topic Re: Https rules in Network Security

Https rules

Stijntacken — Mon, 11 Mar 2019 19:54:21 GMT

Hello everyone,

We're experiëncing some difficulties with our ASA 5505.

When we want to visit https://portal.example.com the pc doesn't go to that website. However, when we visit a different portal, it goes right ahead. When we remove the ASA 5505 out of the network we can vizit https://portal.example.com just fine.

I uploaded the firewall rules just in case. I didn't think there's anything wrong with those but I uploaded them anyway.

Has anyone experienced the same kind of incidents?

Thanks in advance,

Stijn

Re: Https rules

Jitendriya Athavale — Tue, 22 Feb 2011 14:54:16 GMT

please apply captures on the outside and inside and of the asa and also the PC this will give us some ideas

let us see where it is feeling

http://www.cisco.com/en/US/products/ps6120/products_tech_note09186a00807c35e7.shtml

this will help you applying captures

Re: Https rules

Jitendriya Athavale — Tue, 22 Feb 2011 15:08:16 GMT

you might also want to take a look at this

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a00804c8b9f.shtml

Re: Https rules

m.kafka — Tue, 22 Feb 2011 20:54:48 GMT

Hi,

I assume that "portal.example.com" is just a placeholder for the real server you try to access.

Some things to verify (because "PC doesn't go to that website" is not very precise):

Can you resolve the name on the PC in question with nslookup?

Can you establish a telnet session to the resolved IP address, port 443?

(you might want to do that test from "server" because it's the only one permitted https to the outside)

A packet-tracer is always recommended to verify if something is wrong with the firewall config (but in that case I don't think its the config).

Is "server" functioning as a https-proxy for the inside PCs? If so, can the server itself open the website?

If "server" is a https-proxy could be something wrong with the server policies, like black-list or something wrong with the certificate of "portal.example.com"?

In some rare cases a server can redirect the clients to a different port with "content location changed" (vulgo "http redirect").

Just a few things that might be worth trying to drill down into the cause of the issue.

Rgds,

MiKa

Re: Https rules

Stijntacken — Tue, 01 Mar 2011 14:09:18 GMT

Hi!

These answers put me on the right track.

I had t change the MMS value in the ASA. After that it worked.

Thank you all!

Greets,

Stijn Tacken