-
Cisco ASDM User Guide, 6.1
-
Preface
- Getting Started
-
Device Setup and Management
-
Using the Startup Wizard
-
Configuring Basic Device Settings
-
Configuring Interfaces
-
Configuring Interfaces in Multiple Mode
-
Configuring Switch Ports and VLAN Interfaces for the Cisco ASA 5505 Adaptive Security Appliance
-
Configuring Security Contexts
-
Configuring Dynamic And Static Routing
-
Configuring Multicast Routing
-
DHCP, DNS and WCCP Services
-
Configuring AAA Servers and the Local Database
-
Configuring High Availability
-
Managing Device Access
-
Configuring Logging
-
-
Configuring the Firewall
-
Firewall Mode Overview
-
Adding Global Objects
-
Configuring Access Rules and EtherType Rules
-
Configuring NAT
-
Configuring Service Policy Rules
-
Applying AAA for Network Access
-
Configuring Application Layer Protocol Inspection
-
Configuring QoS
-
Configuring Filter Rules
-
Configuring Advanced Firewall Protection
-
Configuring IPS
-
Configuring Trend Micro Content Security
-
Configuring ARP Inspection and Bridging Parameters
-
- Configuring VPN
- Monitoring the Security Appliance
- Reference
-
Index
-
Table Of Contents
Configuring the Setup for Cisco Secure Desktop
Configuring Application Helper
Clock Accuracy for SharePoint Access
Configuring DNS for Port Forwarding
Add/Edit Port Forwarding Entry
Configuring the Use of External Proxy Servers
Add/Replace SSL VPN Client Image
Add/Edit SSL VPN Client Profiles
Configuring SiteMinder and SAML Browser Post Profile
SAML POST SSO Server Configuration
Adding the Cisco Authentication Scheme to SiteMinder
Configuring Smart Tunnel Access
Smart Tunnel Requirements and Limitations
General Requirements and Limitations
Windows Requirements and Limitations
Mac OS Requirements and Limitations
Configuring a Smart Tunnel (Lotus example)
Add or Edit Smart Tunnel Entry
Add or Edit Smart Tunnel Auto Sign-on Server List
Add or Edit Smart Tunnel Auto Sign-on Server Entry
Configuring Customization Objects
Import/Export Customization Object
Creating XML-Based Portal Customization Objects and URL Lists
Understanding the XML Customization File Structure
Using the Customization Template
Import/Export Application Help Content
Configuring Browser Access to Client-Server Plug-ins
About Installing Browser Plug-ins
Plug-in Requirements and Restrictions
Preparing the Security Appliance for a Plug-in
Installing Plug-ins Redistributed by Cisco
Assembling and Installing Third-Party Plug-ins—Example: Citrix Java Presentation Server Client
Import/Export Language Localization
Configure GUI Customization Objects (Web Contents)
Clientless SSL VPN Macro Substitutions
Clientless SSL VPN
Clientless SSL VPN lets users establish a secure, remote-access VPN tunnel to the security appliance using a web browser. There is no need for either a software or hardware client. Clientless SSL VPN provides easy access to a broad range of web resources and both web-enabled and legacy applications from almost any computer that can reach HTTPS Internet sites. Clientless SSL VPN uses Secure Socket Layer Protocol and its successor, Transport Layer Security (SSL/TLS1) to provide a secure connection between remote users and specific, supported internal resources that you configure at a central site. The security appliance recognizes connections that need to be proxied, and the HTTP server interacts with the authentication subsystem to authenticate users.
The network administrator provides access to Clientless SSL VPN resources on a user or group basis. Users have no direct access to resources on the internal network.
Clientless SSL VPN works on the platform in single, routed mode.
For information on configuring Clientless SSL VPN for end users, see Clientless SSL VPN End User Set-up.
Security Precautions
Clientless SSL VPN connections on the security appliance differ from remote access IPSec connections, particularly with respect to how they interact with SSL-enabled servers, and precautions to follow to reduce security risks.
In a clientless SSL VPN connection, the security appliance acts as a proxy between the end user web browser and target web servers. When a user connects to an SSL-enabled web server, the security appliance establishes a secure connection and validates the server SSL certificate. The end user browser never receives the presented certificate, so therefore cannot examine and validate the certificate.
The current implementation of clientless SSL VPN on the security appliance does not permit communication with sites that present expired certificates. Nor does the security appliance perform trusted CA certificate validation. Therefore, users cannot analyze the certificate an SSL-enabled web-server presents before using with the web-enabled service.
We recommend that you do the following to minimize risks posed by Clientless SSL VPN access:
Step 1
Configure a group policy for all users who need Clientless SSL VPN access, and enable Clientless SSL VPN only for that group policy.
Step 2
Step 3
Step 4
Caution
ACLs
You can configure ACLs (Access Control Lists) to apply to user sessions. These are filters that permit or deny user access to specific networks, subnets, hosts, and web servers.
•
•
•
This pane lets you add and edit ACLs to be used for Clientless SSL VPN sessions, and the ACL entries each ACL contains. It also displays summary information about ACLs and ACEs, and lets you enable or disable them, and change their priority order.
Fields
•
•
•
•
•
•
•
•
•
•
•
•
Modes
The following table shows the modes in which this feature is available:
Add ACL
This pane lets you create a new ACL.
Fields
•
Add/Edit ACE
An Access Control Entry permits or denies access to specific URLs and services. You can configure multiple ACEs for an ACL. ACLs apply ACEs in priority order, acting on the first match.
Fields
•
•
–
–
–
–
–
–
–
–
•
•
–
–
–
–
–
Examples
Here are examples of ACLs for Clientless SSL VPN:
Modes
The following table shows the modes in which this feature is available:
Configuring the Setup for Cisco Secure Desktop
The Cisco Secure Desktop Setup window displays the version and state of the Cisco Secure Desktop image if it is installed on the security appliance, indicates whether it is enabled, and shows the size of the cache used to hold the Cisco Secure Desktop and SSL VPN Client on the security appliance.
You can use the buttons in this window as follows:
•
To prepare to install or upgrade Cisco Secure Desktop, use your Internet browser to download a securedesktop_asa_<n>_<n>*.pkg file from http://www.cisco.com/pcgi-bin/tablebuild.pl/securedesktop to any location on your PC. Then use this button to transfer a copy from your local computer to the flash device. Click Browse Flash to install it into the running configuration. Finally, check Enable Secure Desktop.
•
Note
•
Fields
The Cisco Secure Desktop Setup pane displays the following fields:
•
•
a.
b.
c.
d.
Note
e.
Modes
The following table shows the modes in which this feature is available:
Upload Image
The Upload Image dialog box lets you transfer a copy of a Cisco Secure Desktop image from your local computer to the flash device on the security appliance. Use this window to install or upgrade Cisco Secure Desktop.
Note
You can use the buttons in this window as follows:
•
•
•
•
Fields
The Upload Image dialog box displays the following fields:
•
D:\Documents and Settings\Windows_user_name.AMER\My Documents\My Downloads\securedesktop_asa_3_1_1_16.pkg
ASDM inserts the file path into the Local File Path field.
•
disk0:/securedesktop_asa_3_1_1_16.pkg
•
Modes
The following table shows the modes in which this feature is available:
Configuring Application Helper
Clientless SSL VPN includes an Application Profile Customization Framework option that lets the security appliance handle non-standard applications and web resources so they display correctly over a Clientless SSL VPN connection. An APCF profile contains a script that specifies when (pre, post), where (header, body, request, response), and what data to transform for a particular application. The script is in XML and uses sed (stream editor) syntax to transform strings/text.
Typically, Cisco TAC helps you write and apply an APCF.
You can configure multiple APCF profiles on a security appliance to run in parallel. Within an APCF profile script, multiple APCF rules can apply. In this case, the security appliance processes the oldest rule first, based on configuration history, the next oldest rule next, and so forth.
You can store APCF profiles on the security appliance flash memory, or on an HTTP, HTTPS, FTP, or TFTP server. Use this panel to add, edit, and delete APCF packages, and to put them in priority order.
Fields
•
•
•
•
Add/Edit APCF Profile
This panel lets you add or edit and APCF package, which includes identifying its location, which can be either on the security appliance flash memory, or on an HTTP, HTTPS, or TFTP server.
Fields
•
•
•
Note
•
•
•
•
Modes
The following table shows the modes in which this feature is available:
Upload APCF package
Fields
•
•
•
•
•
•
•
•
Modes
The following table shows the modes in which this feature is available:
Clock Accuracy for SharePoint Access
The clientless SSL VPN server on the security appliance uses cookies to interact with applications such as Microsoft Word on the endpoint. The cookie expiration time set by the security appliance can cause Word to malfunction when accessing documents on a SharePoint server if the time on the security appliance is incorrect. To prevent this malfunction, set the ASA clock properly. We recommend configuring the security appliance to dynamically synchronize with NTP services. For instructions, see System Time.
Auto Signon
The Auto Signon window or tab lets you configure or edit auto signon for users of Clientless SSL VPN. Auto signon is a simplified single signon method that you can use if you do not already have an SSO method deployed on your internal network. With auto signon configured for particular internal servers, the security appliance passes the login credentials that the user of Clientless SSL VPN entered to log in to the security appliance (username and password) to those particular internal servers. You configure the security appliance to respond to a specific authentication method for a particular range of servers. The authentication methods you can configure the security appliance to respond to consists of authentication using Basic (HTTP), NTLM, FTP and CIFS, or all of these methods.
Auto signon is a straight-forward method for configuring SSO for particular internal servers. This section describes the procedure for setting up SSO with auto signon. If you already have SSO deployed using Computer Associates' SiteMinder SSO server, or if you have Security Assertion Markup Language (SAML) Browser Post Profile SSO, and if you want to configure the security appliance to support this solution, see SSO Servers.
Note
Fields
•
•
•
•
•
•
Modes
The following table shows the modes in which this feature is available:
Add/Edit Auto Signon Entry
The Add/Edit Auto Signon Entry dialog box lets you add or edit a new auto signon instruction. An auto signon instruction defines a range of internal servers using the auto signon feature and the particular authentication method.
Fields
•
–
–
•
•
–
–
–
–
Note
Modes
The following table shows the modes in which this feature is available:
Configuring Session Settings
The Clientless SSL VPN Add/Edit Internal Group Policy > More Options > Session Settings window lets you specify personalized user information between clientless SSL VPN sessions. By default, each group policy inherits the settings from the default group policy. Use this window to specify personalized clientless SSL VPN user information for the default group policy and any group policies for which you want to differentiate these values.
Fields
•
username:password@host:port-number/path
For example
mike:mysecret@ftpserver3:2323/public
Note
•
•
–
–
–
•
The following table shows the modes in which this feature is available:
Java Code Signer
Code signing appends a digital signature to the executable code itself. This digital signature provides enough information to authenticate the signer as well as to ensure that the code has not been subsequently modified since signed.
Code-signer certificates are special certificates whose associated private keys are used to create digital signatures. The certificates used to sign code are obtained from a CA, with the signed code itself revealing the certificate origin.
To select a Java Code Signer, use the drop down list.
To configure a Java Code Signer, go to Configuration > Remote Access VPN > Certificate Management > Java Code Signer.
Content Cache
Caching enhances the performance of Clientless SSL VPN. It stores frequently reused objects in the system cache, which reduces the need to perform repeated rewriting and compressing of content. The use of the cache reduces traffic, with the result that many applications run more efficiently.
Fields
•
•
–
–
–
Note
–
–
The LM factor sets the policy for caching objects which have only the last-modified timestamp. This revalidates objects that have no server-set change values. The security appliance estimates the length of time since the object has changed, also called the expiration time. The estimated expiration time equals the time elapsed since the last change multiplied by the LM factor. Setting the LM factor to 0 forces immediate revalidation, while setting it to 100 results in the longest allowable time until revalidation.
The expiration time sets the amount of time to for the security appliance to cache objects that have neither a last-modified time stamp nor an explicit server-set expiry time.
–
•
Modes
The following table shows the modes in which this feature is available:
Content Rewrite
The Content Rewrite pane lists all applications for which content rewrite is enabled or disabled.
Clientless SSL VPN processes application traffic through a content transformation/rewriting engine that includes advanced elements such as JavaScript, VBScript, Java, and multi-byte characters to proxy HTTP traffic which may have different semantics and access control rules depending on whether the user is using an application within or independently of an SSL VPN device.
By default, the security appliance rewrites, or transforms, all clientless traffic. You might not want some applications and web resources (for example, public websites) to go through the security appliance. The security appliance therefore lets you create rewrite rules that let users browse certain sites and applications without going through the security appliance. This is similar to split-tunneling in an IPSec VPN connection.
You can create multiple rewrite rules. The rule number is important because the security appliance searches rewrite rules by order number, starting with the lowest, and applies the first rule that matches.
"Example Content Rewrite Rules" shows example content rewrite rules.
Fields
•
–
–
–
–
•
•
Modes
The following table shows the modes in which this feature is available:
Add/Edit Content Rewrite Rule
•
•
•
•
* — Matches everything. ASDM does not accept a mask that consists of a * or *.*
? —Matches any single character.
[!seq] — Matches any character not in sequence.
[seq] — Matches any character in sequence.
Example Content Rewrite Rules
Modes
The following table shows the modes in which this feature is available:
Java Code Signer
Java objects which have been transformed by Clientless SSL VPN can subsequently be signed using a PKCS12 digital certificate associated with a trustpoint. In the Java Trustpoint pane, you can configure the Clientless SSL VPN Java object signing facility to use a PKCS12 certificate and keying material from a specified trustpoint location. To import a trustpoint, see Configuration > Properties > Certificate > Trustpoint > Import.
Fields
•
Modes
The following table shows the modes in which this feature is available:
Encoding
This window lets you view or specify the character encoding for Clientless SSL VPN portal pages.
Character encoding, also called "character coding" and "a character set," is the pairing of raw data (such as 0's and 1's) with characters to represent the data. The language determines the character encoding method to use. Some languages use a single method, while others do not. Usually, the geographic region determines the default encoding method used by the browser, but the remote user can change it. The browser can also detect the encoding specified on the page, and render the document accordingly.
The encoding attribute lets you specify the value of the character-encoding method used on the portal page to ensure that the browser renders it properly, regardless of the region in which the user is using the browser, and regardless of any changes made to the browser.
By default, the security appliance applies the "Global Encoding Type" to pages from Common Internet File System servers. The mapping of CIFS servers to their appropriate character encoding, globally with the "Global Encoding Type" attribute, and individually with the file-encoding exceptions displayed in the table, provides for the accurate handling and display of CIFS pages when the proper rendering of filenames or directory paths, as well as pages, is an issue.
Fields
•
–
–
–
–
–
Note
–
–
–
If you choose none or specify a value that the browser on the Clientless SSL VPN session does not support, it uses its own default encoding.
You can type a string consisting of up to 40 characters, and equal to one of the valid character sets identified in http://www.iana.org/assignments/character-sets. You can use either the name or the alias of a character set listed on that page. The string is case-insensitive. The command interpreter converts upper-case to lower-case when you save the security appliance configuration.
•
A difference in the encoding of the CIFS server filename and directory indicates that you might need to add an entry for the server to ensure the encoding is correct.
•
•
•
•
Modes
The following table shows the modes in which this feature is available:
Add\Edit Encoding
The Add CIFS Server Encoding dialog window lets you maintain exceptions to the "Global Encoding Type" attribute setting in the Add CIFS Encoding window. That window contains the Add and Edit buttons that open this dialog box.
Fields
•
•
–
–
–
–
–
Note
–
–
–
If you choose none or specify a value that the browser on the Clientless SSL VPN session does not support, it uses its own default encoding.
You can type a string consisting of up to 40 characters, and equal to one of the valid character sets identified in http://www.iana.org/assignments/character-sets. You can use either the name or the alias of a character set listed on that page. The string is case-insensitive. The command interpreter converts upper-case to lower-case when you save the security appliance configuration.
Modes
The following table shows the modes in which this feature is available:
Web ACLs
The Web ACLs table displays the filters configured on the security appliance applicable to Clientless SSL VPN traffic. The table shows the name of each access control list (ACL), and below and indented to the right of the ACL name, the access control entries (ACEs) assigned to the ACL.
Each ACL permits or denies access permits or denies access to specific networks, subnets, hosts, and web servers. Each ACE specifies one rule that serves the function of the ACL.
You can configure ACLs to apply to Clientless SSL VPN traffic. The following rules apply:
•
•
•
You can use the following wildcard characters to define more than one wildcard in the Webtype access list entry:
•
•
•
The following examples show how to use wildcards in Webtype access lists.
•
access-list test webtype permit url http://ww?.c*co*/•
access-list test webtype permit url *://ww?.c*co*/•
access-list test webtype permit url *://ww?.c*co*:8[01]/The range operator "[]" in the preceding example specifies that either character 0 or 1 can occur.
•
access-list test webtype permit url http://www.[a-z]oo?*/The range operator "[]" in the preceding example specifies that any character in the range from a to z can occur.
•
access-list test webtype permit url htt*://*/*cgi?*
Note
You can add ACLs and ACEs as follows:
•
Note
•
•
•
To change the values assigned to an ACE, double-click it, or select it and click Edit.
To remove an ACL or an ACE, select the entry in the table and click Delete.
The relative position of an ACE in an ACL determines the sequence with which the security appliance applies it to traffic on the interface. You can reorganize and reuse the ACEs present in the table as follows.
•
•
•
Modes
The following table shows the modes in which this feature is available:
Port Forwarding
Both the Port Forwarding pane and Configure Port Forwarding Lists dialog box let you view the port forwarding lists. Both the Port Forwarding pane and the Add or Edit Port Forwarding Entry dialog box let you specify the name of a port forwarding list, and add, view, edit, and delete port forwarding entries to the list.
To add, change, or remove a port forwarding list, do one of the following:
•
•
•
Why Port Forwarding?
Port forwarding is the legacy technology for supporting TCP-based applications over a clientless SSL VPN connection. You may choose to use port forwarding because you have built earlier configurations that support this technology.
Please consider the following alternatives to port forwarding:
•
–
–
–
•
When configuring port forwarding on the security appliance, you specify the port the application uses. When configuring smart tunnel access, you specify the name of the executable file or its path.
Requirements and Restrictions
The following restrictions apply to port forwarding:
•
–
–
–
•
•
–
–
For details, go to the Safari, Mac OS X 10.5.3: Changes in client certificate authentication.
•
•
•
•
•
•
•
Caution
The Java applet displays in its own window on the end user HTML interface. It shows the contents of the list of forwarded ports available to the user, as well as which ports are active, and amount of traffic in bytes sent and received.
•
•
Configuring DNS for Port Forwarding
Port Forwarding forwards the domain name of the remote server or its IP address to the ASA for resolution and connection. In other words, the port forwarding applet accepts a request from the application and forwards it to the ASA. The ASA makes the appropriate DNS queries and establishes the connection on behalf of the port forwarding applet. The port forwarding applet only makes DNS queries to the ASA. It updates the host file so that when a port forwarding application attempts a DNS query, the query redirects to a loopback address.
Configure the security appliance to accept the DNS requests from the port forwarding applet as follows:
Step 1
The DefaultWEBVPNGroup entry is the default connection profile used for clientless connections.
Step 2
The Basic window opens.
Step 3
Step 4
The Configure DNS Server Groups window opens.
Step 5
A window displays a table of DNS server entries.
Step 6
The Add DNS Server Group window opens.
Step 7
Figure 38-1 Example DNS Server Values for Port Forwarding
Note the domain name you entered. You need it when you specify the remote server later while configuring a port forwarding entry.
Step 8
Step 9
Step 10
Modes
The following table shows the modes in which this feature is available:
Add/Edit Port Forwarding List
The Add/Edit Port Forwarding List dialog boxes let you add or edit a named list of TCP applications to associate with users or group policies for access over clientless SSL VPN connections.
Fields
•
•
•
•
•
Modes
The following table shows the modes in which this feature is available:
Add/Edit Port Forwarding Entry
The Add/Edit Port Forwarding Entry dialog boxes let you specify TCP applications to associate with users or group policies for access over clientless SSL VPN connections. Assign values to the attributes in these windows as follows:
•
•
Caution
•
•
Modes
The following table shows the modes in which this feature is available:
Configuring the Use of External Proxy Servers
Use the Proxies pane to configure the security appliance to use external proxy servers to handle HTTP requests and HTTPS requests. These servers act as an intermediary between users and the Internet. Requiring all Internet access via servers you control provides another opportunity for filtering to assure secure Internet access and administrative control.
Note
Fields
Use an HTTP proxy server—Click to use an external HTTP proxy server.
•
•
•
•
–
–
–
–
•
•
•
Use an HTTPS proxy server—Click to use an external HTTPS proxy server.
•
•
•
•
–
–
–
–
•
•
Modes
The following table shows the modes in which this feature is available:
Configuring Proxy Bypass
You can configure the security appliance to use proxy bypass when applications and web resources work better with the special content rewriting this feature provides. Proxy bypass is an alternative method of content rewriting that makes minimal changes to the original content. It is often useful with custom web applications.
You can configure multiple proxy bypass entries. The order in which you configure them is unimportant. The interface and path mask or interface and port uniquely identify a proxy bypass rule.
If you configure proxy bypass using ports rather than path masks, depending on your network configuration, you might need to change your firewall configuration to allow these ports access to the security appliance. Use path masks to avoid this restriction. Be aware, however, that path masks can change, so you might need to use multiple pathmask statements to exhaust the possibilities.
A path is the text in a URL that follows the domain name. For example, in the URL www.example.com/hrbenefits, hrbenefits is the path. Similarly, for the URL www.example.com/hrinsurance, hrinsurance is the path. If you want to use proxy bypass for all hr sites, you can avoid using the command multiple times by using the * wildcard as follows: /hr*.
Fields
•
•
•
•
•
•
•
Modes
The following table shows the modes in which this feature is available:
Add/Edit Proxy Bypass Rule
This panel lets you set rules for when the security appliance performs little or no content rewriting.
Fields
•
•
–
–
–
–
•
–
–
•
–
–
Modes
The following table shows the modes in which this feature is available:
DTLS Settings
Enabling Datagram Transport Layer Security (DTLS) allows the AnyConnect VPN Client establishing an SSL VPN connection to use two simultaneous tunnels—an SSL tunnel and a DTLS tunnel. Using DTLS avoids latency and bandwidth problems associated with some SSL connections and improves the performance of real-time applications that are sensitive to packet delays.
If you do not enable DTLS, AnyConnect client users establishing SSL VPN connections connect with an SSL VPN tunnel only.
Fields
•
•
•
Modes
The following table shows the modes in which this feature is available:
SSL VPN Client Settings
The Cisco AnyConnect VPN Client provides secure SSL connections to the security appliance for remote users. The client gives remote users the benefits of an SSL VPN client without the need for network administrators to install and configure clients on remote computers.
Without a previously-installed client, remote users enter the IP address in their browser of an interface configured to accept SSL VPN connections. Unless the security appliance is configured to redirect http:// requests to https://, users must enter the URL in the form https://<address>.
After entering the URL, the browser connects to that interface and displays the login screen. If the user satisfies the login and authentication, and the security appliance identifies the user as requiring the client, it downloads the client that matches the operating system of the remote computer. After downloading, the client installs and configures itself, establishes a secure SSL connection and either remains or uninstalls itself (depending on the security appliance configuration) when the connection terminates.
In the case of a previously installed client, when the user authenticates, the security appliance examines the revision of the client, and upgrades the client as necessary.
When the client negotiates an SSL VPN connection with the security appliance, it connects using Transport Layer Security (TLS), and optionally, Datagram Transport Layer Security (DTLS). DTLS avoids latency and bandwidth problems associated with some SSL connections and improves the performance of real-time applications that are sensitive to packet delays.
The AnyConnect client can be downloaded from the security appliance, or it can be installed manually on the remote PC by the system administrator. For more information about installing the client manually, see the Cisco AnyConnect VPN Client Administrator Guide.
The security appliance downloads the client based on the group policy or local user policy attributes. You can configure the security appliance to automatically download the client, or you can configure it to prompt the remote user about whether to download the client. In the latter case, if the user does not respond, you can configure the security appliance to either download the client after a timeout period or present the login page.
Fields
•
–
–
–
–
•
–
–
–
•
Modes
The following table shows the modes in which this feature is available:
Add/Replace SSL VPN Client Image
In this window, you can specify a filename for a file on the security appliance flash memory that you want to add as an SSL VPN client image, or to replace an image already listed in the table. You can also browse the flash memory for a file to identify, or you can upload a file from a local computer.
Fields
•
•
•
•
Modes
The following table shows the modes in which this feature is available:
Upload Image
In this window, you can specify the path of a file on the local computer or in flash memory of the security appliance that you want to identify as an SSL VPN client image. You can also browse the local computer or the flash memory of the security appliance for a file to identify.
Fields
•
•
•
•
•
Modes
The following table shows the modes in which this feature is available:
Add/Edit SSL VPN Client Profiles
In this window, you can specify the path of a file on the local computer or in flash memory of the security appliance that you want to identify as an SSL VPN client profile. These profiles display host information in the AnyConnect VPN Client user interface. You can also browse the local computer or the flash memory of the security appliance for a file to identify.
Fields
•
•
•
•
Modes
The following table shows the modes in which this feature is available:
Upload Package
In this window, you can specify the path of a file on the local computer or in flash memory of the security appliance that you want to identify as an SSL VPN client profile. You can also browse the local computer or the flash memory of the security appliance for a file to identify.
Fields
•
•
•
•
•
Modes
The following table shows the modes in which this feature is available:
Bypass Interface Access List
You can require an access rule to apply to the local IP addresses by unchecking this option. The access rule applies to the local IP address, and not to the original client IP address used before the VPN packet was decrypted.
•
SSO Servers
The SSO Server window lets you configure or delete single sign-on (SSO) for users of Clientless SSL VPN connecting to a Computer Associates SiteMinder SSO server or to a Security Assertion Markup Language (SAML), Version 1.1, Browser Post Profile SSO server. SSO support, available only for Clientless SSL VPN, lets users access different secure services on different servers without entering a username and password more than once.
You can choose from four methods when configuring SSO: Auto Signon using basic HTTP and/or NTLMv1 authentication, HTTP Form protocol, or Computer Associates eTrust SiteMinder (formerly Netegrity SiteMinder), or SAML, Version 1.1 Browser Post Profile.
Note
This section describes the procedures for setting up SSO with both SiteMinder and SAML Browser Post Profile.
•
•
The SSO mechanism either starts as part of the AAA process (HTTP Forms) or just after successful user authentication to either a AAA server (SiteMinder) or a SAML Browser Post Profile server. In these cases, the Clientless SSL VPN server running on the security appliance acts as a proxy for the user to the authenticating server. When a user logs in, the Clientless SSL VPN server sends an SSO authentication request, including username and password, to the authenticating server using HTTPS.
If the authenticating server approves the authentication request, it returns an SSO authentication cookie to the Clientless SSL VPN server. This cookie is kept on the security appliance on behalf of the user and used to authenticate the user to secure websites within the domain protected by the SSO server.
Configuring SiteMinder and SAML Browser Post Profile
SSO authentication with SiteMinder or with SAML Browser Post Profile is separate from AAA and occurs after the AAA process completes. To set up SiteMinder SSO for a user or group, you must first configure a AAA server (RADIUS, LDAP and so forth). After the AAA server authenticates the user, the Clientless SSL VPN server uses HTTPS to send an authentication request to the SiteMinder SSO server.
In addition to configuring the security appliance, for SiteMinder SSO, you also must configure your CA SiteMinder Policy Server with the Cisco authentication scheme. See Adding the Cisco Authentication Scheme to SiteMinder.
For SAML Browser Post Profile you must configure a Web Agent (Protected Resource URL) for authentication. For the specifics of setting up a SAML Browser Post Profile SSO server, see SAML POST SSO Server Configuration.
Fields
•
•
•
•
•
•
•
•
Modes
The following table shows the modes in which this feature is available:
SAML POST SSO Server Configuration
Use the SAML server documentation provided by the server software vendor to configure the SAML server in Relying Party mode. The following steps list the values required to configure the SAML Server for Browser Post Profile:
Step 1
•
•
•
Step 2
Step 3
Step 4
•
•
Adding the Cisco Authentication Scheme to SiteMinder
Besides configuring the security appliance for SSO with SiteMinder, you must also configure your CA SiteMinder Policy Server with the Cisco authentication scheme, provided as a Java plug-in.
Note
•
•
To configure the Cisco authentication scheme on your SiteMinder Policy Server, perform the following tasks:
Step 1
•
•
•
Step 2
Add/Edit SSO Servers
This SSO method uses CA SiteMinder and SAML Browser Post Profile. You can also set up SSO using the HTTP Form protocol, or Basic HTML and NTLM authentication. To use the HTTP Form protocol, see Configuring Session Settings. To set use basic HTML or NTLM authentication, use the auto-signon command at the command line interface.
Fields
•
•
•
•
•
•
Modes
The following table shows the modes in which this feature is available:
Clientless SSL VPN Access
The Clientless SSL VPN Access panel lets you accomplish the following tasks:
•
•
•
•
•
To configure Clientless SSL VPN services for individual users, the best practice is to use the Configuration > VPN > General > Group Policy >Add/Edit >WebVPN panel. Then use the Configuration > Properties >Device Administration >User Accounts > VPN Policy panel to assign the group policy to a user.
Fields
•
–
–
A green check next to Yes indicates that Clientless SSL VPN is enabled.
A red circle next to No indicates that Clientless SSL VPN is disabled.
–
•
•
We recommend that you set this attribute to a short time period. This is because a browser set to disable cookies (or one that prompts for cookies and then denies them) can result in a user not connecting but nevertheless appearing in the sessions database. If the Simultaneous Logins attribute for the group policy is set to one, the user cannot log back in because the database indicates that the maximum number of connections already exists. Setting a low idle timeout removes such phantom sessions quickly, and lets a user log in again.
•
•
•
•
Modes
The following table shows the modes in which this feature is available:
For More Information
Clientless SSL VPN End User Set-up
Configuring Smart Tunnel Access
The Smart Tunnels table displays the smart tunnel lists, each of which identifies one or more applications eligible for smart tunnel access, and its associated OS. Because each group policy or local user policy supports one smart tunnel list, you must group the nonbrowser-based applications to be supported into a smart tunnel list. Following the configuration of a list, you can assign it to one or more group polices or local user policies.
The Configuration > Remote Access VPN > Clientless SSL VPN Access > Portal > Smart Tunnels window lets you do the following:
•
•
•
Following the configuration and assignment of a smart tunnel list, you can make a smart tunnel easy to use by adding a bookmark for the service and clicking the Enable Smart Tunnel Option in the Add or Edit Bookmark dialog box.
About Smart Tunnels
A smart tunnel is a connection between a TCP-based application and a private site, using a clientless (browser-based) SSL VPN session with the security appliance as the pathway, and the security appliance as a proxy server. You can identify applications to which you want to grant smart tunnel access, and specify the local path to each application. For applications running on Microsoft Windows, you can also require a match of the SHA-1 hash of the checksum as a condition for granting smart tunnel access.
Lotus SameTime and Microsoft Outlook Express are examples of applications to which you might want to grant smart tunnel access.
Configuring smart tunnels requires one of the following procedures, depending on whether the application is a client or is a web-enabled application:
•
•
You can also list web-enabled applications for which to automate the submission of login credentials in smart tunnel connections over clientless SSL VPN sessions.
Why Smart Tunnels?
Smart tunnel access lets a client TCP-based application use a browser-based VPN connection to connect to a service. It offers the following advantages to users, compared to plug-ins and the legacy technology, port forwarding:
•
•
•
The advantage of a plug-in is that it does not require the client application to be installed on the remote computer.
Smart Tunnel Requirements and Limitations
The following sections categorize the smart tunnel requirements and limitations.
General Requirements and Limitations
Smart tunnel has the following general requirements and limitations:
•
•
•
•
In an HTTP-based remote access scenario, sometimes a subnet does not provide user access to the VPN gateway. In this case, a proxy placed in front of the ASA to route traffic between the web and the end user's location provides web access. However, only VPN users can configure proxies placed in front of the ASA. When doing so, they must make sure these proxies support the CONNECT method. For proxies that require authentication, smart tunnel supports only the basic digest authentication type.
•
•
Windows Requirements and Limitations
The following requirements and limitations apply to Windows only:
•
•
•
Mac OS Requirements and Limitations
The following requirements and limitations apply to Mac OS only:
•
•
•
•
•
•
–
–
–
–
–
–
Configuring a Smart Tunnel (Lotus example)
To configure a Smart Tunnel, perform the following steps:
Note
Step 1
Step 2
For example, click Add in the Smart Tunnels pane, enter Lotus in the List Name field, and click Add.
Step 3
Step 4
Step 5
Table 38-1 shows example Application ID strings and the associated paths required to support Lotus.
Step 6
Step 7
Step 8
Step 9
Step 10
•
•
Add or Edit Smart Tunnel List
The Add Smart Tunnel List dialog box lets you add a list of smart tunnel entries to the security appliance configuration. The Edit Smart Tunnel List dialog box lets you modify the contents of the list.
Field
•
Following the configuration of the smart tunnel list, the list name appears next to the Smart Tunnel List attribute in the Clientless SSL VPN group policies and local user policies. Assign a name that will help you to distinguish its contents or purpose from other lists that you are likely to configure.
Modes
The following table shows the modes in which this feature is available:
Add or Edit Smart Tunnel Entry
The Add or Edit Smart Tunnel Entry dialog box lets you specify the attributes of an application in a smart tunnel list.
•
•
Windows requires an exact match of this value to the right side of the application path on the remote host to qualify the application for smart tunnel access. If you specify only the filename for Windows, SSL VPN does not enforce a location restriction on the remote host to qualify the application for smart tunnel access.
If you specify a path and the user installed the application in another location, that application does not qualify. The application can reside on any path as long as the right side of the string matches the value you enter.
To authorize an application for smart tunnel access if it is present on one of several paths on the remote host, either specify only the name and extension of the application in this field; or create a unique smart tunnel entry for each path.
Note
For Windows, if you want to add smart tunnel access to an application started from the command prompt, you must specify "cmd.exe" in the Process Name of one entry in the smart tunnel list, and specify the path to the application itself in another entry, because "cmd.exe" is the parent of the application.
Mac OS requires the full path to the process, and is case-sensitive. To avoid specifying a path for each username, insert a tilde (~) before the partial path (e.g., ~/bin/vnc).
•
•
The SHA-1 hash is always 40 hexadecimal characters.
Before authorizing an application for smart tunnel access, Clientless SSL VPN calculates the hash of the application matching the Application ID. It qualifies the application for smart tunnel access if the result matches the value of Hash.
Entering a hash provides a reasonable assurance that SSL VPN does not qualify an illegitimate file that matches the string you specified in the Application ID. Because the checksum varies with each version or patch of an application, the Hash you enter can only match one version or patch on the remote host. To specify a hash for more than one version of an application, create a unique smart tunnel entry for each Hash value.
Note
Following the configuration of the smart tunnel list, you must assign it to a group policy or a local user policy for it to become active, as follows:
•
•
Modes
The following table shows the modes in which this feature is available:
Add or Edit Smart Tunnel Auto Sign-on Server List
The Add Smart Tunnel Auto Sign-on Server List dialog box lets you add one or more lists of servers for which to automate the submission of login credentials during smart tunnel setup. The Edit Smart Tunnel Auto-signon Server List dialog box lets you modify the contents of these lists.
Field
•
Following the configuration of the smart tunnel auto sign-on list, the list name appears next to the Auto Sign-on Server List attribute under Smart Tunnel in the Clientless SSL VPN group policy and local user policy configurations. Assign a name that will help you to distinguish its contents or purpose from other lists that you are likely to configure.
Modes
The following table shows the modes in which this feature is available:
Add or Edit Smart Tunnel Auto Sign-on Server Entry
The Add or Edit Smart Tunnel Entry dialog box lets you identify a server to be added to a smart tunnel auto sign-on list. You can identify it by its hostname, or IP address and subnet mask.
Caution
•
–
–
–
For example, enter *.example.com. Using this option protects the configuration from dynamic changes to IP addresses.
•
•
•
Following the configuration of the smart tunnel auto sign-on server list, you must assign it to a group policy or a local user policy for it to become active, as follows:
•
•
Modes
The following table shows the modes in which this feature is available:
Configuring Customization Objects
You can customize all end-user visible content on the clientless SSL VPN portal. To do so, you create an XML customization object, using an XML template, the Customization Editor in ASDM, or by exporting and editing an already existing customization object, which you then reimport to the security appliance.
Version 8.0 software extends the functionality for configuring customization, and the new process is incompatible with previous versions. During the upgrade to 8.0 software, the security appliance preserves a current configuration by using old settings to generate new customization objects. This process occurs only once, and is more than a simple transformation from the old format to the new one because the old values are only a partial subset of the new ones.
Note
From the current pane, you can add a new customization object, based on a template, or you can modify an already-imported customization object.
Fields
Add—Click to invoke the Add Customization pane, which lets you make a copy of the default customization object and save it with a unique name. Then you can use the ASDM SSL VPN Customization Editor to modify it to suit your requirements.
Edit—Click to edit an existing, highlighted customization object. Doing so invokes the SSL VPN Customization Editor.
Delete—Click to delete a customization object.
Import—Click to import a customization object, which is an XML file. For information about creating such an XML file, click this link: Creating XML-Based Portal Customization Objects and URL Lists.
Export—Click to export an exiting, highlighted customization object. Doing so lets you edit the object, and then reimport it to this security appliance or to another one.
Customization Objects—Lists the existing customization objects on the security appliance.
OnScreen Keyboard—Specify when to display the OnScreen Keyboard to end users. This keyboard provides additional security by eliminating the need to enter keystrokes on a physical keyboard for passwords when users log on or otherwise authenticate.
Modes
The following table shows the modes in which this feature is available:
Add Customization Object
To add a customization object, create a copy of and provide a unique name for the DfltCustomization object. Then you can modify or edit it to meet your requirements.
Field
Customization Object Name—Enter a name for the new customization object. Maximum 64 characters, no spaces.
Modes
The following table shows the modes in which this feature is available:
Import/Export Customization Object
You can import or export already-existing customization objects. Import an object that you want to apply to end users. Export a customization object already resident on the security appliance for editing purposes, after which you can reimport it.
Fields
•
•
–
–
–
–
–
–
–
–
•
Modes
The following table shows the modes in which this feature is available:
Creating XML-Based Portal Customization Objects and URL Lists
This section includes the following topics:
•
•
Understanding the XML Customization File Structure
Table 38-3 presents the file structure for an XML customization object.
Note
(hostname)# param value ""
Absence of a parameter/tag results in a default/inherited value, while presence results in setting the parameter/tag value even it is an empty string.
Customization Example
The following example illustrates the following customization options:
•
•
•
•
•
<custom name="Default"><auth-page><window><title-text l10n="yes">title WebVPN Logon</title></window><title-panel><mode>enable</mode><text l10n="yes">XYZ WebVPN</text><logo-url>http://www.xyz.com/images/XYZ.gif</logo-url></title-panel><copyright><mode>enable</mode><text l10n="yes">(c)Copyright, XYZ Inc., 2006</text></copyright><info-panel><mode>enable</mode><image-url>/+CSCOE+/custom/XYZ.jpg</image-url><text l10n="yes"><![CDATA[<div><b>Welcome to WebVPN !.</b></div>]]></text></info-panel><logon-form><form><title-text l10n="yes">title WebVPN Logon</title><message-text l10n="yes">message WebVPN Logon</title><username-prompt-text l10n="yes">Username</username-prompt-text><password-prompt-text l10n="yes">Password</password-prompt-text><internal-password-prompt-text l10n="yes">Domain password</internal-password-prompt-text><group-prompt-text l10n="yes">Group</group-prompt-text><submit-button-text l10n="yes">Logon</submit-button-text></form></logon-form><logout-form><form><title-text l10n="yes">title WebVPN Logon</title><message-text l10n="yes">message WebVPN Logon</title><login-button-text l10n="yes">Login</login-button-text><close-button-text l10n="yes">Logon</close-button-text></form></logout-form><language-slector><language><code l10n="yes">code1</code><text l10n="yes">text1</text></language><language><code l10n="yes">code2</code><text l10n="yes">text2</text></language></language-slector></auth-page><portal><window><title-text l10n="yes">title WebVPN Logon</title></window><title-panel><mode>enable</mode><text l10n="yes">XYZ WebVPN</text><logo-url>http://www.xyz.com/logo.gif</logo-url></title-panel><navigation-panel><mode>enable</mode></navigation-panel><application><id>file-access</id><mode>disable</mode></application><application><id>web-access</id><tab-title>XYZ Intranet</tab-title><order>3001</order></application><column><order>2</order><width>40%</width><column><column><order>1</order><width>60%</width><column><url-lists><mode>no-group</mode></url-lists><pane><id>rss_pane</id><type>RSS</type><url>rss.xyz.com?id=78</url></pane><pane><id>text_pane</id><type>TEXT</type><url>rss.xyz.com?id=78</url><column>1</column><row>0</row><text>Welcome to XYZ WebVPN Service</text></pane><pane><type>IMAGE</type><url>http://www.xyz.com/logo.gif</url><column>1</column><row>2</row></pane><pane><type>HTML</type><title>XYZ news</title><url>http://www.xyz.com/news.html</url><column>1</column><row>3</row></pane></portal></custom>Using the Customization Template
A customization template, named Template, contains all currently employed tags with corresponding comments that describe how to use them. Use the export command to download the customization template from the security appliance, as follows:
hostname# export webvpn customization Template tftp://webserver/default.xmlhostname#You cannot change or delete the file Template. When you export it as in this example, you are saving it to a new name, default.xml. After you make your changes to this file, using it to create a customization object that meets the needs of your organization, you import it to the security appliance, either as default.xml or another name of your choosing. For example,
hostname# import webvpn customization General tftp://webserver/custom.xml
hostname#
where you import an XML object called custom.xml and name it General on the security appliance.
The Customization Template
The customization template, named Template, follows.
<?xml version="1.0" encoding="UTF-8" ?>- <!--Copyright (c) 2007,2008 by Cisco Systems, Inc.All rights reserved.Note: all white spaces in tag values are significant and preserved.Tag: customDescription: Root customization tagTag: custom/languagesDescription: Contains list of languages, recognized by ASAValue: string containing comma-separated language codes. Each language code isa set dash-separated alphanumeric characters, started withalpha-character (for example: en, en-us, irokese8-language-us)Default value: en-usTag: custom/default-languageDescription: Language code that is selected when the client and the serverwere not able to negotiate the language automatically.For example the set of languages configured in the browseris "en,ja", and the list of languages, specified by'custom/languages' tag is "cn,fr", the default-language will beused.Value: string, containing one of the language coded, specified in'custom/languages' tag above.Default value: en-us*********************************************************Tag: custom/auth-pageDescription: Contains authentication page settings*********************************************************Tag: custom/auth-page/windowDescription: Contains settings of the authentication page browser windowTag: custom/auth-page/window/title-textDescription: The title of the browser window of the authentication pageValue: arbitrary stringDefault value: Browser's default value*********************************************************Tag: custom/auth-page/title-panelDescription: Contains settings for the title panelTag: custom/auth-page/title-panel/modeDescription: The title panel modeValue: enable|disableDefault value: disableTag: custom/auth-page/title-panel/textDescription: The title panel text.Value: arbitrary stringDefault value: empty stringTag: custom/auth-page/title-panel/logo-urlDescription: The URL of the logo image (imported via "import webvpn webcontent")Value: URL stringDefault value: empty image URLTag: custom/auth-page/title-panel/background-colorDescription: The background color of the title panelValue: HTML color format, for example #FFFFFFDefault value: #FFFFFFTag: custom/auth-page/title-panel/font-colorDescription: The background color of the title panelValue: HTML color format, for example #FFFFFFDefault value: #000000Tag: custom/auth-page/title-panel/font-weightDescription: The font weightValue: CSS font size value, for example bold, bolder,lighter etc.Default value: empty stringTag: custom/auth-page/title-panel/font-sizeDescription: The font sizeValue: CSS font size value, for example 10pt, 8px, x-large, smaller etc.Default value: empty stringTag: custom/auth-page/title-panel/gradientDescription: Specifies using the background color gradientValue: yes|noDefault value:noTag: custom/auth-page/title-panel/styleDescription: CSS style of the title panelValue: CSS style stringDefault value: empty string*********************************************************Tag: custom/auth-page/copyright-panelDescription: Contains the copyright panel settingsTag: custom/auth-page/copyright-panel/modeDescription: The copyright panel modeValue: enable|disableDefault value: disableTag: custom/auth-page/copyright-panel/textDescription: The copyright panel textValue: arbitrary stringDefault value: empty string*********************************************************Tag: custom/auth-page/info-panelDescription: Contains information panel settingsTag: custom/auth-page/info-panel/modeDescription: The information panel modeValue: enable|disableDefault value: disableTag: custom/auth-page/info-panel/image-positionDescription: Position of the image, above or below the informational panel textValues: above|belowDefault value: aboveTag: custom/auth-page/info-panel/image-urlDescription: URL of the information panel image (imported via "import webvpn webcontent")Value: URL stringDefault value: empty image URLTag: custom/auth-page/info-panel/textDescription: Text of the information panelText: arbitrary stringDefault value: empty string*********************************************************Tag: custom/auth-page/logon-formDescription: Contains logon form settingsTag: custom/auth-page/logon-form/title-textDescription: The logon form title textValue: arbitrary stringDefault value: "Logon"Tag: custom/auth-page/logon-form/message-textDescription: The message inside of the logon formValue: arbitrary stringDefault value: empty stringTag: custom/auth-page/logon-form/username-prompt-textDescription: The username prompt textValue: arbitrary stringDefault value: "Username"Tag: custom/auth-page/logon-form/password-prompt-textDescription: The password prompt textValue: arbitrary stringDefault value: "Password"Tag: custom/auth-page/logon-form/internal-password-prompt-textDescription: The internal password prompt textValue: arbitrary stringDefault value: "Internal Password"Tag: custom/auth-page/logon-form/group-prompt-textDescription: The group selector prompt textValue: arbitrary stringDefault value: "Group"Tag: custom/auth-page/logon-form/submit-button-textDescription: The submit button textValue: arbitrary stringDefault value: "Logon"Tag: custom/auth-page/logon-form/internal-password-firstDescription: Sets internal password first in the orderValue: yes|noDefault value: noTag: custom/auth-page/logon-form/title-font-colorDescription: The font color of the logon form titleValue: HTML color format, for example #FFFFFFDefault value: #000000Tag: custom/auth-page/logon-form/title-background-colorDescription: The background color of the logon form titleValue: HTML color format, for example #FFFFFFDefault value: #000000Tag: custom/auth-page/logon-form/font-colorDescription: The font color of the logon formValue: HTML color format, for example #FFFFFFDefault value: #000000Tag: custom/auth-page/logon-form/background-colorDescription: The background color of the logon formValue: HTML color format, for example #FFFFFFDefault value: #000000*********************************************************Tag: custom/auth-page/logout-formDescription: Contains the logout form settingsTag: custom/auth-page/logout-form/title-textDescription: The logout form title textValue: arbitrary stringDefault value: "Logout"Tag: custom/auth-page/logout-form/message-textDescription: The logout form message textValue: arbitrary stringDefault value: Goodbye.For your own security, please:Clear the browser's cacheDelete any downloaded filesClose the browser's windowTag: custom/auth-page/logout-form/login-button-textDescription: The text of the button sending the user to the logon pageValue: arbitrary stringDefault value: "Logon"*********************************************************Tag: custom/auth-page/language-selectorDescription: Contains the language selector settingsTag: custom/auth-page/language-selector/modeDescription: The language selector modeValue: enable|disableDefault value: disableTag: custom/auth-page/language-selector/titleDescription: The language selector titleValue: arbitrary stringDefault value: empty stringTag: custom/auth-page/language-selector/language (multiple)Description: Contains the language settingsTag: custom/auth-page/language-selector/language/codeDescription: The code of the languageValue (required): The language code stringTag: custom/auth-page/language-selector/language/textDescription: The text of the language in the language selector drop-down boxValue (required): arbitrary string*********************************************************Tag: custom/portalDescription: Contains portal page settings*********************************************************Tag: custom/portal/windowDescription: Contains the portal page browser window settingsTag: custom/portal/window/title-textDescription: The title of the browser window of the portal pageValue: arbitrary stringDefault value: Browser's default value*********************************************************Tag: custom/portal/title-panelDescription: Contains settings for the title panelTag: custom/portal/title-panel/modeDescription: The title panel modeValue: enable|disableDefault value: disableTag: custom/portal/title-panel/textDescription: The title panel text.Value: arbitrary stringDefault value: empty stringTag: custom/portal/title-panel/logo-urlDescription: The URL of the logo image (imported via "import webvpn webcontent")Value: URL stringDefault value: empty image URLTag: custom/portal/title-panel/background-colorDescription: The background color of the title panelValue: HTML color format, for example #FFFFFFDefault value: #FFFFFFTag: custom/auth-pa/title-panel/font-colorDescription: The background color of the title panelValue: HTML color format, for example #FFFFFFDefault value: #000000Tag: custom/portal/title-panel/font-weightDescription: The font weightValue: CSS font size value, for example bold, bolder,lighter etc.Default value: empty stringTag: custom/portal/title-panel/font-sizeDescription: The font sizeValue: CSS font size value, for example 10pt, 8px, x-large, smaller etc.Default value: empty stringTag: custom/portal/title-panel/gradientDescription: Specifies using the background color gradientValue: yes|noDefault value:noTag: custom/portal/title-panel/styleDescription: CSS style for title textValue: CSS style stringDefault value: empty string*********************************************************Tag: custom/portal/application (multiple)Description: Contains the application settingTag: custom/portal/application/modeDescription: The application modeValue: enable|disableDefault value: enableTag: custom/portal/application/idDescription: The application ID. Standard application ID's are: home, web-access, file-access, app-access, network-access, helpValue: The application ID stringDefault value: empty stringTag: custom/portal/application/tab-titleDescription: The application tab text in the navigation panelValue: arbitrary stringDefault value: empty stringTag: custom/portal/application/orderDescription: The order of the application's tab in the navigation panel. Applications with lesser order go first.Value: arbitrary numberDefault value: 1000Tag: custom/portal/application/url-list-titleDescription: The title of the application's URL list pane (in group mode)Value: arbitrary stringDefault value: Tab tite value concatenated with "Bookmarks"*********************************************************Tag: custom/portal/navigation-panelDescription: Contains the navigation panel settingsTag: custom/portal/navigation-panel/modeDescription: The navigation panel modeValue: enable|disableDefault value: enable*********************************************************Tag: custom/portal/toolbarDescription: Contains the toolbar settingsTag: custom/portal/toolbar/modeDescription: The toolbar modeValue: enable|disableDefault value: enableTag: custom/portal/toolbar/prompt-box-titleDescription: The universal prompt box titleValue: arbitrary stringDefault value: "Address"Tag: custom/portal/toolbar/browse-button-textDescription: The browse button textValue: arbitrary stringDefault value: "Browse"Tag: custom/portal/toolbar/logout-prompt-textDescription: The logout prompt textValue: arbitrary stringDefault value: "Logout"*********************************************************Tag: custom/portal/column (multiple)Description: Contains settings of the home page column(s)Tag: custom/portal/column/orderDescription: The order the column from left to right. Columns with lesser order values go firstValue: arbitrary numberDefault value: 0Tag: custom/portal/column/widthDescription: The home page column widthValue: percentDefault value: default value set by browserNote: The actual width may be increased by browser to accommodate content*********************************************************Tag: custom/portal/url-listsDescription: Contains settings for URL lists on the home pageTag: custom/portal/url-lists/modeDescription: Specifies how to display URL lists on the home page:group URL lists by application (group) orshow individual URL lists (nogroup).URL lists fill out cells of the configured columns, which are not takenby custom panes.Use the attribute value "nodisplay" to not show URL lists on the home page.Value: group|nogroup|nodisplayDefault value: group*********************************************************Tag: custom/portal/pane (multiple)Description: Contains settings of the custom pane on the home pageTag: custom/portal/pane/modeDescription: The mode of the paneValue: enable|disableDefault value: disableTag: custom/portal/pane/titleDescription: The title of the paneValue: arbitrary stringDefault value: empty stringTag: custom/portal/pane/notitleDescription: Hides pane's title barValue: yes|noDefault value: noTag: custom/portal/pane/typeDescription: The type of the pane. Supported types:TEXT - inline arbitrary text, may contain HTML tags;HTML - HTML content specified by URL shown in the individual iframe;IMAGE - image specified by URLRSS - RSS feed specified by URLValue: TEXT|HTML|IMAGE|RSSDefault value: TEXTTag: custom/portal/pane/urlDescription: The URL for panes with type HTML,IMAGE or RSSValue: URL stringDefault value: empty stringTag: custom/portal/pane/textDescription: The text value for panes with type TEXTValue: arbitrary stringDefault value:empty stringTag: custom/portal/pane/columnDescription: The column where the pane located.Value: arbitrary numberDefault value: 1Tag: custom/portal/pane/rowDescription: The row where the pane is locatedValue: arbitrary numberDefault value: 1Tag: custom/portal/pane/heightDescription: The height of the paneValue: number of pixelsDefault value: default value set by browser*********************************************************Tag: custom/portal/browse-network-titleDescription: The title of the browse network linkValue: arbitrary stringDefault value: Browse Entire NetworkTag: custom/portal/access-network-titleDescription: The title of the link to start a network access sessionValue: arbitrary stringDefault value: Start AnyConnect-->- <custom>- <localization><languages>en,ja,zh,ru,ua</languages><default-language>en</default-language></localization>- <auth-page>- <window>- <title-text l10n="yes">- <![CDATA[WebVPN Service]]></title-text></window>- <language-selector><mode>disable</mode><title l10n="yes">Language:</title>- <language><code>en</code><text>English</text></language>- <language><code>zh</code><text>?? (Chinese)</text></language>- <language><code>ja</code><text>?? (Japanese)</text></language>- <language><code>ru</code><text>??????? (Russian)</text></language>- <language><code>ua</code><text>?????????? (Ukrainian)</text></language></language-selector>- <logon-form>- <title-text l10n="yes">- <![CDATA[Login]]></title-text>- <title-background-color>- <![CDATA[#666666]]></title-background-color>- <title-font-color>- <![CDATA[#ffffff]]></title-font-color>- <message-text l10n="yes">- <![CDATA[Please enter your username and password.]]></message-text>- <username-prompt-text l10n="yes">- <![CDATA[USERNAME:]]></username-prompt-text>- <password-prompt-text l10n="yes">- <![CDATA[PASSWORD:]]></password-prompt-text><internal-password-prompt-text l10n="yes" /><internal-password-first>no</internal-password-first>- <group-prompt-text l10n="yes">- <![CDATA[GROUP:]]></group-prompt-text>- <submit-button-text l10n="yes">- <![CDATA[Login]]></submit-button-text>- <title-font-color>- <![CDATA[#ffffff]]></title-font-color>- <title-background-color>- <![CDATA[#666666]]></title-background-color><font-color>#000000</font-color><background-color>#ffffff</background-color></logon-form>- <logout-form>- <title-text l10n="yes">- <![CDATA[Logout]]></title-text>- <message-text l10n="yes">- <![CDATA[Goodbye.]]></message-text></logout-form>- <title-panel><mode>enable</mode>- <text l10n="yes">- <![CDATA[WebVPN Service]]></text><logo-url l10n="yes">/+CSCOU+/csco_logo.gif</logo-url><gradient>yes</gradient><style />- <background-color>- <![CDATA[#ffffff]]></background-color>- <font-size>- <![CDATA[larger]]></font-size>- <font-color>- <![CDATA[#800000]]></font-color>- <font-weight>- <![CDATA[bold]]></font-weight></title-panel>- <info-panel><mode>disable</mode><image-url l10n="yes">/+CSCOU+/clear.gif</image-url><image-position>above</image-position><text l10n="yes" /></info-panel>- <copyright-panel><mode>disable</mode><text l10n="yes" /></copyright-panel></auth-page>- <portal>- <title-panel><mode>enable</mode>- <text l10n="yes">- <![CDATA[WebVPN Service]]></text><logo-url l10n="yes">/+CSCOU+/csco_logo.gif</logo-url><gradient>yes</gradient><style />- <background-color>- <![CDATA[#ffffff]]></background-color>- <font-size>- <![CDATA[larger]]></font-size>- <font-color>- <![CDATA[#800000]]></font-color>- <font-weight>- <![CDATA[bold]]></font-weight></title-panel><browse-network-title l10n="yes">Browse Entire Network</browse-network-title><access-network-title l10n="yes">Start AnyConnect</access-network-title>- <application><mode>enable</mode><id>home</id><tab-title l10n="yes">Home</tab-title><order>1</order></application>- <application><mode>enable</mode><id>web-access</id>- <tab-title l10n="yes">- <![CDATA[Web Applications]]></tab-title>- <url-list-title l10n="yes">- <![CDATA[Web Bookmarks]]></url-list-title><order>2</order></application>- <application><mode>enable</mode><id>file-access</id>- <tab-title l10n="yes">- <![CDATA[Browse Networks]]></tab-title>- <url-list-title l10n="yes">- <![CDATA[File Folder Bookmarks]]></url-list-title><order>3</order></application>- <application><mode>enable</mode><id>app-access</id>- <tab-title l10n="yes">- <![CDATA[Application Access]]></tab-title><order>4</order></application>- <application><mode>enable</mode><id>net-access</id><tab-title l10n="yes">AnyConnect</tab-title><order>4</order></application>- <application><mode>enable</mode><id>help</id><tab-title l10n="yes">Help</tab-title><order>1000000</order></application>- <toolbar><mode>enable</mode><logout-prompt-text l10n="yes">Logout</logout-prompt-text><prompt-box-title l10n="yes">Address</prompt-box-title><browse-button-text l10n="yes">Browse</browse-button-text></toolbar>- <column><width>100%</width><order>1</order></column>- <pane><type>TEXT</type><mode>disable</mode><title /><text /><notitle /><column /><row /><height /></pane>- <pane><type>IMAGE</type><mode>disable</mode><title /><url l10n="yes" /><notitle /><column /><row /><height /></pane>- <pane><type>HTML</type><mode>disable</mode><title /><url l10n="yes" /><notitle /><column /><row /><height /></pane>- <pane><type>RSS</type><mode>disable</mode><title /><url l10n="yes" /><notitle /><column /><row /><height /></pane>- <url-lists><mode>group</mode></url-lists></portal></custom>Help Customization
The security appliance displays help content on the application panels during clientless sessions. Each clientless application panel displays its own help file content using a predetermined filename. For example, the help content displayed on the Application Access panel is from the file named app-access-hlp.inc. Table 38-4 shows the clientless application panels and predetermined filenames for the help content.
You can customize the help files provided by Cisco or create help files in other languages. Then use the Import button to copy them to the flash memory of the security appliance for display during subsequent clientless sessions. You can also export previously imported help content files, customize them, and reimport them to flash memory.
The following sections describe how to customize or create help content visible on clientless sessions:
•
•
Fields
Import—Click to launch the Import Application Help Content dialog, where you can import new help content to flash memory for display during clientless sessions.
Export—Click to retrieve previously imported help content selected from the table.
Delete—Click to delete previously imported help content selected from the table.
Language—Displays the abbreviation of the language rendered by the browser. This field is not used for file translation; it indicates the language used in the file. To identify the name of a language associated with an abbreviation in the table, display the list of languages rendered by your browser. For example, a dialog window displays the languages and associated language codes when you use one of the following procedures:
•
•
Filename—Displays the filename the help content file was imported as.
Modes
The following table shows the modes in which this feature is available:
Customizing a Help File Provided by Cisco
To customize a help file provided by Cisco, you need to get a copy of the file from the flash memory card first. Get the copy and customize it as follows:
Step 1
Step 2
language is the abbreviation for the language rendered by the browser. It is not used for file translation; it indicates the language used in the file. For help files provided by Cisco in English, enter the abbreviation en.
The following example address displays the English version of the Terminal Servers help:
https://address_of_security_appliance/+CSCOE+/help/en/rdp-hlp.inc
Step 3
Caution
Step 4
Step 5
Note
Step 6
Step 7
Return to ASDM and choose Configuration > Remote Access VPN > Clientless SSL VPN Access > Portal > Help Customization > Import to import the modified help file into flash memory.
Creating Help Files for Languages Not Provided by Cisco
Use standard HTML to create help files in other languages. We recommend creating a separate folder for each language you want to support.
Note
Save the file as HTML only. Use the filename in the Filename column of Table 38-4.
Return to ASDM and choose Configuration > Remote Access VPN > Clientless SSL VPN Access > Portal > Help Customization > Import to import the new help file into flash memory.
Import/Export Application Help Content
Use the Import Application Help Content dialog box to import help files to flash memory for display on the portal pages during clientless sessions. Use the Export Application Help Content dialog box to retrieve previously imported help files for subsequent editing.
Fields
Language—For the Import Application Help Content dialog box only, this field specifies the language rendered by the browser. (This Language field is inactive in the Export Application Help Content dialog box.) This field is not used for file translation; it indicates the language used in the file. Click the dots next to the Language field, double-click the row containing the language used in the help file in the Browse Language Code dialog box, confirm the abbreviation in the Language Code field matches the abbreviation in the row, and click OK. If the language for which you want to provide help content is not present in the Browse Language Code dialog box, enter the abbreviation for the language you want into the Language Code field and click OK, or enter it into the Language text box to the left of the dots. To identify the abbreviation for the language of a help file to be imported if it is not present in the Browse Language Code dialog box, display the list of languages and abbreviations rendered by your browser. For example, a dialog window displays the languages and associated language codes when you use one of the following procedures:
•
•
File Name—If you are importing, specify the file name from the drop-down list for the new help content file. If you are exporting, this field is unavailable.
Select a File—Configure the parameters for the source file (if importing) or destination file (if exporting):
Local computer—Select if the source or destination file is on a local computer:
–
–
Flash file system—Select if the source or destination file is located in flash memory on the security appliance:
–
–
Remote server—Select if the source or destination file is on a remote server:
–
Modes
The following table shows the modes in which this feature is available:
Configuring Browser Access to Client-Server Plug-ins
The Client-Server Plug-in table displays the plug-ins the security appliance makes available to browsers in Clientless SSL VPN sessions.
To add, change, or remove a plug-in, do one of the following:
•
•
About Installing Browser Plug-ins
A browser plug-in is a separate program that a web browser invokes to perform a dedicated function, such as connect a client to a server within the browser window. The security appliance lets you import plug-ins for download to remote browsers in Clientless SSL VPN sessions. Of course, Cisco tests the plug-ins it redistributes, and in some cases, tests the connectivity of plug-ins we cannot redistribute. However, we do not recommend importing plug-ins that support streaming media at this time.
Note
The security appliance does the following when you install a plug-in onto the flash device:
•
•
•
•
Table 38-6 shows the changes to the main menu and address field of the portal page when you add the plug-ins described in the following sections.
Note
When the user in a Clientless SSL VPN session clicks the associated menu option on the portal page, the portal page displays a window to the interface and displays a help pane. The user can select the protocol displayed in the drop-down menu and enter the URL in the Address field to establish a connection.
Note
Before installing the first plug-in, you must follow the instructions in the next section.
Plug-in Requirements and Restrictions
Clientless SSL VPN must be enabled on the security appliance to provide remote access to the plug-ins.
The minimum access rights required for remote use belong to the guest privilege mode.
A stateful failover does not retain sessions established using plug-ins. Users must reconnect following a failover.
Preparing the Security Appliance for a Plug-in
Before installing a plug-in, prepare the security appliance by performing the following steps:
Step 1
Step 2
Note
See the section that identifies the type of plug-in you want to provide for Clientless SSL VPN access.
•
•
Installing Plug-ins Redistributed by Cisco
Cisco redistributes the following open-source, Java-based components to be accessed as plug-ins for web browsers in clientless SSL VPN sessions:
To retrieve a plug-in redistributed by Cisco and import it into the security appliance, perform the following steps:
Step 1
Step 2
Step 3
This pane displays the plug-ins that are available to Clientless SSL sessions.
Step 4
The Import Client-Server Plug-in dialog box opens.
Step 5
Fields
The Import Client-Server Plug-in dialog box displays the following fields:
•
–
–
–
–
Note
•
–
–
–
Step 6
Click Apply.
The plug-in is now available for future Clientless SSL VPN sessions.
Modes
The following table shows the modes in which this feature is available:
Assembling and Installing Third-Party Plug-ins—Example: Citrix Java Presentation Server Client
The open framework of the security appliance lets you add plug-ins to support third-party Java client/server applications. As an example of how to provide Clientless SSL VPN browser access to third-party plug-ins, this section describes how to add Clientless SSL VPN support for the Citrix Presentation Server Client.
Caution
With a Citrix plug-in installed on the security appliance, Clientless SSL VPN users can use a connection to the security appliance to access Citrix MetaFrame services.
A stateful failover does not retain sessions established using the Citrix plug-in. Citrix users must reauthenticate after failover.
To provide access to the Citrix plug-in, follow the procedures in the following sections.
Preparing the Citrix MetraFrame Server for Clientless SSL VPN Access
The security appliance performs the connectivity functions of the Citrix secure gateway when the Citrix client connects to the Citrix MetaFrame Server. Therefore, you must configure the Citrix Web Interface software to operate in a mode that does not use the (Citrix) "secure gateway." Otherwise, the Citrix client cannot connect to the Citrix MetaFrame Server.
Follow the instructions in the "Preparing the Security Appliance for a Plug-in" section before using the next section, if you are not already providing support for a plug-in.
Creating, Installing, and Testing the Citrix Plug-in
To create and install the Citrix plug-in, perform the following steps:
Step 1
This file contains files that Cisco customized for use with the Citrix plug-in.
Step 2
Step 3
•
•
You can use WinZip to perform this step and the next.
Step 4
Step 5
Step 6
Note
Step 7
citrix-server/?DesiredColor=4&DesiredHRes=1024&DesiredVRes=768
See Add/Edit Bookmark List and Add Bookmark Entry as needed.
Step 8
