the following changes
network of the VPN-POOL object
10.10.10.0 subnet 255.255.255.0
the object of the LAN network
subnet 192.168.1.0 255.255.255.0
PAT-SOURCE network object-group
object-network 192.168.1.0 255.255.255.0
object-network 10.10.10.0 255.255.255.0
NAT static destination LAN LAN (indoor, outdoor) static source VPN-VPN-POOL
destination VPN VPN-POOL POOL static NAT (outside, outside) 1 static source VPN-VPN-POOL
NAT interface (it is, outside) the after-service automatic PAT-SOURCE dynamic source
The above should allow
- Dynamic PAT for LAN and VPN users
- NAT0 for traffic between the VPN and LAN
- NAT0 for traffic between the VPN users
You can then delete the previous NAT configurations. Naturally, please save the configuration before you make the change, if you want to revert to the original configuration.
no static source nat (inside, everything) all electricity static destination RAVPN RAVPN
No source (indoor, outdoor) nat static static NETWORK_OBJ_10.10.10.0_28 destination NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_10.10.10.0_28
No source (indoor, outdoor) nat static everything all NETWORK_OBJ_10.10.10.0_28 of NETWORK_OBJ_10.10.10.0_28 static destination
No network obj_any object
No network object RAVPN
In case you do not want to change the settings a lot you might be right by adding this
network of the VPN-POOL object
10.10.10.0 subnet 255.255.255.0
destination VPN VPN-POOL POOL static NAT (outside, outside) 1 static source VPN-VPN-POOL
But the other above configurations changes would make NAT configurations currently simpler and clearer to see every goal of "nat" configurations.
-Jouni
-
Web VPN/SSL - general Split Tunnel capable?
When I look through some examples of configuration for IOS Web VPN - it seems you attract to the filling of a web page of web sites that users can go to. I would be rather thin client act as client light 4.x CVPN - divided for example tunnel with access to a resource internal resource. Is this possible with Cisco VPN Web? Also - with is WebVPN any ability of the NAC?
I'm not sure IOS SSL vpn, but on the asa webvpn, there is a complete client ssl option. With this, you can either create a tunnel, or all split tunnel and the only defined networks. I hope that answers your question.
-
Hello all -
I'm working on an ASA 5510, running version 8.4. I'm looking for something that I imagine would be simple, but having a few problems.
I am configuring the connection profile for the client and clientless VPN on the SAA. I would like the profiles of customer (who will serve with anyconnect by our internal staff) to have the possibility to select the profile to login on the login page. I have create a subnet by using policies and business unit to restrict access to various servers. This option button is displayed on the page of remote vpn in the ASDM, I select it and problem solved, they see a drop-down menu when using the anyconnect client, select one and the appropriate IP pool is assigned.
Now, when I am configuring profiles without client (to be used by our external business clients), I don't want that they have the ability to choose a profile. At least not the ability to see all of the internal profiles, I created for our internal employees. It is displayed by selecting this option in the "client access", it also allows her to "client access". What Miss me in how I can prevent our external collaborators via SSL, see the profiles that I created for our internal employees via the drop-down list? As I hinted above, I use the ASDM.
Any help would be appreciated-
Brian
Hello
Unfortunately this is not possible because when you enable the option for users to select the connection profile, it will be available for all connections. If this is not enabled the default policy will be selected so it is a must to have chosen option.
What you can do is to create a group URL and maps it to a specific connection profile, so when users type in the full URL for example https://my domain.com / external it will take the user directly on the specific connection profile.The size to the bottom of this configuration is that if someone types in the URL without the group URL it is taken to the default profile and can see the drop-down list with all connection profiles.
Sent by Cisco Support technique iPad App
-
Impossible to reconnect the VPN to ASA on the internet
Hello
I ASA5540 running IOS 8.04 - K8, users are able to the VPN connection over the internet but impossible to reconnect the VPN when users disconnected abnormally (abnormally means they are not manually disconnect, VPN disconnect everything manually without problem occur). ASA showing an active session of the disconnected user and the user having reason 433 at the re-login VPN.
Any suggestion and recommendation for this case.
Awaiting your repies.
Thank you very much.
Kind regards
Arsalan
Hello
under the tunnel-group, try to reduce the keepalive interval... Can help detect that the peer is down faster...
Best wishes
McLaughlin
-
VPN SSL from the inside on the external interface
Hi all
First of all I know that I can activate the SSL interface inside, but that's not what I need or want.
Scenario:
Several interfaces and VLAN on the SAA (running 8.0.5).
SSL VPN configured and enabled on the external interface.
Need to know if it is possible to access the SSL VPN from other interfaces directly to the IP address external interface, something like her hairpin.
Possible a solution (if it exists) with or without NAT (I have public IPs on some interfaces).
This will be useful for users who can connect any interface (inside, outside, or other) and with only a DNS record, I'll be able to manage everything.
Concerning
PS: Is DNS doctoring an option? The tests that I have done this does not work.
Post edited by: rcordeiro
Hello
Unfortunately, it is not possible. You cannot communicate with an ASA interface which is not directly connected through the firewall.
Kind regards
NT
-
setting up a vpn ssl to a netgear router
I have setup a router netgear FVS336G at a customer and you have configured a vpn ssl to the customer. I can cinnect on a win xp machine, but not on my machine which is running Vista 64 bit. I get narrations of error message cannot install the vpn tunnel.
Hi Jluequi,
The issue of Windows 7 you have posted is better suited for the IT Pro TechNet public. Please post your question in the TechNet Windows 7 networking forum.
Concerning
Joel S
Microsoft Answers Support Engineer
Visit our Microsoft answers feedback Forum and let us know what you think. -
Does anyone know if the GRE tunnels can be used with the AIM-VPN/SSL-2 module for the Cisco 2800 series routers?
Yes, we use it with GRE/IPSec.
Hope that helps.
-
WebVPN and remote vpn, ssl vpn anyconnect
Hi all
Differences between webvpn and remote vpn, ssl vpn anyconnect
All require a separate license?Thank you
Hello
The difference between the webvpn and SSL VPN Client is the WebVPN to use SSL/TLS and port
send through a java application to support the application, it also only supports TCP for unicast traffic, no ip address
address is assigned to the customer, and the navigation on the web in the tunnel is made with a SSL
Web-mangle that allows us stuff things in theSSL session.
SSL VPN (Anyconnect) Client is a client of complete tunneling using SSL/TCP, which installs an application on the computer and
envelopes vpn traffic in the ssl session and thus also an assigned ip address has the
tunnel's two-way, not one-way. It allows for the support of the application on the
tunnel without having to configure a port forward for each application.
AnyConnect is a client of new generation, which has replaced the old vpn client and can be used as long as the IPSEC vpn ssl.
For anyconnect licenses please see the link below:
http://www.Cisco.com/c/en/us/TD/docs/security/vpn_client/AnyConnect/ANYC...
Kind regards
Kanwal
-
3005 &; customer VPN SSL gone?
I upgraded from 2 3005 to vpn3000 - 4.1.7.Q - k9... after that my SSL VPN client options are gone, used to be: Configuration | Tunneling and security | WebVPN | VPN SSL Client...
This get removed from the latest releases and now I only have the mode of transmission by SSL VPN proxy on of the 3005? Can't seem to find it in the release notes...
Razor head
The problem you are having is due to the upgrade to 4.1. *, which is not the software package you need. You were previously using 4.7. *, which is the right one for SD/SVC.
Ken
Maybe you are looking for
-
ETA for even 10 compatible fully functional Firefox and Thunderbird?
Win 10 is due to a little less than 3 weeks.
-
Satellite Z830: Sometimes slow WLan
Hello! I have the problem that my wifi is sometimes very slow.It takes 5 minutes to google something. Home everything works fine but to (for example) in my college, I compared my wifi with laptops similar speed and they were more than two times faste
-
HP 15-r203TX: including deivers I can downoad
I purchesed HP for computer laptop 15-r203TX, now I confused the pilots because on hp.support there are a lot of drivers for this model (for eg. in display drivers there are 2-3). 1 I download.
-
iP8720 - wired USB and wifi at the same time?
I sought an answer to this but have not found one that I really understand. An iP87290 can be used as a wired printer and printer wifi simultaneously? I put up as a USB Wired printer on the office a year ago. Works very well. Now my wife wants to
-
BlackBerry Smartphones using improved please my flashlight online now, I can't use it
Help please I really need my phone