-
User Guide for Cisco Security Manager 3.2
-
Preface
-
Getting Started with Security Manager
-
Managing User Accounts
-
Working with the Security Manager User Interface
-
Using Map View
-
Preparing Devices for Management
-
Managing the Device Inventory
-
Managing Policies
-
Managing Activities
-
Managing Objects
-
Managing Site-to-Site VPNs
-
Managing Remote Access VPNs
-
Managing SSL VPNs
-
Managing Firewall Services
-
Managing IPS Services
-
Managing Routers
-
Managing Firewall Devices
-
Managing Cisco Catalyst Switches and Cisco 7600 Series Routers
-
Managing IPS Devices
-
Managing Deployment
-
Managing FlexConfigs
-
Managing the Security Manager Server
-
Using Monitoring, Troubleshooting, and Diagnostic Tools
-
Administrative Settings User Interface Reference
-
Map View User Interface Reference
-
Device Inventory User Interface Reference
-
Policy User Interface Reference
-
Activities User Interface Reference
-
Policy Object Manager User Interface Reference
-
Site-to-Site VPN User Interface Reference
-
Remote Access VPN User Interface Reference
-
SSL VPN User Interface Reference
-
Firewall Services User Interface Reference
-
Router Platform User Interface Reference
-
PIX/ASA/FWSM Platform User Interface Reference
-
Catalyst Platform User Interface Reference
-
IPS User Interface Reference
-
Deployment User Interface Reference
-
FlexConfig User Interface Reference
-
Index
-
Table Of Contents
Configuring SSL VPN on an IOS Device
Using the Wizard to Create an IOS SSL VPN Connection
Configuring an SSL VPN Gateway and Context
Customizing the SSL VPN Portal Page
Configuring an SSL VPN Policy (IOS)
Configuring General Settings for an IOS SSL VPN Policy
Configuring the Portal Page for an IOS SSL VPN Policy
Configuring the Secure Desktop Software for an IOS SSL VPN Policy
Configuring Advanced Settings for an IOS SSL VPN Policy
Understanding User Groups in SSL VPN
Configuring User Groups on an IOS Device
Configuring User Groups on an ASA Device
Defining the User Group Name and Access Methods
Configuring the Full Tunnel Access Mode
Configuring the Clientless and Thin Client Access Modes
Configuring SSL VPN on an ASA Device
Using the Wizard to Create an ASA SSL VPN Connection Profile
Defining the ASA SSL VPN Access Parameters
Defining the ASA SSL VPN Connection Profile Parameters
Configuring SSL VPN Policies on an ASA Device
Understanding SSL VPN Connection Profile Policies
Configuring an SSL VPN Connection Profile Policy
Configuring ASA User Groups Policy in Your SSL VPN
Configuring the Cisco Secure Desktop Software
Managing SSL VPNs
The SSL VPN feature enables users to access enterprise networks from any Internet-enabled location using only a web browser that natively supports Secure Socket Layer (SSL) encryption, without the need for a software or hardware client.
Note
SSL VPN is supported on ASA 5500 devices running software version 7.1 and 7.2, and on Cisco 870, 1800, 2800, 3700, 3800, 7200, and 7301 Series routers running software version 12.4(6)T and later. For ASA devices and routers running other software versions, a message is displayed stating that SSL VPN policies cannot be configured using Security Manager when you click SSL VPN in the Policy Selector.
Note
In Security Manager 3.1, if you configure SSL VPN policies on an ASA device running 7.0, activity validation fails with an error. In Security Manager 3.2, SSL VPN policies are not available for configuration itself in the Policy Selector for ASA 7.0 devices.On IOS devices, remote access is provided through an SSL-enabled VPN gateway. Using an SSL-enabled web browser, the remote user establishes a connection to the SSL VPN gateway. After the remote user is authenticated to the secure gateway via the web browser, an SSL VPN session is established and the user can access the internal corporate network. A portal page enables users to access all the resources available on the SSL VPN networks.
On ASA devices, remote users establish a secure, remote access VPN tunnel to the security appliance using the web browser. The SSL protocol provides the secure connection between remote users and specific, supported internal resources that you configure at a central site. The security appliance recognizes connections that need to be proxied, and the HTTP server interacts with the authentication subsystem to authenticate users.
Note
Figure 12-1 shows how a mobile worker can access protected resources from the main office and branch offices. Site-to-site IPsec connectivity between the main and remote sites is unaltered. The mobile worker needs only Internet access and supported software (web browser and operating system) to securely access the corporate network.
Figure 12-1 Secure SSL VPN Access Example
Prerequisites for Configuring SSL VPN
For a remote user to securely access resources on a private network behind an SSL VPN gateway, the following prerequisites must be met:
•
•
•
•
–
–
Related Topics
•
•
SSL VPN Access Modes
SSL VPN provides three modes of remote access that are supported on IOS routers and ASA devices—Clientless, Thin Client, and Full Tunnel client.
Clientless Access Mode
In Clientless mode, the remote user accesses the internal or corporate network using a web browser on the client machine. No applet downloading is required.
Clientless mode is useful for accessing most content that you would expect in a web browser, such as Internet access, databases, and online tools that employ a web interface. It supports web browsing (using HTTP and HTTPS), file sharing using Common Internet File System (CIFS), and Outlook Web Access (OWA) email. For Clientless mode to work successfully, the PC of the remote user must run Windows 2000, Windows XP, or Linux operating systems.
Thin Client Access Mode
Thin Client mode, also called TCP port forwarding, assumes that the client application uses TCP to connect to a well-known server and port. In this mode, the remote user downloads a Java applet by clicking the link provided on the portal page. The Java applet acts as a TCP proxy on the client machine for the services configured on the SSL VPN gateway. The Java applet starts a new SSL connection for every client connection.
The Java applet initiates an HTTP request from the remote user client to the SSL VPN gateway. The name and port number of the internal email server is included in the HTTP request. The SSL VPN gateway creates a TCP connection to that internal email server and port.
Thin Client mode extends the capability of the cryptographic functions of the Web browser to enable remote access to TCP-based applications such as Post Office Protocol version 3 (POP3), Simple Mail Transfer Protocol (SMTP), Internet Message Access protocol (IMAP), Telnet, and Secure Shell (SSH).
Note
When using Thin Client mode, you should be aware of the following:
•
•
•
Full Tunnel Client Access Mode
Full Tunnel Client mode enables access to the corporate network completely over an SSL VPN tunnel, which is used to move data at the network (IP) layer. This mode supports most IP-based applications, such as, Microsoft Outlook, Microsoft Exchange, Lotus Notes E-mail, and Telnet. Being part of the SSL VPN is completely transparent to the applications run on the client. A java applet is downloaded to handle the tunneling between the client host and the SSL VPN gateway. The user can use any application as if the client host was in the internal network.
The tunnel connection is determined by the group policy configuration. The SSL VPN Client (SVC) is downloaded and installed to the remote client, and the tunnel connection is established when the remote user logs in to the SSL VPN gateway. By default, the SVC is removed from the remote client after the connection is closed, but you can keep it installed, if required.
Note
Note
Related Topics
•
•
•
•
•
Working with SSL VPN Policies
SSL VPN policies define the configuration that is required for remote users to establish a secure remote access VPN tunnel between an Internet-enabled location and a private network behind an SSL VPN, using an SSL-enabled web browser.
Note
You cannot discover the configurations on a device that is already deployed in an SSL VPN network. Security Manager leaves any existing SSL VPN configurations intact on the device until you deploy SSL VPN policies that were configured with Security Manager.In Device view, you can view and configure SSL VPN policies for devices. To access Device view, select View > Device View or click the Device View button in the toolbar. You can right-click a policy in the Policy selector to display menu options that enable you to share the policy, assign the shared policy to, or unassign it from the selected device. For more information, see Performing Basic Policy Management, page 7-18.
You can also view all shared policies for each policy type in an SSL VPN, edit policies, and modify their assignments to devices, in Policy view. See Managing Shared Policies in Policy View, page 7-39.
Note
These topics provide information about configuring an SSL VPN from the Security Manager Device view:
•
•
•
•
Configuring SSL VPN on an IOS Device
On Cisco IOS routers, remote access is provided through an SSL-enabled VPN gateway. Using an SSL-enabled web browser, the remote user establishes a connection to the SSL VPN gateway. After the remote user is authenticated to the secure gateway via the web browser, an SSL VPN session is established and the user can access the internal corporate network. A portal page enables users to access all the resources available on the SSL VPN networks.
SSL VPN configuration on Cisco IOS routers is usually deployed in small office/home office (SOHO) networks, remote branch offices, and main corporate sites.
Using Security Manager, you can create a basic connection with a limited set of features that enable an SSL VPN to function, and then configure additional policies and features for your SSL VPN.
These topics describe how to configure an SSL VPN connection and the policies required for it to function:
•
•
Using the Wizard to Create an IOS SSL VPN Connection
The SSL VPN wizard enables you to configure SSL VPN on your VPN gateway (server) device.
The wizard creates an SSL VPN connection with a limited set of features that enable a basic SSL VPN to function. After you complete the wizard, you can configure additional policies and features for the SSL VPN, or modify the existing ones. If required, you can return to the wizard to create additional SSL VPN configurations.
To access the SSL VPN wizard:
1.
2.
3.
4.
These topics describe the steps in the SSL VPN wizard:
•
•
Related Topics
•
Configuring an SSL VPN Gateway and Context
The SSL VPN gateway acts as a proxy for connections to protected resources, which are accessed through an SSL-encrypted connection between the gateway and a web-enabled browser on a remote device.
An SSL VPN gateway provides a reachable IP address and certificate for one or more SSL VPN contexts. Each gateway configured on a router must be configured with its own IP address—IP addresses cannot be shared among gateways. You can use the IP address of a router interface, or another reachable IP address if one is available. Either a digital certificate or a self-signed certificate must be configured for a gateway to establish a secure connection. All gateways on the router can use the same certificate.
An SSL VPN context defines the virtual configuration of the SSL VPN. It must be configured before an SSL VPN gateway can be used. An SSL VPN context can be associated with only one gateway. It supports one or more user group policies. Although one gateway can serve multiple SSL VPN contexts, resource constraints and IP address reachability must be taken into account.
The SSL VPN gateway and context configuration must be completed before a remote user can access resources on a private network behind the SSL VPN. In the first step of the SSL VPN wizard, you create an SSL VPN context, configure a gateway, and specify information that permits users to access a portal page, as described in the following procedure.
Before You Begin
•
Related Topics
•
•
•
Step 1
The wizard opens, displaying the Gateway and Context page. For a description of the elements on this page, see Table I-1 on page I-3.
Step 2
Note
Step 3
Step 4
Note
Step 5
Step 6
Step 7
Note
Step 8
Step 9
Note
Customizing the SSL VPN Portal Page
The portal page enables the remote user access to all resources available on the SSL VPN networks. For example, the portal page could provide a link to allow the remote user to download and install a thin-client Java applet (for TCP port forwarding) or a tunneling client. Only the websites that appear as links on the portal page are available to users.
This procedure describes how to define the appearance of the portal page. You can select among the predefined themes listed, and obtain a preview of the portal page as it would appear if that theme were used.
Before You Begin
In Device view (View > Device View), make sure the selected device is an Cisco IOS router.
Related Topics
•
•
Step 1
Step 2
•
•
•
•
A preview of the portal page is displayed.
Step 3
The SSL VPN connection you have defined in the wizard is displayed in the SSL VPN Policy page. If required, you can modify this connection from the SSL VPN folder. See Configuring an SSL VPN Policy (IOS).
Configuring an SSL VPN Policy (IOS)
After you create a basic SSL VPN connection on your server device using the SSL VPN wizard, you can modify the connection, if required, and configure additional policies and features from the SSL VPN folder in the Device view.
The SSL VPN Policy page displays a list of all the currently defined SSL VPN policies, including any policies that were created using the wizard. From this page, you can create, modify, or delete SSL VPN policies.
These topics enable you to configure SSL VPN policies on an IOS router:
•
•
•
•
Related Topics
•
•
•
Configuring General Settings for an IOS SSL VPN Policy
This procedure describes how to create or edit the general settings required for an SSL VPN policy, such as, specifying the gateway, domain, AAA servers for accounting and authentication, and user groups.
Before You Begin
In Device view (View > Device View), select the required IOS router.
Related Topics
•
Step 1
The SSL VPN Policy page opens. For a description of the elements on the SSL VPN Policy page, see Table I-7 on page I-15.
Step 2
The SSL VPN Context Editor dialog box opens, displaying the General tab. For a description of the elements on the General tab, see Table I-8 on page I-17.
Step 3
Note
Step 4
Note
Step 5
Step 6
Step 7
Note
Step 8
Step 9
•
If the required user group is not included in the Selector, click Create to open the Add User Group dialog box in which you can create a new user group object. For a description of the User Groups Selector, see Table I-3 on page I-8.
•
For more information about user group objects, see Creating User Group Objects, page 9-199.
Step 10
Configuring the Portal Page for an IOS SSL VPN Policy
The portal page enables the remote user to access all resources available on the SSL VPN networks. Only the websites that appear as links on the portal page are available to users.
You can configure the appearance of the portal page when you create an SSL VPN connection, using the wizard (see Customizing the SSL VPN Portal Page). In the Portal Page tab of the SSL VPN Context Editor, you can redefine the themes for a selected SSL VPN policy, or customize the portal page for a new SSL VPN policy.
This procedure describes how to define the appearance of the portal page for an SSL VPN policy. You can select among the predefined themes listed, and obtain a preview of the portal page as it would appear if that theme were used.
Before You Begin
In Device view (View > Device View), select the required IOS router.
Related Topics
•
Step 1
The SSL VPN Policy page opens. For a description of the elements on the SSL VPN Policy page, see Table I-7 on page I-15.
Step 2
Step 3
Step 4
•
•
•
•
A preview of the portal page is displayed.
Step 5
Configuring the Secure Desktop Software for an IOS SSL VPN Policy
Cisco Secure Desktop (CSD) enables you to eliminate all traces of sensitive data by providing a single, secure location for session activity and removal on the client system. CSD provides a session-based interface where sensitive data is shared only for the duration of a SSL VPN session. All session information is encrypted, and all traces of the session data are removed from the remote client when the session is terminated, even if the connection terminates abruptly.
Note
This procedure describes how to configure CSD on an IOS router.
Before You Begin
•
•
Related Topics
•
•
•
Step 1
The SSL VPN Policy page opens. For a description of the elements on the SSL VPN Policy page, see Table I-7 on page I-15.
Step 2
Step 3
Step 4
Step 5
You can click Select to open the Secure Desktops Selector from which you can select a CSD distribution package file from a list of CSD distribution package objects. For more information, see Understanding Secure Desktop Configuration Objects, page 9-171.
Step 6
Configuring Advanced Settings for an IOS SSL VPN Policy
This procedure describes how to specify or edit the advanced settings required for an SSL VPN policy, including the maximum number of SSL VPN user sessions that can be configured, and Virtual Routing Forwarding (VRF) related information.
Before You Begin
In Device view (View > Device View), select the required IOS router.
Related Topics
•
Step 1
The SSL VPN Policy page opens. For a description of the elements on the SSL VPN Policy page, see Table I-7 on page I-15.
Step 2
Step 3
Step 4
Step 5
Step 6
Understanding User Groups in SSL VPN
SSL VPN user group policies allow you to accommodate the needs of different groups of users. For example, a group of engineers working remotely needs access to network resources different from the network resources to which sales personnel working in the field need access. Business partners and outside vendors must be able to access the information that they need to work with your organization, but you must ensure that they do not have access to confidential information or other resources they do not need. Creating a different policy for each group provides remote users with the resources they need, and prevents them from accessing other resources.
In Security Manager, user parameters are captured by user groups which define the resources accessible to the user when connecting to an SSL VPN gateway or ASA security appliance.
On an IOS router, a user group is defined within a context. Each context has a domain name. When a user types a URL to access the SSL VPN gateway, that domain name is used to associate the user with the user group defined in the context. You can have more than one user group in a context. Each SSL VPN context has its own user groups list.
Note
An ASA security appliance has a built-in user group that is shared by all connections to the device. During SSL VPN user authentication, the AAA server returns a user group name that the user belongs to. The device first tries to match the name to the names in the User Groups list. If a match is found, the definition in the matching user group will be used. Otherwise, the default user group is used. If no default user group is defined, the device's built-in user group is used.
Related Topics
•
•
•
•
Configuring User Groups on an IOS Device
When you are configuring SSL VPN, you must specify the user group(s) that will be used in your SSL VPN connection. You can use predefined user group(s), edit them if required, and create user groups.
This procedure describes how to specify the user group(s) to use in your SSL VPN connection on an IOS router.
Before You Begin
In Device view (View > Device View), select the required IOS device.
Related Topics
•
•
•
•
•
Step 1
The Gateway and Context page of the SSL VPN wizard opens. For a description of the elements on the Gateway and Context page, see Table I-1 on page I-3.
The User Groups table displays the currently defined user groups that will be used in your SSL VPN connection.
Step 2
Note
The User Groups Selector opens displaying a list of predefined user groups available for selection. For a description of the elements on the User Groups Selector page, see Table I-3 on page I-8.
Step 3
•
•
•
Step 4
The newly defined, selected or edited user group(s) appears in the User Groups table on the Gateway and Context page.
Configuring User Groups on an ASA Device
When you are configuring SSL VPN on an ASA device, you must specify the user group(s) that will be used in your SSL VPN connection profile. You can select predefined user group(s), edit them if required, and create user groups.
This procedure describes how to specify the user group(s) to use in your SSL VPN connection profile on an ASA device.
Before You Begin
In Device view (View > Device View), select the required ASA device.
Related Topics
•
•
•
•
•
Step 1
Step 2
The User Groups table on the Connection Profile page displays the currently defined ASA user groups that will be used in your SSL VPN connection profile.
Note
Step 3
The User Groups Selector opens displaying a list of predefined ASA user groups available for selection. For a description of the elements on the User Groups Selector page, see Table I-3 on page I-8.
Step 4
•
•
Step 5
The newly defined, selected or edited ASA user group(s) appears in the User Groups table on the Connection Profile page.
Creating a New User Group
User groups define the resources accessible to the user when connecting to an IOS SSL VPN gateway, or an ASA security appliance. In Security Manager, you can create a new user group that will be used in your SSL VPN connection on an IOS router or ASA device, using the Policy Object Manager or from within the SSL VPN wizard.
These topics describe the steps you may configure to create a user group from within the SSL VPN wizard:
•
•
•
For information about creating user groups from the Policy Object Manager, see:
•
•
Related Topics
•
•
•
•
Defining the User Group Name and Access Methods
This procedure describes how to define a name for your user group, and optionally, select and configure the remote access method(s) that will be used to access the SSL-enabled gateway (IOS router) or ASA security appliance.
Before You Begin
•
Related Topics
•
•
•
Step 1
Step 2
•
•
Step 3
Step 4
Step 5
•
•
•
Step 6
Configuring the Full Tunnel Access Mode
Full Tunnel Client mode enables access to the corporate network completely over an SSL VPN tunnel. In Full Tunnel Client access mode, the tunnel connection is determined by the group policy configuration. The full tunnel client software, SSL VPN Client (SVC), is downloaded to the remote client, so that a tunnel connection is established when the remote user logs in to the SSL VPN gateway, or connects to the ASA security appliance.
For more information, see SSL VPN Access Modes.
This procedure describes how to configure the Full Tunnel access mode to be used in your user group configuration.
Note
Before You Begin
•
Related Topics
•
•
Step 1
Note
Step 2
Step 3
Step 4
Step 5
Step 6
Step 7
Step 8
•
•
•
Step 9
Step 10
Step 11
Step 12
Step 13
Configuring the Clientless and Thin Client Access Modes
In Clientless access mode, the remote user accesses the internal or corporate network using a web browser on the client machine. No applet downloading is required. In Thin Client access mode, the client application to use TCP to connect to a well-known server and port. The remote user downloads a Java applet that acts as a TCP proxy on the client machine for the services that you configure on the SSL VPN gateway.
This procedure describes how to configure the Clientless and/or Thin Client access modes to be used in your SSL VPN user group configuration.
Note
Before You Begin
•
Related Topics
•
•
•
Step 1
Note
Step 2
You can click Select to open the URL List Selector from which you can make your selection from a list of URL List objects. For more information, see Understanding URL List Objects, page 9-196.
Step 3
You can click Select to open the Port Forwarding List Selector from which you can make your selection from a list of Port Forwarding List objects. For more information, see Understanding Port Forwarding List Objects, page 9-165.
Step 4
Step 5
Step 6
The new user group is displayed in the User Groups Selector page, from where you can select it for use in your SSL VPN. See Creating a New User Group.
Configuring SSL VPN on an ASA Device
SSL VPN configuration is supported on Cisco ASA 5500 Series Security Appliances, software version 7.1 and 7.2.
Note
In an SSL VPN connection, the security appliance acts as a proxy between the end user web browser and target web servers. When an SSL VPN user connects to an SSL-enabled web server, the security appliance recognizes connections that need to be proxied, and the HTTP server interacts with the authentication subsystem to authenticate users. The security appliance establishes a secure connection and validates the server SSL certificate.
Digital certificates are used for authentication. The security appliance creates a self-signed SSL server certificate when it boots, or you can install in the security appliance, an SSL certificate that has been issued in a PKI context (see Public Key Infrastructure Policies in Remote Access VPNs, page 11-25). For HTTPS, this certificate must then be installed on the client. You only need to install the certificate from a given security appliance once.
Using Security Manager, you can create a basic connection profile with a limited set of features that enable an SSL VPN to function, and then configure additional policies and features for your SSL VPN.
These topics describe how to configure an SSL VPN connection profile on an ASA device, and the policies required for it to function:
•
•
Using the Wizard to Create an ASA SSL VPN Connection Profile
The SSL VPN wizard provides a quick and convenient way to configure and enable SSL VPN on your ASA security appliance.
The wizard creates an SSL VPN connection profile with a limited set of features that enable a basic SSL VPN to function. After you complete the wizard, you can configure additional policies and features for the SSL VPN, or modify the existing ones. If required, you can return to the wizard to create additional SSL VPN configurations.
To access the ASA SSL VPN wizard:
1.
2.
3.
4.
These topics describe the steps you configure to define a basic SSL VPN connection profile using the ASA SSL VPN wizard:
•
•
Related Topics
•
Defining the ASA SSL VPN Access Parameters
The Access page of the SSL VPN Configuration Wizard enables you to configure the security appliance interfaces for SSL VPN sessions and select a port for your SSL VPN connection profiles.
This procedure describes how to configure the access parameters on an ASA device.
Before You Begin
•
Related Topics
•
•
Step 1
The wizard opens, displaying the Access page. For a description of the elements on this page, see Table I-12 on page I-24.
Step 2
Step 3
Note
Step 4
Step 5
Step 6
Note
Defining the ASA SSL VPN Connection Profile Parameters
An SSL VPN connection profile comprises a set of records that contain VPN tunnel connection profile policies, including the attributes that pertain to creating the tunnel itself. When you define the parameters for your ASA SSL VPN connection profile, you configure a tunnel group policy. Tunnel groups identify the group policy for a specific connection profile, which includes user-oriented attributes. In Security Manager, user parameters are captured by user groups which define the resources accessible to the user when connecting to the ASA security appliance.
For more information, see Understanding SSL VPN Connection Profile Policies.
In the Connection Profile page of the SSL VPN wizard you configure the tunnel group policies on your security appliance.
This procedure describes how to configure a tunnel group policy, which includes specifying the associated user groups, address pools, and authentication server group settings.
Before You Begin
•
Related Topics
•
•
•
•
•
Step 1
Step 2
Step 3
The default user group is used if no match is found when the AAA server tries to match the user group name to the names in the User Groups list on the ASA device. You can click Select to open a dialog box that lists all available ASA user groups, and from which you can create an ASA user group object. For more information, see Understanding ASA User Group Objects, page 9-42.
Note
Step 4
Note
You can click Edit to open the User Groups Selector, in which you can select the required ASA user groups, and from which you can create and edit ASA user groups. See Configuring User Groups on an ASA Device.
Step 5
Step 6
Step 7
Step 8
Step 9
Step 10
Step 11
Step 12
Step 13
The SSL VPN connection profile you have defined in the wizard is displayed in the SSL VPN Connection Profile Policy page. You can modify this connection profile, if required. See Configuring SSL VPN Policies on an ASA Device.
Configuring SSL VPN Policies on an ASA Device
After you create a basic SSL VPN connection profile on your server device using the SSL VPN wizard, you can modify the connection profile, if required, and configure additional policies and features.
These topics describe the SSL VPN policies you can configure on an ASA device:
•
•
•
Related Topics
•
Configuring an Access Policy
An Access policy specifies the security appliance interfaces on which an SSL VPN connection profile can be enabled, the port to be used for the connection profile, the SSL VPN session timeout and maximum number of sessions.
This procedure describes how to configure an Access policy on an ASA device.
Before You Begin
•
Related Topics
•
•
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Step 7
Step 8
Note
Understanding SSL VPN Connection Profile Policies
Note
An SSL VPN connection profile comprises a set of records that contain VPN tunnel connection profile policies, including the attributes that pertain to creating the tunnel itself. When you define the parameters for your ASA SSL VPN connection profile, you configure a tunnel group policy. Tunnel groups identify the group policy for a specific connection profile, which includes user-oriented attributes. User parameters are captured by user groups which define the resources accessible to the user when connecting to the ASA security appliance.
You can create one or more tunnel groups specific to your environment. Tunnel groups may be configured on the local remote access VPN server or on external AAA servers. Configuring a tunnel group policy includes specifying the associated user groups, address pools, servers, and authentication server group settings.
About Group Aliases
When configuring an SSL VPN Connection Profile policy, you may specify group aliases for your tunnel group. Specifying a group alias creates one or more alternate names by which a user can refer to a tunnel group. This feature is useful when the same group is known by several common names (such as "Devtest" and "QA"). The group alias appears on the login page. If you want the actual name of the tunnel group to appear on the list, you must specify it as an alias. Each tunnel group can have multiple aliases or no alias.
About Group URLs
Specifying a group URL eliminates the need for the user to select a tunnel group at login. When a user logs in, the security appliance looks for the user's incoming URL in the tunnel group policy table. If it finds the URL and if this feature is enabled, the security appliance selects the appropriate server and presents the user with only the username and password fields in the login window. This simplifies the user interface and has the added advantage of never exposing the list of groups to the user. The login window that the user sees uses the customizations configured for that tunnel group. You can configure multiple URLs (or no URLs) for a tunnel group. Each URL can be enabled or disabled individually. You must use a separate specification for each URL, specifying the entire URL using either the HTTP or HTTPS protocol.
Related Topics
•
•
•
Configuring an SSL VPN Connection Profile Policy
The SSL VPN Connection Profiles Policy page displays a list of all the SSL VPN Connection Profile policies currently defined on the security appliance, including any policies that were created using the wizard. From this page, you can create, edit, or delete the policies.
These topics enable you to configure SSL VPN Connection Profile policies on an ASA device:
•
Related Topics
•
•
Defining Basic Parameters
The Basic settings you must define for an SSL VPN Connection Profile policy include specifying a name for the tunnel group, the user group policy, address pools for available for assignment throughout the policy, the DNS server to be used for the tunnel group, group aliases, and incoming group URLs.
For more information about these settings, see Understanding SSL VPN Connection Profile Policies.
This procedure describes how to create or edit the basic settings required for an SSL VPN Connection Profile policy.
Before You Begin
•
Related Topics
•
•
Step 1
The SSL VPN Connection Profiles policy page opens. For a description of the elements on this page, see Table I-15 on page I-31.
Step 2
The Add/Edit SSL VPN Connection Profile dialog box opens, displaying the Basic tab. For a description of the elements on the Basic tab, see Table I-16 on page I-33.
Step 3
Step 4
You can click Select to open a dialog box from which you can select a user group from a list of ASA user group objects. For more information, see Understanding ASA User Group Objects, page 9-42.
Step 5
You can click Select to open a dialog box from which you can select a user group from a list of ASA user group objects. For more information, see Understanding ASA User Group Objects, page 9-42.
Step 6
Step 7
Address pools are predefined network objects. You can click Select to open the Network/Hosts selector from which you can make your selection(s). For more information, see Understanding Network/Host Objects, page 9-144.
Step 8
•
•
•
•
Step 9
•
•
•
•
Note
Step 10
Defining AAA Parameters
When you define the AAA authentication parameters for your SSL VPN Connection Profile policy, you must specify the type of authentication, the authorization, authentication, and accounting server groups, parameters relevant to password management, values for usernames that the security appliance recognizes for authorization, and configure interface-specific server groups for authentication.
This procedure describes how to create or edit the AAA authentication parameters required for an SSL VPN Connection Profile policy.
Before You Begin
•
Related Topics
•
•
Step 1
The SSL VPN Connection Profiles policy page opens. For a description of the elements on this page, see Table I-15 on page I-31.
Step 2
The Add/Edit SSL VPN Connection Profile dialog box opens.
Step 3
Step 4
Step 5
Step 6
Step 7
Step 8
Step 9
Step 10
Step 11
•
•
Then select one of the following options:
•
•
Note
Step 12
Note
Step 13
Step 14
Step 15
•
•
•
•
•
Note
Step 16
Defining Servers and Address Pools
The Settings tab lets you configure the WINS servers for the connection profile policy, select a customized look and feel for the SSL VPN end-user logon web page, DHCP servers to be used for client address assignment, and establish an association between an interface and client IP address pools.
This procedure describes how to create or edit these settings for an SSL VPN Connection Profile policy.
Before You Begin
•
Related Topics
•
•
•
Step 1
The SSL VPN Connection Profiles policy page opens. For a description of the elements on this page, see Table I-15 on page I-31.
Step 2
The Add/Edit SSL VPN Connection Profile dialog box opens.
Step 3
Step 4
Step 5
Step 6
Step 7
•
•
•
•
Note
Step 8
Configuring ASA User Groups Policy in Your SSL VPN
When you configure an SSL VPN connection profile, you must create user groups to which remote clients will belong. A user group policy specifies the attributes that determine user access to, and use of the SSL VPN. User groups simplify system management, enabling you to quickly configure SSL VPN access for large numbers of users.
A user group policy is a set of user-oriented attribute/value pairs for SSL VPN connection profiles that are stored either internally (locally) on the device or externally on an AAA server. The tunnel group uses a user group policy that sets terms for user connection profiles after the tunnel is established. Group policies let you apply whole sets of attributes to a user or a group of users, rather than having to specify each attribute individually for each user.
Note
An ASA security appliance has a built-in user group. During SSL VPN user authentication, the AAA server returns a user group name that the user belongs to. The device first tries to match the name to the names in the User Groups list. If a match is found, the definition in the matching user group is used. Otherwise, the default user group is used. If no default user group is defined, the device's built-in user group is used.
The ASA User Groups Policy page displays the ASA user groups currently defined for your SSL VPN connection profile. From this page you can create new user group policies and edit existing ones. In Security Manager, ASA user groups are predefined objects. When creating an ASA User Groups policy, you may need to select one or more objects to include in the policy definition.
This procedure describes how to specify the user groups you want to assign to your SSL VPN connection profile on an ASA device.
Before You Begin
•
Related Topics
•
•
•
Step 1
The ASA User Groups Policy page opens, displaying a table listing the ASA user groups defined for your SSL VPN. For a description of the elements on this page, see Table I-23 on page I-46.
Step 2
a.
ASA user groups are predefined objects. The Add User Group Selector opens, displaying a list of available ASA user group objects. For a description of the elements in this selector, see Creating and Editing Deployment Jobs, page 19-36.
b.
c.
Note
For information on how to create or edit an ASA user group object, see Creating ASA User Group Objects, page 9-44.
d.
Step 3
The Edit ASA User Group dialog box opens, enabling you to edit the selected ASA user group object. For more information, see Creating ASA User Group Objects, page 9-44.
Step 4
Note
Configuring the Cisco Secure Desktop Software
Cisco Secure Desktop (CSD) enables you to eliminate all traces of sensitive data by providing a single, secure location for session activity and removal on the client system. This ensures that cookies, browser history, temporary files, and downloaded content do not remain on a system after a remote user logs out or an SSL VPN session times out. CSD increases protection against data theft and client system malware (malicious software) by encrypting all data and files associated with or downloaded during the SSL VPN session.
CSD encrypts all information in the session. This protection is valuable in case of an abrupt session termination, or if a session times out due to inactivity. Furthermore, CSD stores all session information in the secure vault desktop partition. When the session closes, CSD overwrites and removes all data using a U.S. Department of Defense (DoD) sanitation algorithm to provide endpoint security protection.
This procedure describes how to configure the CSD on an ASA device. For the procedure to configure CSD on an IOS router, see Configuring the Secure Desktop Software for an IOS SSL VPN Policy.
Before You Begin
•
•
•
Related Topics
•
•
•
Step 1
Step 2
Step 3
You can click Select to open the Secure Desktops Selector from which you can select a CSD distribution package file from a list of available CSD distribution package objects. See Understanding Secure Desktop Configuration Objects, page 9-171.
Step 4
Note
Configuring Global Settings
In Security Manager, you can define SSL VPN global settings that apply to all devices in your SSL VPN topology. These settings include caching, content rewriting, character encoding, proxy, and proxy bypass definitions.
These topics describe how to configure these global VPN settings:
•
•
•
Defining Performance Settings
Caching enhances SSL VPN performance. It stores frequently reused objects in the system cache, which reduces the need to perform repeated rewriting and compressing of content. It reduces traffic between SSL VPN and both the remote servers and end-user browsers, with the result that many applications run much more efficiently.
This procedure describes how to enable caching on your ASA security appliance.
Before You Begin
•
•
Related Topics
Step 1
The Global Settings page opens, displaying the Performance tab. For a description of the elements on this tab, see Table I-26 on page I-50.
Step 2
Step 3
Note
Step 4
Step 5
Step 6
Step 7
Step 8
Step 9
Note
Defining Content Rewrite Rules
SSL VPN processes application traffic through a content transformation/rewriting engine that includes advanced elements (such as, JavaScript, VBScript, Java, and multi-byte characters) to proxy HTTP traffic depending on whether the user is using an application within or independently of an SSL VPN device.
If you do not want some applications and web resources, such as public websites, to go through the security appliance, you can create rewrite rules that permits users to browse certain sites and applications without going through the security appliance itself. This is similar to split tunneling in an IPsec VPN connection.
In the Content Rewrite tab of the SSL VPN Global Settings page, you can configure multiple content rewrite rules. The Content Rewrite tab lists all applications for which content rewrite is enabled or disabled.
Note
From this tab, you can create or edit content rewrite rules, as described in the following procedure.
Before You Begin
•
•
Related Topics
•
•
Step 1
Step 2
Step 3
The Add/Edit Content Rewrite dialog box opens. For a description of the elements in this dialog box, see Table I-28 on page I-54.
Step 4
Step 5
Step 6
Step 7
Step 8
Note
Step 9
Note
Defining Encoding Rules
Character encoding is the pairing of raw data (such as 0's and 1's) with characters to represent the data. The language determines the character encoding method to use. Some languages use the same method, while others do not. Usually, the geographic region determines the default encoding method used by the browser, but the remote user can change this. The browser can also detect the encoding specified on the page, and render the document accordingly.
The encoding attribute lets you specify the value of the character encoding method in the SSL VPN portal page to ensure that the browser renders it properly, regardless of the region in which the user is using the browser, or any changes made to the browser.
The character encoding attribute is a global setting that, by default, all SSL VPN portal pages inherit. However, you can override the file-encoding attribute for Common Internet File System (CIFS) servers that use character encoding that differs from the value of the character-encoding attribute. You can use different file-encoding values for CIFS servers that require different character encodings.
The SSL VPN portal pages downloaded from the CIFS server to the SSL VPN user encode the value of the SSL VPN file-encoding attribute identifying the server, or if one does not, they inherit the value of the character encoding attribute. The remote user's browser maps this value to an entry in its character encoding set to determine the proper character set to use. The SSL VPN portal pages do not specify a value if SSL VPN configuration does not specify a file encoding entry for the CIFS server and the character encoding attribute is not set. The remote browser uses its own default encoding if the SSL VPN portal page does not specify the character encoding, or if it specifies a character encoding value that the browser does not support.
In the Encoding tab of the SSL VPN Global Settings page, you can view the currently configured character sets associated with the CIFS server to be encoded in the portal pages. From this tab, you can create or edit the character sets, as described in the following procedure.
Before You Begin
•
•
Related Topics
•
Step 1
Step 2
Step 3
Note
Step 4
The Add/Edit File Encoding dialog box opens. For a description of the elements in this dialog box, see Table I-30 on page I-58.
Step 5
CIFS servers are predefined network objects. You can click Select to open the Network/Hosts Selector dialog box that lists all available network hosts, and in which you can create network host objects.
Step 6
Step 7
Note
Step 8
Note
Defining Proxies and Proxy Bypass Rules
The security appliance can terminate HTTPS connections and forward HTTP/HTTPS requests to HTTP and HTTPS proxy servers. These servers act as intermediaries between users and the Internet. Requiring all Internet access via a server you control, provides another opportunity for filtering to assure secure Internet access and administrative control.
Note
You can configure the security appliance to use proxy bypass when applications and web resources work better with the content rewriting this feature provides. Proxy bypass is an alternative method of content rewriting that makes minimal changes to the original content. It is useful with custom web applications.
You can configure multiple proxy bypass entries. The order in which you configure them is unimportant. The interface and path mask or interface and port uniquely identify a proxy bypass rule.
If you configure proxy bypass using ports rather than path masks, depending on your network configuration, you might need to change your firewall configuration to allow these ports access to the security appliance. Use path masks to avoid this restriction. Be aware, however, that path masks can change, so you might need to use multiple path mask statements to exhaust the possibilities.
In the Proxy tab of the SSL VPN Global Settings page, you can view the currently configured proxy bypass rules, create new rules or edit the existing ones, as described in the following procedure.
Before You Begin
•
•
Related Topics
•
•
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Step 7
The Add/Edit Proxy Bypass dialog box opens. For a description of the elements in this dialog box, see Table I-32 on page I-61.
Step 8
Step 9
•
•
Step 10
Step 11
Step 12
Note
Step 13
Note
Step 14
Note
Defining Advanced Settings
The Advanced tab lets you configure the amount of security appliance memory that SSL VPN can use for its sessions.
Before You Begin
•
•
Related Topics
Step 1
Step 2
Step 3
Note
Step 4
Note
