ASA WebVPN: URL redirection?

[Damon Cassell]

I have a question about performing URL redirection with WebVPN. Basically, is there a way to do this?

We use ASA for IPSec VPN, and Microsoft ISA to allow access to webmail and some other internal HTTP resources without a client.

I am trying to cook up a configuration on the ASA to do what ISA does for us, so we can get down to one remote access platform.

So far, I can do 95% of what ISA 2004 does with ASA WebVPN. One thing I am stuck on, though, is this scenario:

We allow access to "http://intranet.mycompany.com/timecards". But, if a user requests (or clicks a link to) "http://intranet.mycompany.com/otherpath" we want her to be shown a help page hosted on our external www server. The generic "Access to this resource has been denied" message is not sufficient.

How do I do this? It seems simple enough, and ISA 2004 handles it quite nicely, but I cannot figure out how to do this on ASA.

I'm running an ASA 5540 with ASA 7.2(2)22 and ASDM 5.2(2)58.

[fmeetz]

Set the default group policy to redirect the WebVPN home page. By default, alternative group policies and users inherit the Custom Homepage setting of the default group policy.

Double-click the DfltGrpPolicy entry in the Group Policy table, open the WebVPN > Homepage tab, click Specify URL, select http from the drop-down menu, enter the URL of the Citrix server in the field to the right, and click OK.

?Set the alternative group policies to redirect the WebVPN home page.

By default, users inherit the Custom Homepage setting from their respective assigned group policies.

For each internal or external group policy for which you want to redirect the WebVPN home page, double-click the policy in the Group Policy table, open the WebVPN > Homepage tab, clear Inherit in the Custom Homepage area, click Specify URL, select http from the drop-down menu, enter the URL of the Citrix server in the field to the right, and click OK

[Damon Cassell]

That's all fine -- that redirects users to a HOME page. What I want to do is deliver a highly customized ACCESS DENIED message when someone clicks a link they don't have access to. My preference is to redirect them to a web page on our public WWW server when they are DENIED access to a resource.