topic Re: ASA WEB VPN in Network Security

ASA WEB VPN

shihabuddin_ebrahim — Fri, 21 Feb 2020 16:13:27 GMT

Hi,

There is a web server hosted on internet nobody can access it from internet except allowed IPs.
so we can access it from our prem but not from internet.
we created sslvpn on Cisco ASA and added the URL of the web server as bookmark but it doesn't work.
we found that ASA the traffic to internet directly not through the Proxy,
how we can make ASA to send the traffic to this URL to the proxy?

Regards

Re: ASA WEB VPN

balaji.bandi — Tue, 11 Sep 2018 13:43:09 GMT

As per my understading

when the user connect to your network using VPN they are not able to access the URL, which was access through your Local Lan but not on VPN.

if this case, is your LAN using Proxy settings, or WCCP to send traffic to proxy Server.

Explain how is your Lan access to this URL, flow model.

Re: ASA WEB VPN

shihabuddin_ebrahim — Tue, 11 Sep 2018 14:54:34 GMT

Thank you for your response,

from local lan the traffic goes to ASA a policy based routing forwards http and https to the proxy.

but when the user clicks the bookmark the traffic goes directly to internet without passing the proxy.

i need to make it go to the proxy.

Re: ASA WEB VPN

gbekmezi-DD — Tue, 11 Sep 2018 15:41:34 GMT

You have more details? What is happening when you try? Is the link showing up in the webvpn portal? What error are you experiencing?

Thanks,

George

Re: ASA WEB VPN

balaji.bandi — Tue, 11 Sep 2018 15:53:01 GMT

but when the user clicks the bookmark the traffic goes directly to internet without passing the proxy.

This you mean VPN user ? in this case you need to use same policy to route to proxy. (for the IP range for the VPN Range).

Re: ASA WEB VPN

shihabuddin_ebrahim — Tue, 11 Sep 2018 18:05:34 GMT

yes clientless ssl vpn user, there is no ip range because this is client less vpn , if i change same policy the remaining 9000 users well be affected i want to configure the bookmark only to go to the proxy, but how ?

Re: ASA WEB VPN

balaji.bandi — Tue, 11 Sep 2018 19:46:32 GMT

as suggested other post we need more details to assist further on this problem.

Re: ASA WEB VPN

shihabuddin_ebrahim — Tue, 11 Sep 2018 19:51:51 GMT

@gbekmezi-DD wrote:
You have more details? What is happening when you try? Is the link showing up in the webvpn portal? What error are you experiencing?

Thanks,

George

yes the link showing in the portal,the traffic goes to internet but as the web server do not accept traffic except from our proxy ip the web page does not open, we need a way to make the traffic go to the proxy I wonder if there is a method to add the proxy IP to the group policy to make this particular bookmark to go to the proxy

Re: ASA WEB VPN

shihabuddin_ebrahim — Tue, 11 Sep 2018 19:53:17 GMT

@gbekmezi-DD

Re: ASA WEB VPN

balaji.bandi — Tue, 11 Sep 2018 19:55:45 GMT

Since you are redirecting the Traffic to proxy using PBR, you need to identify the VPN user IP block and route the same to proxy for that URL IP, so proxy will can allow your VPN users to access that URL.

If you think this is issue with your other users and Service impact.

for testing create a another vpn user group with new IP range, test it, if that works deploy same for all other users.

Make Sense ?

Re: ASA WEB VPN

shihabuddin_ebrahim — Tue, 11 Sep 2018 19:58:38 GMT

there is NO vpn user ip BECAUSE this is CLIENTLESS vpn

Re: ASA WEB VPN

shihabuddin_ebrahim — Tue, 11 Sep 2018 20:00:59 GMT

there is NO VPN USER IP BECAUSE this is CLIENTLESS SSL VPN through portal

Re: ASA WEB VPN

shihabuddin_ebrahim — Tue, 11 Sep 2018 20:05:34 GMT

yes make sense but there is a little problem there is NO IP RANGE and NO IP POOL BECAUSE THIS IS CLIENTLESS SSL VPN

Re: ASA WEB VPN

balaji.bandi — Tue, 11 Sep 2018 20:38:55 GMT

Can you post webvpn part of configuration.

Re: ASA WEB VPN

gbekmezi-DD — Tue, 11 Sep 2018 21:02:34 GMT

What kind of proxy are you using and what network equipment exists between the ASA and the web server? Can you use WCCP to redirect the traffic sourced from the ASA to the internal web server to your proxy?

Re: ASA WEB VPN

shihabuddin_ebrahim — Wed, 12 Sep 2018 04:01:34 GMT

the traffic coming from the users to the ASA where there is policy based routing to forward http and https to bluecoat.

do you mean that it is possible to use wccp to forward the traffic of this bookmark to bluecoat and keep all remaining traffic as it is , is this possible ?

Re: ASA WEB VPN

shihabuddin_ebrahim — Wed, 12 Sep 2018 08:07:34 GMT

I getting this message
[cid:11c59e5a-fc47-4570-9768-46015c17f463]

Re: ASA WEB VPN

shihabuddin_ebrahim — Thu, 13 Sep 2018 06:41:19 GMT

I managed to resolve the issue in webacl allow the destination url under advanced put the proxy

configure a static route to your proxy in the proxy configure no authenticate for the url and create a web access layer, thanks for all who tried to help me