Table Of Contents
Overview of Group Policies, Tunnel Groups, and Users
Configuring an External Group Policy
Adding an External Group Policy
Editing an External Group Policy
Configuring an Internal Group Policy
Configuring Internal Group Policy General Attributes
Configuring Tunneling Protocols
Configuring General VPN Connection Settings Attributes
Configuring WINS and DNS Servers and DHCP Scope
Configuring Reauthentication on IKE Rekey
Configuring Perfect Forward Secrecy
Configuring Tunnel Group Locking
Configuring Client Access Rules
Configuring Client Configuration Parameters
Configuring the Banner Message
Configuring Domain Attributes for Tunneling
Configuring Split-Tunneling Attributes
Configuring Cisco Client Parameters
Configuring Firewall Attributes
Configuring Attributes for VPN Hardware Clients
Configuring Group-Policy WebVPN Attributes
Configuring Group-Policy WebVPN Function Tab Attributes
Configuring Content Filtering Tab Attributes
Enabling Port Forwarding (WebVPN Application Access) for a Group Policy
Configuring Server and List Arguments Using the WebVPN Other Tab
Configuring the SSL VPN Client Tab Attributes
Configuring Group Policies
This chapter describes how to configure VPN group policies using ASDM. This chapter includes the following sections.
•
Overview of Group Policies, Tunnel Groups, and Users
•
•
Groups, group policies, tunnel groups, and users, are interdependent. In summary, you first configure tunnel groups to set the values for the connection. Then you configure group policies. These set values for users in the aggregate. Then you configure users, which can inherit values from groups and configure certain values on an individual user basis. This chapter describes how and why to configure group policies.
Overview of Group Policies, Tunnel Groups, and Users
Although this chapter deals only with group policies, you should understand the context in which these group policies exist. Groups and users are core concepts in managing the security of virtual private networks (VPNs) and in configuring the security appliance. They specify attributes that determine user access to and use of the VPN. A group is a collection of users treated as a single entity. Users get their attributes from group policies. Tunnel groups identify the group policy for a specific connection. If you do not assign a particular group policy to a user, the default group policy for the connection applies.
Tunnel groups and group policies simplify system management. To streamline the configuration task, the security appliance provides a default LAN-to-LAN tunnel group, a default remote access tunnel group, a default WebVPN tunnel group, and a default group policy (DfltGrpPolicy). The default tunnel groups and group policy provide settings that are likely to be common for many users. As you add users, you can specify that they "inherit" parameters from a group policy. Thus you can quickly configure VPN access for large numbers of users.
If you decide to grant identical rights to all VPN users, then you do not need to configure specific tunnel groups or group policies, but VPNs seldom work that way. For example, you might allow a finance group to access one part of a private network, a customer support group to access another part, and an MIS group to access other parts. In addition, you might allow specific users within MIS to access systems that other MIS users cannot access. Tunnel groups and group policies provide the flexibility to do so securely.
Note
Group Policies
A group policy is a set of user-oriented attribute/value pairs for IPSec connections that are stored either internally (locally) on the device or externally on a RADIUS or LDAP server. A tunnel group uses a group policy that sets terms for user connections after the tunnel is established. Group policies let you apply whole sets of attributes to a user or a group of users, rather than having to specify each attribute individually for each user. You can also modify the group-policy attributes for a specific user
To assign a group policy to users or to modify a group policy for specific users, select Configuration > VPN > General > Group Policy (Figure 4-1).
Figure 4-1 Group Policy Window
.
You can configure internal and external group policies. Internal groups are configured on the security appliance internal database. External groups are configured on an external authentication server, such as RADIUS or LDAP. Group policies include the following attributes:
•
•
•
•
•
•
•
•
•
•
Default Group Policy
The security appliance supplies a default group policy, named DfltGrpPolicy, which always exists on the security appliance. This default group policy does not take effect unless you configure the security appliance to use it. DfltGrpPolicy is always an internal group policy. You can modify this default group policy, but you cannot delete it. When you configure other group policies, any attribute that you do not explicitly specify takes its value from the default group policy.
The Group Policy window lets you manage VPN group policies. Configuring the default VPN group policy lets users inherit attributes that you have not configured at the individual group or username level. By default, VPN users have no group policy association. The group policy information is used by VPN tunnel groups and user accounts.
The "child" windows, tabs, and dialog boxes let you configure the default group parameters. These parameters are those that are most likely to be common across all groups and users, and they streamline the configuration task. Groups can "inherit" parameters from this default group, and users can "inherit" parameters from their group or the default group. You can override these parameters as you configure groups and users.
To modify the default group policy, select DfltGrpPolicy in the table on the Group Policy window and click Edit. The Edit Internal Group Policy: DfltGrpPolicy window appears (Figure 4-2):
Figure 4-2 Edit Internal Group Policy: DfltGrpPolicy Window
To change any of the attributes of the default group policy, work through the selections on the various tabs on the Edit Internal Group Policy: DfltGrpPolicy window, just as you would for any other internal group policy, as described in Configuring an Internal Group Policy.
The default group policy, DfltGrpPolicy, that the security appliance has the following attributes:
group-policy DfltGrpPolicy internalgroup-policy DfltGrpPolicy attributeswins-server nonedns-server nonevpn-access-hours nonevpn-simultaneous-logins 3vpn-idle-timeout 30vpn-session-timeout nonevpn-filter nonevpn-tunnel-protocol IPSecpassword-storage disableip-comp disablere-xauth disablegroup-lock nonepfs disablebanner noneipsec-udp disableipsec-udp-port 10000split-tunnel-policy tunnelallsplit-tunnel-network-list nonedefault-domain nonesplit-dns nonesecure-unit-authentication disableuser-authentication disableuser-authentication-idle-timeout 30ip-phone-bypass disableleap-bypass disablenem disablebackup-servers keep-client-configclient-firewall noneclient-access-rule nonewebvpnfunctions url-entryno html-content-filterno homepageno filterno url-listno port-forwardport-forward-name value Application AccessConfiguring Group Policies
This section includes the following sections:
•
•
•
•
•
•
A group policy can apply to any kind of tunnel. In each case, if you do not explicitly define a parameter, the group takes the value from the default group policy. To configure (add or modify) a group policy, follow the steps in the subsequent sections.
If you click the Add dialog box, a small menu appears giving you the option to create a new internal group policy, or an external group policy that is stored externally on a RADIUS or LDAP server. Both the Add Internal Group Policy window and the Edit Group Policy window include six tabbed sections. If you click the WebVPN tab, you expose six additional tabs. Click each tab to display its parameters. As you move from tab to tab, the security appliance retains your settings. When you have finished setting parameters on all tabbed sections, click OK or Cancel.
In these dialog boxes, you configure the following kinds of parameters:
•
•
•
•
•
•
Before configuring these parameters, you should configure:
•
•
•
•
•
Configuring an External Group Policy
External group policies take their attribute values from the external server that you specify. For an external group policy, you must identify the AAA server group that the security appliance can query for attributes and specify the password to use when retrieving attributes from the external AAA server group. If you are using an external authentication server, keep in mind that usernames and group names must be unique. When naming a group, do not pick a name that matches the name of any external user. Conversely, when assigning a name to an external user, do not choose the name of any existing group.
The security appliance supports user authorization on an external LDAP or RADIUS server. Before you configure the security appliance to use an external server, you must configure the server with the correct security appliance authorization attributes and, from a subset of these attributes, assign specific permissions to individual users. Follow the instructions in the Cisco Security Appliance Command Line Configuration Guide, Appendix E, "Configuring an External Server for Security Appliance User Authorization" to configure your external server.
Adding an External Group Policy
The following steps explain how to add an external group policy.
Step 1
Figure 4-3 Adding an External Group Policy
The Add External Group Policy dialog box appears (Figure 4-4).
Figure 4-4 Add External Group Policy Dialog Box
To configure the attributes of the new external group policy, do the following steps, specifying a name and type for the group policy, along with the server-group name and a password.
Step 2
Note
Figure 4-5 Add AAA Server Group Dialog Box
Step 3
•
•
•
•
•
•
Note
If the server group name that you specify does not contain any servers, you see the following message (Figure 4-6):
Figure 4-6 Empty Server Group Message
To add servers to a group, select Configuration > Properties >AAA Setup > AAA Groups. To continue after seeing this message, click OK. To exit the external group configuration procedure, click Cancel.
Editing an External Group Policy
The procedures for editing a group policy are similar to those for adding, except that when you click Edit on the Group Policy window, the Edit Group Policy window appears, with the Name field already filled in. The rest of the fields on this window are the same. You can also add a AAA server group when you edit an external group policy. See Steps 2 and 3 of Adding an External Group Policy.
Configuring an Internal Group Policy
Internal group policies are configured on the security appliance internal database. To configure the attributes of the new internal group policy, do the following steps.
Step 1
Figure 4-7 Group Policy Window, Add Internal Group Policy
Step 2
•
•
The contents of these windows are similar, the only difference being that for editing, the Name field is display-only. Because of this similarity, the following procedures show only the Add Internal Group Policy window.
Figure 4-8 Add Internal Group Policy Window
This window offers several tabs, on which you configure function-specific attributes. In most cases, you can check the Inherit check box to take the corresponding setting from the default group policy. Allowing inheritance can greatly simplify the configuration process. You can explicitly configure those attributes that you do not want to be inherited. The following sections explain how to configure the group policy attributes for an internal group policy.
Configuring Internal Group Policy General Attributes
The Add or Edit Internal Group Policy window, General tab lets you configure tunneling protocols, ACL filters, connection settings, and servers for the group policy being added or modified. For each of the fields on this window, checking the Inherit check box lets the corresponding setting take its value from the default group policy. Clearing the Inherit check box lets you configure specific values.
The following sections explain how to configure the values of each of the attributes in the General tab.
Configuring Tunneling Protocols
Select the tunneling protocol or protocols that this group can use. Users can use only the selected protocols. You must configure at least one tunneling mode for users to connect over a VPN tunnel. The default is IPSec.
The choices are as follows:
•
•
Note
To remove a protocol attribute from the running configuration, clear the check box for that protocol.
Configuring the ACL Filter
Filters consist of rules that determine whether to allow or reject tunneled data packets coming through the security appliance, based on criteria such as source address, destination address, and protocol. You configure ACLs to permit or deny various types of traffic for this group policy. (You can also configure this attribute in username mode, in which case the value configured under username supersedes the group-policy value.)
Note
At the end of each ACL, there is an implicit, unwritten rule that denies all traffic that is not permitted. If traffic is not explicitly permitted by an access control entry (ACE), it is denied. ACEs are referred to as rules in this topic.:To specify that you want the group policy to inherit the filter from the default group policy, click the Inherit check box. To specify a different filter, either select a filter from the menu or select None. With any of these options, you do not add or modify an existing filter, so you can skip to Configuring General VPN Connection Settings Attributes in these instructions.
To create a new filter (ACL) or modify an existing filter, click Manage. The ACL Manager dialog box (Figure 4-9) appears. In this dialog box, you can add, edit, and delete Access Control Lists (ACLs) and Extended Access Control Lists (ACEs) to control the access of a specific host or network to another host/network, including the protocol or port that can be used.
To remove an ACL from the group policy, select None from the menu. To delete a group policy from the configuration, click Delete in the ACL Manager dialog box.
A group policy can inherit this value from another group policy. To prevent inheriting a value, select None instead of specifying an ACL name. The None option indicates that there is no access list and sets a null value, thereby disallowing an access list.
Note
However, you do not know at the configuration time what values the group policy is inheriting. To ensure that no ACL is associated with a particular group policy, clear the Inherit check box and select None in the ACL (Filter/Web-VPN ACL ID/...) drop-down list.
If you are dealing with one of the default group policies, the part about inheritance is inapplicable, so only selecting None is relevant.Figure 4-9 ACL Manager Dialog Box
The fields in this dialog box are as follows:
•
•
•
•
•
•
•
•
•
Rules are applied in the order in which they appear in the table in the ACL Manager dialog box. To move a rule up or down in the list, click Move Up or Move Down. To delete a rule, click Delete. To add a filter rule, click Add ACE. To edit a filter rule, click Edit ACE. The Add or Edit Extended Access List Rule dialog box appears (Figure 4-10).
Figure 4-10 Add Extended Access List Rule
This dialog box lets you configure whether to permit or deny traffic, specify a time range to apply or define a new time range, configure the syslog options, specify the source and destination host or network, specify the protocol, service (source and destination ports) to which to apply this rule and manage the service groups. Optionally, you can also enter a description of this rule. Your entries here appear in the Configure ACLs table in the ACL Manager dialog box.
Configuring Syslog Options (Extended Access List Rule Dialog Box)
To specify the system log as something other than the default syslog, click More Options in the Syslog area. The Log Options dialog box appears (Figure 4-11), in which you can configure the system log options.
Figure 4-11 Syslog Dialog Box—Log Options
Log Options
The Log Options dialog box lets you set logging options for each access control entry (also called a rule) for an access control list. Conduits and outbound lists do not support logging. See the online Help for Configuration > Properties > Logging > Logging Setup and subsequent windows for an explanation of how to set global logging options.
The Log Options dialog box lets you choose the type of logging mechanism to use:
•
•
By default, syslog messages are generated at the informational level (level 6). You can select a different level of logging messages to be sent to the syslog server from the drop-down list in the Syslog Level field. Logging levels are as follows:
–
–
–
–
–
–
–
–
If a packet matches the ACE, the security appliance creates a flow entry to track the number of packets received within a specific interval (see the Logging Interval field that follows). The security appliance generates a syslog message at the first hit and at the end of each interval, identifying the total number of hits during the interval. At the end of each interval, the security appliance resets the hit count to 0. If no packets match the ACE during an interval, the security appliance deletes the flow entry.
Note
•
•
Note
Configuring the Source and Destination Host/Network Area
Use this area to identify the source and destination networks. Specify the following parameters for both the source and destination areas:
•
•
•
•
•
Configuring Protocol and Service Area Attributes
Use this area to specify the protocol and type of service for this rule. The content of these areas depends on your protocol choice.
•
•
•
•
•
Managing Service Groups
Service groups let you identify multiple non-contiguous port numbers that you want the ACL to match. For example, if you want to filter HTTP, FTP, and port numbers 5, 8, and 9, define a service group that includes all these ports. Without service groups, you would have to create a separate rule for each port.
You can create service groups for TCP, UDP, and TCP-UDP. A service group with the TCP-UDP protocol contains services, ports, and ranges that might use either the TCP or UDP protocol.
In the Protocol and Service area of the Add Extended Access List rule dialog box, you configure the connection protocol and the type of service or the service group for the source and destination ports. If you do not want to make any changes, go on to the Description field. To manage these service groups, click Manage Service Groups. The Manage Service Groups dialog box (Figure 4-12) appears.
Figure 4-12 Manage Service Groups Dialog Box
The Manage Service Groups dialog box lets you associate multiple TCP, UDP, or TCP-UDP services (ports) in a named group. You can then use the service group in an access or IPSec rule, a conduit, or other functions within ASDM and the CLI.
The term service refers to higher layer protocols associated with application level services having well known port numbers and "literal" names such as ftp, telnet, and smtp.
The security appliance permits the following TCP literal names: bgp, chargen, cmd, daytime, discard, domain, echo, exec, finger, ftp, ftp-data, gopher, h323, hostname, http, ident, irc, klogin, kshell, lpd, nntp, pop2, pop3, pptp, smtp, sqlnet, sunrpc, tacacs, talk, telnet, time, uucp, whois, www.
The Name of a service group must be unique to all four types of object groups. For example, a service group and a network group may not share the same name.
Multiple service groups can be nested into a "group of groups" and used the same as a single group. When a service object group is deleted, it is removed from all service object groups where it is used.
If a service group is used in an access rule, do not remove it. A service group used in an access rule cannot be made empty.
The fields in the Manage Service Groups dialog box are as follows:
•
–
–
–
•
Figure 4-13 Add Service Group Dialog Box
Adding or Editing a Service Group
The Add or Edit Service Group dialog box lets you manage a group of TCP/UDP services/ports. The fields are as follows:
•
•
•
•
Configuring General VPN Connection Settings Attributes
Follow the steps in this section to configure attributes that set the values of VPN connection attributes. These attributes control the access hours, the number of simultaneous logins allowed, the timeouts, the name of the ACL to use for VPN connections, and the tunnel protocol. For all the attributes in this section, you can check the Inherit check box to allow the group policy to inherit a value from the default group policy.
Configuring Access Hours
The VPN access hours determine when users in this group can connect to the security appliance. To set the VPN access hours, you associate a group policy with a previously configured time-range policy, which determines the actual access hours.
A time range is a variable specifying the range of access hours during which a user can connect to the security appliance using this group policy. You select the name of this variable from a menu when you want to restrict access hours.
To view the characteristics of the existing time ranges, select Configuration > Global Objects > Time Ranges. To select an existing time range to use with an ACL filter, choose a name from the drop-down Time Range menu in the Add/Edit Extended Access List Rule dialog box. To specify no time range restriction for this filter, choose Not Applied from the menu. In either case, since you are not defining a new time range, skip to Configuring Syslog Options (Extended Access List Rule Dialog Box).
You can check the Inherit check box to allow the group policy to inherit the access hours variable from the group policy. If you choose this option, skip to Configuring Simultaneous Logins.
To define a new time range, click New in the Time Range area in the Add Extended Access List Rule dialog box. The Add Time Range dialog box appears (Figure 4-14).
Figure 4-14 Add Time Range Dialog Box
First, specify a name for this time range. When needed, you select this time range by choosing this name from a drop-down list when you configure a group policy with a time range.
Specify the starting and ending times. If you configure specific starting and ending times, note that these times are inclusive.
You can further constrain the active time of this range by specifying recurring time ranges, which are active within the start and end times specified. To remove a recurring time range, select the range and click Delete. To add or edit a recurring time range, click Add or Edit. The Add or Edit Recurring Time Ranges dialog box appears (Figure 4-15).
Figure 4-15 Add or Edit Recurring Time Ranges Dialog Box.
Specify the recurring time ranges either as days of the week and times on which this recurring range is active or as a weekly interval when this recurring range is active, and click OK. Click OK to complete the configuration on the Add Time Range dialog box.
Configuring Simultaneous Logins
Specify the number of simultaneous logins allowed for any user. The default value is 3. The range is an integer in the range 0 through 2147483647. A group policy can inherit this value from another group policy. Enter 0 to disable login and prevent user access.
Caution
Configuring Maximum Connect Time
Configure a maximum amount of time for VPN connections. At the end of this period of time, the security appliance terminates the connection. To allow unlimited connection time, check the Unlimited check box. To configure a specific time limit, clear the Unlimited check box. This makes the minutes field available. The minimum time is 1 minute, and the maximum time is 35791394 minutes. There is no default value.
Configuring User Idle Timeout
Configure the user idle timeout period by either checking the Unlimited check box or specifying a number of minutes that the system can remain idle. If there is no communication activity on the connection in this period, the security appliance terminates the connection. The minimum time is 1 minute, and the maximum time is 35791394 minutes. The default is 30 minutes.
Configuring WINS and DNS Servers and DHCP Scope
You can configure primary and secondary WINS servers and DNS servers and the DHCP scope. The default value in each case is none. To configure these attributes, do the following steps:
Step 1
Every time that you enter a DNS Server value, you overwrite the existing setting. For example, if you configure the primary DNS server as 10.10.10.15 and later configure the primary DNS server to be 10.10.10.30, the later specification overwrites the first, and 10.10.10.30 becomes the primary DNS server.
Step 2
Every time that you enter the wins-server command, you overwrite the existing setting. For example, if you configure WINS server x.x.x.x and then configure WINS server y.y.y.y, the second command overwrites the first, and y.y.y.y becomes the sole WINS server. The same is true for multiple servers. To add a WINS server rather than overwrite previously configured servers, include the IP addresses of all WINS servers when you enter this command.
The following example shows how to configure WINS servers with the IP addresses 10.10.10.15 and 10.10.10.30 for the group policy named FirstGroup:
Step 3
Configuring IPSec Attributes
The IPSec tab on the Add or Edit Internal Group Policy window lets you specify security attributes for this group policy. Figure 4-16 shows the IPSec tab.
Figure 4-16 Add Internal Group Policy Window, IPSec Tab
Check an Inherit check box to let the corresponding setting take its value from the default group policy. The following sections explain how to configure the attributes on this tab.
Configuring Reauthentication on IKE Rekey
Specify whether to require that users reauthenticate on IKE rekey by choosing Enable or Disable. If you enable reauthentication on IKE rekey, the security appliance prompts the user to enter a username and password during initial Phase 1 IKE negotiation and also prompts for user authentication whenever an IKE rekey occurs. Reauthentication provides additional security. Reauthentication on IKE rekey is disabled by default if you clear the Inherit check box.
If the configured rekey interval is very short, users might find the repeated authorization requests inconvenient. To avoid repeated authorization requests, disable reauthentication. To check the configured rekey statistics, select Monitoring > VPN > VPN Statistics > Crypto Statistics to view the security association statistics.
Note
Configuring IP Compression
Specify whether to enable IP compression, which is disabled by default. Enabling data compression might speed up data transmission rates for remote dial-in users connecting with modems. IP compression is disabled by default.
Caution
To enable or disable LZS IP compression, select Enable or Disable.
Configuring Perfect Forward Secrecy
Specify whether to enable perfect forward secrecy. In IPSec negotiations, perfect forward secrecy ensures that each new cryptographic key is unrelated to any previous key. A group policy can inherit a value for perfect forward secrecy from the default group policy if you check the Inherit check box. Otherwise, perfect forward secrecy is disabled by default. To enable or disable perfect forward secrecy, select Enable or Disable.
Configuring Tunnel Group Locking
Specify whether to restrict remote users to access only through the tunnel group, by enabling or disabling the Tunnel Group Lock attribute.
The tunnel-grp-name variable specifies the name of an existing tunnel group that the security appliance requires for the user to connect. Tunnel group lock restricts users by checking if the group configured in the VPN client is the same as the tunnel group to which the user is assigned. If it is not, the security appliance prevents the user from connecting. If you do not configure group-lock, the security appliance authenticates users without regard to the assigned group. Group locking is disabled by default.
To remove the group-lock attribute from the running configuration, enter the no form of this command. This option allows inheritance of a value from another group policy.
To disable group-lock, enter the group-lock command with the none keyword. The none keyword sets group-lock to a null value, thereby allowing no group-lock restriction. It also prevents inheriting a group-lock value from a default or specified group policy.
Configuring Client Access Rules
The Client Access Rules area lets you specify up to 25 rules that determine whether to permit or deny access by certain types and versions of VPN clients. Either the group policy can inherit these rules from the default group policy, or you can specify particular rules for this group policy.
The table in this area shows the priority, action, client type and VPN client version that each rule specifies.
To configure rules that limit the remote access client types and versions that can connect via IPSec through the security appliance, clear the Inherit check box. This makes the buttons at the side of the table active. By default, there are no access rules. When there are no client access rules, all client types and versions can connect. To delete individual rules, click Delete.
The columns in the Client Access Rules table are as follows:
•
•
•
•
To add a new rule for an IPSec group policy, click Add. To modify an existing rule for an IPSec group policy, click Edit. The Add or Edit Client Access Rule dialog box appears (Figure 4-17).
Figure 4-17 Add Client Access Rule Dialog Box
Construct rules according to these caveats:
•
•
•
•
•
•
•
Configuring Client Configuration Parameters
Use the Client Configuration tab of the Add/Edit Internal Group Policy Window (Figure 4-18) to configure the following parameters:
•
•
•
•
•
•
Figure 4-18 Edit Internal Group Policy Client Configuration Window
Configuring the Banner Message
The banner is a message that is displayed to remote clients when they connect. The default is no banner. If you choose not to inherit the banner from the default group policy, clear the Inherit check box and click Edit Banner. The View/Config Banner dialog box appears (Figure 4-19).
Figure 4-19 View/Config Banner Dialog Box
To specify the banner, or welcome message, if any, that you want to display, enter the banner text, up to 510 characters in length. Enter the "\n" sequence to insert a carriage return.
Note
To delete a banner, remove the text.
Configuring Domain Attributes for Tunneling
You can specify a default domain name for tunneled packets or a list of domains to be resolved through the split tunnel. The following sections describe how to set these domains.
Defining a Default Domain Name for Tunneled Packets
The security appliance passes the default domain name to the IPSec client to append to DNS queries that omit the domain field. When there are no default domain names, users inherit the default domain name in the default group policy. To specify the default domain name for users of the group policy, clear the Inherit check box and enter the default domain name in the field.
The domain name that you enter identifies the default domain name for the group. To specify that there is no default domain name, leave this field blank. This command sets a default domain name with a null value, which disallows a default domain name and prevents inheriting a default domain name from a default or specified group policy.
Defining a List of Domains for Split Tunneling
To provide a list of domains for split-tunneling, clear the Inherit check box and enter a space-delimited list of domains to be resolved through the split tunnel. When there are no split tunneling domain lists, users inherit any that exist in the default group policy. To prevent users from inheriting such split tunneling domain lists, leave this list blank.
The domain name attribute provides a domain name that the security appliance resolves through the split tunnel. Leaving this list blank indicates that there is no split DNS list. It also sets a split DNS list with a null value, thereby disallowing a split DNS list, and prevents inheriting a split DNS list from a default or specified group policy.
Enter a single space to separate each entry in the list of domains. There is no limit on the number of entries, but the entire string can be no longer than 255 characters. You can use only alphanumeric characters, hyphens (-), and periods (.). If the default domain name is to be resolved through the tunnel, you must explicitly include that name in this list.
Configuring Split-Tunneling Attributes
Split tunneling lets a remote-access IPSec client conditionally direct packets over an IPSec tunnel in encrypted form or to a network interface in clear text form. With split tunneling enabled, packets not bound for destinations on the other side of the IPSec tunnel do not have to be encrypted, sent across the tunnel, decrypted, and then routed to a final destination. This command applies this split tunneling policy to a specific network.
Setting the Split-Tunneling Policy
Set the rules for tunneling traffic by specifying the split-tunneling policy. The default is to tunnel all traffic. To set a split tunneling policy, clear the Inherit check box and select the split-tunnel policy from the drop-down menu. To remove the split-tunnel policy attribute from the running configuration, leave this field blank. This enables inheritance of a value for split tunneling from another group policy.
•
•
•
Note
Creating a Network List for Split-Tunneling
Select a network list name for split tunneling from the Split Tunnel Network List drop-down menu. Split tunneling network lists distinguish networks that require traffic to travel across the tunnel from those that do not require tunneling. The security appliance makes split tunneling decisions on the basis of a network list, which is an ACL that consists of a list of addresses on the private network. Only standard-type ACLs are allowed. Clicking Manage opens the ACL Manager dialog box, where you can configure the ACLs. For information on using ACL Manager dialog box, see Configuring the ACL Filter.
The access-list name that you select identifies an access list that enumerates the networks to tunnel or not tunnel. Selecting None indicates that there is no network list for split tunneling; the security appliance tunnels all traffic. Selecting None sets a split tunneling network list with a null value, thereby disallowing split tunneling. It also prevents inheriting a default split tunneling network list from a default or specified group policy.
Configuring Cisco Client Parameters
The attributes in the Cisco Client Parameters area specify certain security settings for the group, including password storage, IPSec over UPD settings, and IPSec backup servers.
Configuring Password Storage
You can specify whether to let users store their login passwords on the client system. For security reasons, password storage is disabled by default. Enable password storage only on systems that you know to be in secure sites.
To enable or disable password storage, clear the Inherit check box for the Store Password on Client System attribute and select either Yes (enable) or No (disable).
This action does not apply to interactive hardware client authentication or individual user authentication for hardware clients.
Configuring IPSec-UDP Attributes
IPSec over UDP, sometimes called IPSec through NAT, lets a Cisco VPN client or hardware client connect via UDP to a security appliance that is running NAT. It is disabled by default. IPSec over UDP is proprietary; it applies only to remote-access connections, and it requires mode configuration. The security appliance exchanges configuration parameters with the client while negotiating SAs. Using IPSec over UDP may slightly degrade system performance.
To enable or disable IPSec over UDP, clear the Inherit check box and choose either Enable or Disable.
The Cisco VPN client must also be configured to use IPSec over UDP (it is configured to use it by default). The VPN 3002 requires no configuration to use IPSec over UDP.
To use IPSec over UDP, you must also configure the IPSec over UDP Port attribute, which sets a UDP port number for IPSec over UDP. In IPSec negotiations, the security appliance listens on the configured port and forwards UDP traffic for that port even if other filter rules drop UDP traffic. To configure the IPSec over UDP Port attribute, clear the Inherit check box and enter a port number into the field. The port numbers can range from 4001 through 49151. The default port value is 10000.
Configuring IPSec Backup Servers
Configure backup servers if you plan on using them. IPSec backup servers let a VPN client connect to the central site when the primary security appliance is unavailable.When you configure backup servers, the security appliance pushes the server list to the client as the IPSec tunnel is established. Backup servers do not exist until you configure them, either on the client or on the primary security appliance.
Configure backup servers either on the client or on the primary security appliance. If you configure backup servers on the security appliance, it pushes the backup server policy to the clients in the group, replacing the backup server list on the client if one is configured.
Note
To specify one or more backup servers or to remove the configured backup server or servers from the client configuration, do the following:
Step 1
Step 2
•
•
•
Step 3
Configuring Firewall Attributes
A firewall isolates and protects a computer from the Internet by inspecting each inbound and outbound individual packet of data to determine whether to allow or drop it. Firewalls provide extra security if remote users in a group have split tunneling configured. In this case, the firewall protects the user's PC, and thereby the corporate network, from intrusions by way of the Internet or the user's local LAN. Remote users connecting to the security appliance with the VPN client can choose the appropriate firewall option. When there are no firewall policies, users inherit any that exist in the default or other group policy.
Set personal firewall policies that the security appliance pushes to the VPN client during IKE tunnel negotiation on the Client Firewall tab (Figure 4-20).
Figure 4-20 Edit Internal Group Policy Client Firewall Tab
Note
The following examples illustrate the use of the client firewall.
In the first scenario, a remote user has a personal firewall installed on the PC. The VPN client enforces firewall policy defined on the local firewall, and it monitors that firewall to make sure it is running. If the firewall stops running, the VPN client drops the connection to the security appliance. (This firewall enforcement mechanism is called Are You There (AYT), because the VPN client monitors the firewall by sending it periodic "are you there?" messages; if no reply comes, the VPN client knows the firewall is down and terminates its connection to the security appliance.) The network administrator might configure these PC firewalls originally, but with this approach, each user can customize his or her own configuration.
In the second scenario, you might prefer to enforce a centralized firewall policy for personal firewalls on VPN client PCs. A common example would be to block Internet traffic to remote PCs in a group using split tunneling. This approach protects the PCs, and therefore the central site, from intrusions from the Internet while tunnels are established. This firewall scenario is called push policy or Central Protection Policy (CPP). On the security appliance, you create a set of traffic management rules to enforce on the VPN client, associate those rules with a filter, and designate that filter as the firewall policy. The security appliance pushes this policy down to the VPN client. The VPN client then in turn passes the policy to the local firewall, which enforces it.
The Add or Edit Internal Group Policy window, Client Firewall tab, lets you configure firewall settings for VPN clients for the group policy being added or modified. To specify the client firewall settings, clear the Inherit check box and configure the following attributes in the Client Firewall Attributes area
Configuring Firewall Setting
Specify whether there is no firewall, or whether the firewall is optional or required by selecting the appropriate setting from the drop-down menu.
Note
Configuring Firewall Type
Select the type of firewall (or no firewall) from the drop-down menu. The options are:
•
•
•
•
•
•
•
Configuring a Custom Firewall
If you selected Custom Firewall as the firewall type, you must also configure the custom firewall attributes, as follows:
•
•
•
Configure the Firewall Policy attributes to specify the source and characteristics of the firewall policy, as follows:
•
•
If you select Policy Pushed (CPP), you must also select the policies that the client uses for inbound and outbound traffic.
Clicking Manage opens the ACL Manager dialog box (Figure 4-9), i n which you can create a set of traffic management rules to enforce on the VPN client, associate those rules with a filter, and designate that filter as the firewall policy. The security appliance pushes this policy down to the VPN client, which, in turn, passes the policy to the local firewall, which enforces it.
Configuring Attributes for VPN Hardware Clients
The Add or Edit Internal Group Policy Hardware Client tab (Figure 4-21)lets you configure attributes specific to VPN hardware clients. On this tab you can enable or disable secure unit authentication and user authentication and set a user authentication timeout value for VPN hardware clients. You can also allow Cisco IP phones and LEAP packets to bypass individual user authentication and allow hardware clients using Network Extension Mode to connect.
Figure 4-21 Edit Internal Group Policy Hardware Client Tab
Requiring Interactive Client Authentication (Secure Unit Authentication)
Secure unit authentication provides additional security by requiring VPN hardware clients to authenticate with a username and password each time that the client initiates a tunnel. With this feature enabled, the hardware client does not have a saved username and password. Secure unit authentication is disabled by default.
Note
Secure unit authentication requires that you have an authentication server group configured for the tunnel group the hardware client(s) use. If you require secure unit authentication on the primary security appliance, be sure to configure it on any backup servers as well.
Interactive hardware client authentication provides additional security by requiring the VPN 3002 Hardware Client to authenticate with a username and password that you enter manually each time the VPN 3002 initiates a tunnel. With this feature enabled, the VPN 3002 does not have a saved username and password. When you enter the username and password, the VPN 3002 sends these credentials to the security appliance to which it connects. The security appliance facilitates authentication, on either the internal or an external authentication server. If the username and password are valid, the tunnel is established.
When you enable interactive hardware client authentication for a group, the security appliance pushes that policy to the VPN 3002s in the group. If you have previously set a username and password on the VPN 3002, the software deletes them from the configuration file. When you try to connect, the software prompts you for a username and password.
If, on the security appliance, you subsequently disable interactive hardware authentication for the group, it is enabled locally on the VPN 3002s, and the software continues to prompt for a username and password. This lets the VPN 3002 connect, even though it lacks a saved username and password, and the security appliance has disabled interactive hardware client authentication. If you subsequently configure a username and password, the feature is disabled, and the prompt no longer displays. The VPN 3002 connects to the security appliance using the saved username and password.
Specify whether to enable or disable the requirement for interactive client authentication by clearing the Inherit check box and selecting either Enable or Disable. This parameter is disabled by default.
Requiring Individual User Authentication
When enabled, user authentication requires that individual users behind a hardware client authenticate to gain access to the network across the tunnel. Individual users authenticate according to the order of authentication servers that you configure. Individual user authentication for these users is disabled by default. To display a banner to VPN 3002 devices in a group, individual user authentication must be enabled.
If you require user authentication on the primary security appliance, be sure to configure it on any backup servers as well.
Individual user authentication protects the central site from access by unauthorized persons on the private network of the VPN 3002. When you enable individual user authentication, each user that connects through a VPN 3002 must open a web browser and manually enter a valid username and password to access the network behind the security appliance, even though the tunnel already exists.
Note
If you have a default home page on the remote network behind the security appliance, or if you direct the browser to a website on the remote network behind the security appliance, the VPN 3002 directs the browser to the proper pages for user login. When you successfully log in, the browser displays the page you originally entered.
If you try to access resources on the network behind the security appliance that are not web-based, for example, e-mail, the connection fails until you authenticate using a browser.
To authenticate, you must enter the IP address for the private interface of the VPN 3002 in the browser Location or Address field. The browser then displays the login screen for the VPN 3002. To authenticate, click the Connect/Login Status button.
One user can log in for a maximum of four sessions simultaneously. Individual users authenticate according to the order of authentication servers that you configure for a group.
Configuring an Idle Timeout
To set an idle timeout for individual users behind hardware clients, clear the Inherit check box and either check the Unlimited check box to specify that there is no idle timeout or specify a specific number of minutes. If there is no communication activity by a user behind a hardware client in the idle timeout period, the security appliance terminates the client's access.
Note
The minutes field specifies the number of minutes in the idle timeout period.The minimum is 1 minute, the default is 30 minutes, and the maximum is 35791394 minutes. If you clear both the Inherit and Unlimited check boxes, you must specify a value in the minutes field.
Configuring IP Phone Bypass
You can allow Cisco IP phones to bypass individual user authentication behind a hardware client. To enable or disable IP Phone Bypass, clear the Inherit check box and select Enable or Disable. IP Phone Bypass lets IP phones behind hardware clients connect without undergoing user authentication processes. IP Phone Bypass is disabled by default. If enabled, secure unit authentication remains in effect.
Note
Configuring LEAP Bypass
LEAP users behind a VPN 3002 have a circular dilemma: they cannot negotiate LEAP authentication because they cannot send their credentials to the RADIUS server behind the central site device over the tunnel. The reason they cannot send their credentials over the tunnel is that they have not authenticated on the wireless network. To solve this problem, LEAP Bypass lets LEAP packets, and only LEAP packets, traverse the tunnel to authenticate the wireless connection to a RADIUS server before individual users authenticate. Then the users proceed with individual user authentication.
LEAP Bypass works as intended under the following conditions:
•
•
•
•
•
•
When LEAP Bypass is enabled, LEAP packets from wireless devices behind a VPN 3002 hardware client travel across a VPN tunnel prior to user authentication. This action lets workstations using Cisco wireless access point devices establish LEAP authentication and then authenticate again per user authentication (if enabled). LEAP Bypass is disabled by default.
To allow LEAP packets from Cisco wireless access points to bypass individual users authentication, clear the Inherit check box and select Enable. To disable LEAP bypass, select Disable.
Note
Cisco Systems has developed an 802.1X wireless authentication type called Cisco LEAP. LEAP (Lightweight Extensible Authentication Protocol) implements mutual authentication between a wireless client on one side of a connection and a RADIUS server on the other side. The credentials used for authentication, including a password, are always encrypted before they are transmitted over the wireless medium.
Cisco LEAP authenticates wireless clients to RADIUS servers. It does not include RADIUS accounting services.This feature does not work as intended if you enable interactive hardware client authentication.
Caution
Enabling Network Extension Mode
Network extension mode lets hardware clients present a single, routable network to the remote private network over the VPN tunnel. IPSec encapsulates all traffic from the private network behind the hardware client to networks behind the security appliance. PAT does not apply. Therefore, devices behind the security appliance have direct access to devices on the private network behind the hardware client over the tunnel, and only over the tunnel, and vice versa. The hardware client must initiate the tunnel, but after the tunnel is up, either side can initiate data exchange.
Network extension mode is required for the VPN 3002 to support IP phone connections, because the Call Manager can communicate only with actual IP addresses.
Note
Enable or disable network extension mode for hardware clients by clearing the Inherit check box and selecting Enable or Disable.
Configuring Group-Policy WebVPN Attributes
WebVPN lets users establish a secure, remote-access VPN tunnel to the security appliance using a web browser. There is no need for either a software or hardware client. WebVPN provides easy access to a broad range of web resources and web-enabled applications from almost any computer that can reach HTTPS Internet sites. WebVPN uses SSL and its successor, TLS1, to provide a secure connection between remote users and specific, supported internal resources that you configure at a central site. The security appliance recognizes connections that need to be proxied, and the HTTP server interacts with the authentication subsystem to authenticate users. By default, WebVPN is disabled.
You can customize a WebVPN configuration for specific internal group policies.
In the Add or Edit Internal Group Policy WebVPN tab, you can specify whether to inherit the settings for all the functions or customize the WebVPN attributes, each of which is described in the subsequent sections:
•
•
•
•
•
•
In many instances, you define the WebVPN attributes as part of configuring WebVPN, then you apply those definitions to specific groups when you configure the group-policy webvpn attributes. The attributes in the WebVPN tab for group policies define access to files, MAPI proxy, URLs and TCP applications over WebVPN. They also identify ACLs and types of traffic to filter. WebVPN is disabled by default. See the description of WebVPN in the online Help for this tab and the Cisco Security Appliance Command Line Configuration Guide and Cisco Security Appliance Command Reference for more information about configuring the WebVPN attributes.
You do not need to configure WebVPN to use e-mail proxies.
Configuring Group-Policy WebVPN Function Tab Attributes
The Functions tab (Figure 4-22) lets you configure basic WebVPN functions. To configure the WebVPN functions (such as file access and file browsing, HTTP Proxy, MAPI Proxy, and URL entry over WebVPN) that you want to enable, clear the Inherit check box and check the check boxes for the individual functions that you want to enable or apply. These functions are disabled by default.
Figure 4-22 Edit Internal Group Policy WebVPN Tab Functions Tab
The functions that you can configure on this tab are as follows:
•
Using WebVPN does not ensure that communication with every site is secure. WebVPN ensures the security of data transmission between the remote user's PC or workstation and the security appliance on the corporate network. If a user then accesses a non-HTTPS web resource (located on the Internet or on the internal network), the communication from the corporate security appliance to the destination web server is not secured.
In a WebVPN connection, the security appliance acts as a proxy between the end user's web browser and target web servers. When a WebVPN user connects to an SSL-enabled web server, the security appliance establishes a secure connection and validates the server's SSL certificate. The end user's browser never receives the presented certificate, so therefore cannot examine and validate the certificate. The current implementation of WebVPN does not permit communication with sites that present expired certificates. Neither does the security appliance perform trusted CA certificate validation. Therefore, WebVPN users cannot analyze the certificate an SSL-enabled web-server presents before communicating with it.
To limit Internet access for WebVPN users, deselect the Enable URL Entry field. This prevents WebVPN users from surfing the Web during a WebVPN connection.
•
When this box is checked, users can access Windows files on the network. If you enable only this parameter for WebVPN file sharing, users can access only servers that you configure in the Servers and URLs area (see the description of Configuring Server and List Arguments Using the WebVPN Other Tab). To let users access servers directly or to browse servers on the network, see the Enable file server entry and Enable file server browsing attribute descriptions.
With this check box checked, users can download, edit, delete, rename, and move files. They can also add files and folders.
Shares must also be configured for user access on the applicable Windows servers. Users might have to be authenticated before accessing files, depending on network requirements.
File access, server/domain access, and browsing require that you configure a WINS server or a master browser, typically on the same network as the security appliance, or reachable from that network. The WINS server or master browser provides the security appliance with an list of the resources on the network. You cannot use a DNS server instead.
Note
•
With this check box checked, users can enter pathnames to directly Windows files. They can download, edit, delete, rename, and move files. They can also add files and folders. Again, shares must also be configured for user access on the applicable Windows servers. Users might have to be authenticated before accessing files, depending on network requirements.
•
With this check box checked, users can select domains and workgroups and can browse servers and shares within those domains. Shares must also be configured for user access on the applicable Windows servers. Users may need to be authenticated before accessing servers, according to network requirements.
•
•
Note
With this check box checked users can access client/server applications by mapping TCP ports on the local and remote systems.
Note
•
•
•
•
Configuring Content Filtering Tab Attributes
The Content Filtering tab (Figure 4-23) lets you configure the security appliance to block or remove the parts of websites that use Java or Active X, scripts, display images, and deliver cookies. By default, these parameters are disabled, which means that no filtering occurs. To configure the WebVPN filters, clear the Inherit check box and check the check boxes for the individual filters that you want to enable. These functions are disabled by default.
Figure 4-23 Edit Internal Group Policy WebVPN Tab, Content Filtering Tab
The filters that you can configure on this tab are as follows:
•
•
•
•
Configuring the User Homepage
ASDM lets you customize a home page that the user sees upon logging in. You define a home page customization (such as color, logo, and so on) as part of the WebVPN configuration, then apply that customization when you configure a particular group policy. The Add or Edit Group Policy window, WebVPN tab, Homepage tab (Figure 4-24), lets you configure what, if any, home page that you want users to see upon logging in and specify the name of any previously defined customization that you want to apply to change the look-and-feel of that login web page. There is no default home page, and the default for customization is no customization. For information about configuring web-page customizations, see the online help for Configuration > VPN > WebVPN > Webpage Customization.
Figure 4-24 Edit Internal Group Policy WebVPN Tab Homepage Tab
To specify the Webpage Customization attribute, clear the Inherit check box and either select the name of a customization from the drop-down menu or click New to define a new customization. Clicking New opens the Add Customization Object dialog box. Click the Homepage tab in that dialog box to configure the customizations for the user home page. The other tabs in this dialog box configure other web page customizations to apply to the various GUI pages that the user sees. For information about how to configure web page customizations, see the online Help for that dialog box.
Regardless of whether you specify customizations, you can specify a particular home page that the user sees upon logging in. There is no default home page. To specify a URL for the web page that you want to display when a user in this group logs in, clear the Inherit check box in the Custom Homepage area and select Specify URL. Select either http or https (the default) as http or https as the connection protocol for the home page. In the field to the right of the :// characters, specify the URL of the Web page to use as the home page.
To remove a configured home page, select Use None. This sets a null value, thereby disallowing a home page and prevents inheriting an home page.
Enabling Port Forwarding (WebVPN Application Access) for a Group Policy
Port forwarding, also known as application access, lets you control the list of applications that WebVPN users can access through their remote connection. Port forwarding is disabled by default. The Add or Edit Group Policy window, WebVPN tab, Port Forwarding tab (Figure 4-25), lets you configure port forwarding parameters.
Figure 4-25 Edit Internal Group Policy WebVPN Tab Port Forwarding Tab
You configure a list of applications to make available through port forwarding either as part of the WebVPN configuration or in the group-policy Port Forwarding tab. To apply port forwarding to a group policy, clear the Inherit check box or boxes and configure the following fields:
•
•
•
The Add or Edit Port Forwarding List dialog box (Figure 4-26) lets you configure a new port forwarding list entry or modify an existing entry for WebVPN users for the group policy being added or modified.
Figure 4-26 Add Port Forwarding List Dialog Box
To add a port forwarding list, click Add and configure the following fields. To edit an existing port forwarding list, select the list entry in the table area, then click Edit and configure the appropriate fields. To remove a port forwarding entry from this list, click Delete. The field descriptions follow:
•
•
•
•
•
Note
Configuring Server and List Arguments Using the WebVPN Other Tab
The Add or Edit Group Policy window, WebVPN tab, Other tab (Figure 4-27), lets you configure servers and URL lists and the Web-type ACL ID.
Figure 4-27 Edit Internal Group Policy WebVPN Tab Other Tab
This tab lets you configure an assortment of server and management functions, as follows. To configure individual fields, clear the Inherit check box for that field.
•
Figure 4-28 Add Server and URL List Dialog Box
•
•
Figure 4-29 Web Type ACL Dialog Box
Clicking Add ACL, Add ACE, or Edit ACE opens a dialog box in which you can perform these functions. See Configuring the ACL Filter for an explanation of the fields and buttons on these dialog boxes. Figure Figure 4-30 shows the Add Web-Type ACL dialog box.
Figure 4-30 Add Web-Type ACL Dialog Box
The ACL ID value provides the name of the previously configured access list. After you add a Web Type ACL, you can configure that ACL by clicking Add ACE. This opens the Add Web Type ACE dialog box, in which you configure the action (permit/deny), filter (URL or IP address, subnet mask, and port), syslog options, and time range name, just as you would for other ACLs/ACEs.
Note
•
Note
Click New to open the Add SSO Server dialog box (Figure 4-31) in which you can add a new server to the list.
Figure 4-31 Add SSO Server
Configure the fields in this dialog box as follows:
–
–
–
–
–
–
•
•
•
–
–
–
Configuring the SSL VPN Client Tab Attributes
The SSL VPN Client (SVC) is a VPN tunneling technology that gives remote users the benefits of an IPSec VPN client without the need for network administrators to install and configure IPSec VPN clients on remote computers. The SVC uses the SSL encryption that is already present on the remote computer as well as the WebVPN login and authentication of the security appliance.
To establish an SVC session, the remote user enters the IP address of a WebVPN interface of the security appliance in the browser, and the browser connects to that interface and displays the WebVPN login screen. If the user satisfies the login and authentication, and the security appliance identifies the user as requiring the SVC, the security appliance downloads the SVC to the remote computer. If the security appliance identifies the user as having the option to use the SVC, the security appliance downloads the SVC to the remote computer while presenting a link on the user screen to skip the SVC installation.
After downloading, the SVC installs and configures itself, and then the SVC either remains or uninstalls itself (depending on the configuration) from the remote computer when the connection terminates.
The security appliance might have several unique SVC images residing in cache memory for different remote computer operating systems. When the user attempts to connect, the security appliance can consecutively download portions of these images to the remote computer until the image and operating system match, at which point it downloads the entire SVC. You can order the SVC images to minimize connection setup time, with the first image downloaded representing the most commonly-encountered remote computer operating system. For complete information about installing and using SVC, see Cisco Security Appliance Command Line Configuration Guide, Chapter 31, "Configuring SSL VPN Client."
After enabling SVC, as described in that configuration guide chapter, you can enable or require SVC features for a specific group. This feature is disabled by default. If you enable or require SVC, you can then enable a succession of svc commands, described in this section.
The Edit Internal Group Policy window WebVPN tab SSL VPN tab (Figure 4-32) lets you configure connection settings for the SSL VPN Client. Each attribute can inherit its value from the default group policy, or, if you clear the Inherit check box, you can explicitly configure individual attributes.
Figure 4-32 Edit Internal Group Policy WebVPN Tab SSL VPN Client Tab
Configure the SSL VPN Client attributes as follows:
•
•
•
•
•
–
–
•
–
–
You have now completed the configuration of an internal group policy.
