Cisco VPN :: ASA 8.4 / How To Allow SSLVPN Client To Control SBL
Apr 25, 2011
I enabled SBL on ASA 8.4, anyconnect client is Win-XP, everything worked as expected, but some users do not want to see SBL logon screen before windows logon because often times they will need to login before they can get network connection. So I modified profile.xml's following line from
the new profile is downloaded to client machine's anyconnect vpn profile fine, yet still users see VPN logon screen before Windows log on, "Connect on startup" is un-checked on Anyconnect VPN client, client machines rebooted multiple times, Anyconnect VPN client was removed and re-downloaded from scratch, no change ... What else do I have to do? I certainly can create a new group-policy/tunnel-group for those users without SBL, but that is far from an elegant solution.
We have an internal DNS server that all internal hosts do lookups to .. these requests are forwarded onto open dns for anything the dns server isnt authoritative for.. My question is we have purchased the botnet filter and this requires the asa5505 dns client to be active on at least one interface .. Should i point the asa dns to an external IP such as 8.8.8.8 and apply DNS enabled on interface outside ( am using asdm) I don't want the ASA to control DNS for our internal clients we already have a internal server for this, i DO want the asa5505 to check dns packets against its botnet filter, whilst still using open dns for forwarding.
I am using a win server 2008 in my company, recently my staff have being using internet a lot for downloading and many other unnecessary software therby redusing overall bandwidth.Is there any software solution i can use for controlling bandwidth of my client computer from server2008 computer.
We have been using the VPN client for a very long time. Our most current VPN setup is using an ASA 5510, without split tunneling. We tunnel all traffic. We are using IPSec group authentication off of an AD domain controller.
Recently I have been having some issues with some of the client machines, and I can't for the life of me figure out what the issue is. Some machines will not respond to pings, and I cannot remotely access the machines (using Dameware Remote Control) while they are connected to the VPN. Other client machines work fine. In fact there have been a couple instances where I have two machines in a remote office, using the same internet connection, both connected to the VPN, where I can ping and remotely manage one machine, but not the other. If RDP is enabled, I can sometimes get into those problem machines via RDP. But this is crippling our ability to remotely support many of our VPN users, and I just don't know what to look for.
I have tried disabling Windows firewall completely, and that does not seem to work at all. The only other thing I can think of is I recently upgraded our McAfee software. But it does not prevent us from getting connected to or pinging any of the systems on our physical network, nor to half of our VPN users. Most of our clients are running Windows 7, or Vista, and using the client version 5.0.07.0290, or 5.0.05.0290. Most of the clients using 5.0.07.0290 are using the 64-bit version.
How to configure Belkin N (F5D8636-4) Client IP Filtering so that a range of client IP' deny access to the internet using the following blocked time ranges e.g. Mon 5:00pm to Tues 2:00pm, Tues 5:00pm to Wed 2:00pm, Wed 5:00pm to Thur 2:00pm, Thur 5:00pm to Fri 2:00pm, Fri 5:00pm to Sat 10:00am, Sat 1:00pm to Sun 10:00am, Sun 1:00pm to Mon 2:00pm - BTW - this access regime is to deny internet access for my teenage son?
I have configured SSLVPN on a asa5520 with aaa and certificate authentication.Both authentication works fine,but I find the client users can use any others' certificate to authentication,I want to binding the aaa account to user's certificate.everyone must use their own certificate.
I'm having some troubles with SSLVPN connectivity. I've setup SSLVPN at one site and it works great with web access, file share, RDP plugin etc. at the local LAN on that site. But I also would like to reach another site (connected with an IPSEC tunnel). Is this possible? if it is, how do I do it?Both firewalls are ASA5505, one 8.31 and one 8.22 Just a note, it works to connect with IPSEC client and reach the remote site just fine.
I have setup an SA520W and configured SSL-VPN for our small business. Everything seemed to go smoothly and I tested SSL VPN by logging in and playing around a bit which seemed to be fine. However, shortly after deployment I started getting complaints about it being much slower than our old VPN through the consumer grade router I just replaced. I investigated and tested with IE8 and Chrome on Windows XP 32-bit with several different machines, and in all instances it did seem very slow indeed. While looking around I noticed that the Task Manager under the Networking tab shows the SSL VPN connection as VirutalPassage at 64 Kbps. Going into Network Connections shows VirtualPassage under the Dial-up heading with device name Virtual Passage SSLDrv Adapter. Additional properties describe it as an ISDN channel. I have attached an image of the Task Manager pane.The router is running the latest firmware of 2.1.51. It is connected via a static IP that does not require a login, to our dedicated 5 Mbit / 5 Mbit ethernet over copper link to our ISP. We get great speeds and low latency through everything but SSL VPN connections. I haven't done anything fancy so the router certificate is the factory default. Currently we are using the existing 2 SSL VPN licenses that come with the router until we need more access, at which point I want to upgrade to the 25 user bundle. However, I don't feel comfortable upgrading until I get this resolved, because 64kbps simply cannot work for us for a VPN solution.how to configure the SSL VPN to not limit at 64kbps? My engineers are making fun of me for bringing us back to dialup, and I have to agree with them!
Is It possible to hairpin clientless SSLVPN connections (ASA5510)? I'd like to create a portal that allows a user to log into the central clientless webpage and access RDP/VNC resources at remote sites connected via site-to-site VPN. Initial testing shows the user can access resources at the hub site, but not the spokes. I have the standard:
We have an ASA5510 with AnyConnect SSLVPN set up, which works great from remote locations. However, when I am inside the network, I cannot connect to this SSLVPN. I would like to be able to this for testing purposes; I have a VLAN10 that has ACLs so it cannot reach any private IP addresses, we use this VLAN for our guest Wifi network. I would like to be able to make AnyConnect SSLVPN connections from this VLAN, to test the VPN access without having to be at a remote site. However, since I don't want to change any settings compared to my remote site, I don't want to just bind the sslvpn to both outside and VLAN10 (by issuing the enable VLAN10 statement). [code]
I'm trying to setup a SSLVPN Portal for our customer which will authenticate against Active Directory using LDAP over SSL and with the portal have the ability to change password if it has expired. I have managed to setup everything now except for the password reset which is giving me a headache. This is the message that's presented by the portal when i try to change the password even though the same password works when i change it on a PC instead of using the portal.
"Cannot complete password change because the password does not meet the password policy requirements. Check the minimum password length, password complexity, and password history requirements."
And below is the output of ldap debug on the ASA5510 the Portal is running on.
[473] Session Start [473] New request Session, context 0xadbe760c, reqType = Modify Password [473] Fiber started [473] Creating LDAP context with uri=ldaps://x.x.x.x:3269 [473] Connect to LDAP server: ldaps://x.x.x.x:3269, status = Successful [473] supportedLDAPVersion: value = 3
We already know that ASA 9.0 supports site-to-site VPN in multiple context mode. But remote access VPN isn't supported. Obviously, SSL-VPN is a very important feature for most multi-tenant deployment scenarios where each context acts as a border firewall towards the Internet for each tenant. The alternative to terminate all tenant remote-access VPNs in one context means that each tenant would have to be routable from the ASA, which of course isn't a reasonable requirement in most cases.
So, what I'd like to do is to deploy an ASA cluster, and provide remote access VPNs for each tenant, where the connectivity for each remote access group can be addressed with whatever IP address space, and that goes into it's own VRF in the back-end.
As far as I can tell, this isn't doable with the ASA, since multiple context mode prohibits the use of remote access VPN, and I can't think of any other work-around than either having individual firewalls running in single context mode for each tenant, or demand that all tenants are interoperable routing-wise and configure a separate ip address pool in a single context mode for each tenant.
Essentially, there's no good way to implement this with multiple virtual firewalls, using cisco firewalls?
Has any else encountered the SSLVPN not functioning on a Windows client AFTER installing KB2585542? If we install the update, we can't use SSL VPN with the AnyConnect client until the update is removed.
We are starting to deploy SSL VPN in our company and we recently purchased two ASA 5510 firewalls. I have already completed the initial configuration but I do have some inquiry on how to have it configured properly.
1. Employees and clients will access the URL 2. They will select the appropriate group on where they should login. 3. Enter credentials, etc. 4. Username/Password authentication is via RADIUS. The usernames were all created in Cisco ACS 5.3.
My challenge is, we have several clients and all their usernames were created in ACS5.3. Meaning if the configuration is just being differentiated by group settings, clientA can select the profile of clientB and still get authenticated. If that happens, they will be able to access the resources of each other. Also in the future, we will be deploying 2-Factor authentication for some of our clients.
A new Windows 8 computer can't access the SSLVPN corporate connection.
When we try to access the SSLVPN website to download the launcher (you have to download the VPN launcher everytime for our configuration), you can log in and that's fine, and then you can click on the VPN Tunnel link, a popup shows up but it doesn't actually download the launcher. Solutions we've tried so far:
1) Reinstalling C++ Redistirbutable 2) Adding the site to trusted sites and allowing unsigned ActiveX controls 3) Removing all internet objects through internet options.
I do not have a valid SSL Certificate on my firewall but I want to use SSLVPN.
If I connect to the IP adress and the SSLVPN Portal I can choose the sslclient launcher but after that I get a error that I need a internet explorer 64bit or that the active I was blocked because of a unsecure publisher.
when a user login into the Cisco ASA Firewall (v8.3.2) via WebVPN, and accesses the applications. This works fine. In fact, the user can also create bookmarks etc.The problem here is when this user signs off and another user signs in via WebVPN, on the same PC or even on a different PC, this new user can view the screen viewed by the previous user. Basically, even though certain users can view only certain applications, but in my case, not all the time, but most of the time, users logging into via WebVPN can view someone else's profile application.
I suspect this is due to cookies or cache but I'm not sure myself. What can I do to resolve the problem.Currently, this issue is being resolved via a lousy manner i.e. we go to the SMB location and we clear the .CSP file manually, which is not the correct way to address this issue.
I have tried Cisco presales but got bounced - go Cisco !So, i have a small customer who requires a single device which will provide .....
1/ Leased Line connection @ 10mb 2/ ADSL failover onbox (so configurable from CLI, unlike the 860’s which I see only have one ‘active’ wan port) 3/ IOS based 4/ integrated 4 ports (min) switch 5/ site to site VPN 6/ up to 10 x SSLVPN remote users
I did pitch in with ASA5505 with external ADSL router but he is “space-constrained”.It worries me when Cisco doc's say only one WAN port is 'active' - since it doesn't say the second port automatically comes up if the first goes down so I can't take a gamble on that being the case.
i have a question about tunneling a software EasyVPN client to a client ASA Network. It looks like this:
EasyVPN Server 192.168.202.0/24 Network extension mode to Client EasyVPN ASA 192.168.1.0/24 This works fine in both directions. But now i want to connect the client ASA network via EasyVPN software client from outside. The user are already able to connect to the ASA Server on its static outside IP obtaining an IP from a 192.168.21.0/24 pool. This works fine. But how am i able to connect to the 192.168.1.0/24 network from this client?
how to make the java SSH thin client applet bigger in SSL VPN Clientless portal?It works and all that but the window is literally half the size of the monitor and unworkable. You can't even hit tab! (tab moves focus around the browser...)I am using the latest java applet (Oct 2012) and ASA OS 8.4(5)
Do the problem caused by the modems itself or it just sign of faulty Ethernet switch (using 20 port Allied Telesis ethernet switch). Sometimes I cannot connect to internet due to "unidentified network" buy i can resolve this problem by restarting my modem + switch.
I can not get to my control panel. I have tried 192.168.1.1 and 192.168.0.1,. I do have it flashed with DD-wrt. I can access the internet with it, the lights look correct, I don,t believe it is bricked. I have tried hard reset and soft reset.
I'm a bit confused about new NAT functionality in Ver 8.4(2). I've gone through all the documentation as well as different blogs but still not clear about the various things.One of these is NAT-CONTROL. I understand that this has now been removed. Does this means that traffic traversing the ASA doesn't need any NAT'ing commands unless specifically required by the administrator? In other words by default traffic is allowed through the firewall without any NAT'ing.
My Second Query
I've ASA5520 running ver 8.4(2). For inside interface, I've created 13 x sub-interfaces under Gi0/1. All have same security level i.e. 100. What I want to achieve is that:Traffic from these sub-interfaces should be NATTed to outside interface when going to internetBut, intra sub-interface traffic should be allowed without NAT'ing. I'm using RFC1918 on both sides i.e. source / destination The first point is not a problem it's working, however. I'm struggling with the second point. On ver 8.2, it wasn't a problem, I used NAT 0 with access-list permitting RFC1918 addresses as source and destination.
I am in a process of replacing the Cisco ASA 5510 with 7.3 OS with a new Cisco ASA 5515X with 8.6OS. In the existing Cisco ASA 5510, we have configured 'no nat-control' for which the traffic from all sub-interfaces were flowing to the lower security interfaces without any NAT command. Just access-lists were configured. Now how do i acheive the same in the Cisco ASA 5515X with 8.6? I do not find any 'no nat-control' command available for it.
We are forced to rush a installation of a WLC 5508 various reasons in a testing lab. I eventually want to configure RADIUS and such but cannot do it at this immediate time. What I would like to do is implement straight forward MAC filtering. The problem I am having is the controller allows either any W LAN or only one W LAN, and a interface setting. I need to have each MAC be able to access several W LAN's but not all of them. Can anyone point me to a article or give me a quick idea of what I can do.I have basic W LAN's configured and have MAC filtering generally working. I cannot just use a user authentication because each user may have 20-30 devices, but not all of these devices should be allowed on all W LAN's and I do not want to rely on the user.
How can i get the mouse to control the arrow when i connect my tv to my laptop computer;i can control the arrow with the control on the laptop but not with mouse.
I am currently at a standstill when it comes to our desired set up for the following:Originally we purchased an iPad app called Luminair, which works as a DMX board. The idea was to be able to control a set of light fixtures hard lined into a Linksys WRT54G router, which would then allow us to control the lights with the iPad and the Luminair App.After quite a long time and a lot of different settings, I've found myself at this point:We recently were able to connect and control our lights from DMX Workshop, an application running on a Windows 7 64bit connected directly to the fixture through a standard ethernet cord. Both the computer and fixture are set at a 2.x.x.x IP address and a 255.0.0.0 subnet. To allow the two systems to connect andw work with each other, the speed had to be throttled from 100Mb to 10Mb.
I've now tried to introduce the Linksys WRT54G router in between the computer and the fixture hard lined with ethernet cables. My hope is to establish a connection with this setup, and then swap the computer for the iPad.Is it possible to set up the Linksys to a 255.0.0.0 subnet? And do you think it needs to be at this subnet and a 2.x.x.x IP to allow it to work?Also, is it possible to throttle the speed in the router to 10Mb as well, because if it is trying to connect at 100mbps, I am confident it will not work.
Is their a program i can use to see who is doing what then disable their monitor keyboard and mouse. I work for my college/student and i am the assistant admin, my teacher gave me full admin privileges. I would like to have this as untended program where they cant change any thing stays hidden in the back ground. I used team viewer but i have to have them to log each one.
