Cisco ASA / SSL Proxy with client-certificates

jm — Tue, 12 Mar 2019 02:13:20 GMT

Hi All,

A customer want to replace his old Microsoft ISA firewall with another device.

I thought of a redundant Cisco ASA pair. The new firewall has to meet the following requirement:

The new Firewall has to validate SSL client-certificates against Microsofts Active Directory

and act as a SSL proxy between server and client.

Does somebody know if that is possible with a Cisco ASA? Or maybe with another Cisco product?

Thank a ton,

Johannes

Cisco ASA / SSL Proxy with client-certificates

Favaloro. — Wed, 17 Jul 2013 18:46:00 GMT

If by "validate SSL client-certificates against Microsofts Active Directory" you mean have the ASA confirm that the certificate the client holds is valid, it does it by checking its CRL, in case it uses that method, can also use OCSP as you might know.

Now, as for the "act as a SSL proxy between server and client" thingy, i know that the newest member of the ASA-frewall family, the ASA CX [it's actually a module], has a TLS/SSL proxy feature.

Couldn't find a document stating that fact though, i guess you can always reach out for your Cisco rep and get that clarified.

topic Cisco ASA / SSL Proxy with client-certificates in Network Security

Cisco ASA / SSL Proxy with client-certificates

Cisco ASA / SSL Proxy with client-certificates