topic Re: DAP vs cut through proxy in Network Security

DAP vs cut through proxy

Amadou TOURE — Mon, 11 Mar 2019 14:51:11 GMT

Hello,

I've configured, in my ASA 5550, cut through proxy with IAS/AD for internal users browsing the Internet and the feature works well.

As soon as I deployed the remote access VPN config which's working with DAP, the cut though proxy stopped working.

Users got error message (error:Dynamic access policy not continue.

How can I disable http request handling by DAP, I want to use DAP and cut though proxy separately.

Thanks for your hints

Re: DAP vs cut through proxy

Ivan Martinon — Mon, 16 Feb 2009 21:46:25 GMT

This is Odd, DAP asks you to choose the application that it will be used for, in your case IPSEC, did you choose this application?

Re: DAP vs cut through proxy

Amadou TOURE — Tue, 17 Feb 2009 14:32:56 GMT

Hi,

For now I removed all policies and I just have the default Access policy and there's no application for it.

Thank you.

Re: DAP vs cut through proxy

Ivan Martinon — Tue, 17 Feb 2009 14:36:11 GMT

So is it working now or not?

Re: DAP vs cut through proxy

Amadou TOURE — Tue, 17 Feb 2009 15:38:02 GMT

you have to configure the default action to continue to make it work.

when you configure the default action to terminate the error message is displayed.

Do you have a link or a document that explain how to configure DAP without interfering with cut through proxy ?

Thank you.

Re: DAP vs cut through proxy

Ivan Martinon — Tue, 17 Feb 2009 15:42:41 GMT

Yes, and DAP has a default action enabled by default which action is to continue, I don't think there are docs explaining how to integrate both but again using the application type you can restrict it to

cut-through or IPSEC.

https://www.cisco.com/en/US/products/ps6120/products_white_paper09186a00809fcf38.shtml

Re: DAP vs cut through proxy

Amadou TOURE — Tue, 17 Feb 2009 17:13:42 GMT

Thank you...I'll remake my test based on your suggestions.

Best regards

Re: DAP vs cut through proxy

Amadou TOURE — Tue, 17 Feb 2009 18:29:45 GMT

Hello,

I want to use DAP with a ipsec VPN client and whenever I create a dynamic policy in CSM, I receive a message asking to activate CSD.

How can I use DAP without CSD ?

Thanks

Re: DAP vs cut through proxy

Ivan Martinon — Tue, 17 Feb 2009 18:32:58 GMT

I have not done it via CSM before, are you on the right section?

Re: DAP vs cut through proxy

Amadou TOURE — Tue, 17 Feb 2009 19:48:07 GMT

Yes, CSM 3.2.1 allow you to configure DAP but not the 3.2 version.

How to configure the application in ASDM ? I didn't see a field for the application.

Re: DAP vs cut through proxy

Ivan Martinon — Tue, 17 Feb 2009 19:51:26 GMT

ASDM 6.0 should have it under SVC Anyconnect section for remote access, but worry not that does not mean it applies anything to the SVC or anyconnect just seems they find no better place to put it, there is another section which I don't have on top of my head right now.

Re: DAP vs cut through proxy

Amadou TOURE — Tue, 17 Feb 2009 20:10:28 GMT

OK, I'll test it and let you know.

thank you very much