01-16-2012 10:04 PM - edited 03-11-2019 03:15 PM
Hi,
I'm trying to configure an ASA 5520 with cut-through proxy feature. The user is required to be authenticated when trying to access an outside resource from the inside. This is a test lab before it is implemented in production. Following is the configuration -
ciscoasa# sh run
: Saved
:
ASA Version 8.3(1)
!
hostname ciscoasa
enable password 2KFQnbNIdI.2KYOU encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
!
interface GigabitEthernet0/0
no nameif
no security-level
no ip address
!
interface GigabitEthernet0/1
no nameif
no security-level
no ip address
!
interface GigabitEthernet0/2
nameif inside
security-level 100
ip address 192.168.50.254 255.255.255.0
!
interface GigabitEthernet0/3
nameif outside
security-level 0
ip address 192.168.100.254 255.255.255.0
!
interface Management0/0
nameif management
security-level 100
ip address 192.168.200.254 255.255.255.0
management-only
!
boot system disk0:/asa831-k8.bin
ftp mode passive
object network InternalLAN
subnet 192.168.50.0 255.255.255.0
object network obj_any
subnet 0.0.0.0 0.0.0.0
access-list inside_access_in extended permit tcp object InternalLAN any eq www
pager lines 24
logging enable
logging asdm informational
mtu inside 1500
mtu outside 1500
mtu management 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-631.bin
no asdm history enable
arp timeout 14400
!
object network obj_any
nat (inside,outside) dynamic interface
access-group inside_access_in in interface inside
route outside 0.0.0.0 0.0.0.0 192.168.100.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:03:00 absolute uauth 0:02:00 inactivity
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
aaa authentication match inside_access_in inside LOCAL
aaa proxy-limit 128
aaa local authentication attempts max-fail 3
aaa authentication listener http inside port www redirect
http server enable
http server session-timeout 15
http 192.168.200.0 255.255.255.0 management
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
auth-prompt prompt THIS IS A TEST LOGON PAGE
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
telnet timeout 5
ssh timeout 5
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
username test password P4ttSyrm33SV8TYp encrypted
username admin password f3UhLvUj1QsXsuK7 encrypted!!prompt hostname context
<snip>Cryptochecksum:ce425897ddd74c003034d095e4a2c2d9: end
ciscoasa#
I also use a 3524XL in this setup (default-gateway set to 192
Physical Connections --
Laptop (192.168.50.13/24) ---- 3524XL (Port 1 - Access VLAN 50)
ASA Gi0/2 (Inside) ---- 3524XL (Port 2 - Access VLAN 50)
ASA Gi0/3 (Outside) ---- 3524XL (Port 24 - Access VLAN 100)
From the laptop I can ping the Inside interface and vice-versa.
From the laptop if I browse to an ip address such as http://10.10.10.20 and I would have expected that the ASA will prompt for credentials - no prompts just get the cannot find the server - which is obvious.
From the laptop if I browse to "http://192.168.50.254/netaccess/connstatus.html", I do get the network access webpage but this is the manual process and not very interesting.
I have already gone through the following guides -
http://www.cisco.com/en/US/docs/security/asa/asa84/asdm64/configuration_guide/access_fwaaa.html
https://supportforums.cisco.com/docs/DOC-14695
I'm obviously missing a key element here so would really appreciate if someone can point it out.
Thanks
Vivek
Solved! Go to Solution.
01-18-2012 03:04 PM
Hello Vivek,
Great to hear that.
Please mark the question as answered so future users with the same issue can learn from here,
Regards,
Julio
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide