Problem with WebVPN and Javascript

[colindjackman]

I am trying to get the WebVPN working with one of our applications hosted in house and the parsing/modifying of the javascript is wrong. Just wondering if anyone else has come across this or if there is a workaround or something like that. Example below.

Original Line of code

setTimeout((function() {this.respondToReadyState(1)}).bind(this), 10);

WebVPN replacement

setTimeout(webvpn_mangle_eval((function()){this.respondToReadyState(1)}).bind(this), 10);

As you can see the it puts the brackets for the call webvpn_mangle_eval in the wrong place. It look like the inline function in the line of code is messing it up.

Any ideas would be great.

Colin

[Farrukh Haroon]

This is the ASA or IOS?

Regards

Farrukh

[colindjackman]

Neither - we use a cluster of VPN 3030 appliances, firmware revision

"VPN 3000 Concentrator Version 4.7.2.O Mar 05 2008 16:24:28".

Thanks

Colin

[Farrukh Haroon]

I thought the concentrator did not even support URL mangling?

Regards

Farrukh

[Farrukh Haroon]

I would say your best bet would be to do a webvpn capture and open a case with Cisco TAC:

http://www.cisco.com/en/US/docs/security/vpn3000/vpn3000_47/configuration/guide/webvpnap.html#wp1012837

Regards

Farrukh

[reed.savory]

I'm working with the original poster on this issue.

The VPN 3000 concentrators do in fact apparently rewrite JAVA, although it isn't a function that can be adjusted in terms of how it happens - there doesn't appear to be any administrative settings that would allow you to control how it does it, other than disabling JAVA entirely.

There's a mention in the release notes of the most recent firmware release (which we're running) that indicates an issue being fixed with an application called "TeamCenter" in that the concentrator was apparently causing an issue for this application in terms of how it was rewriting the JAVA code.

We in fact upgraded to the most recent firmware based on this note about fixing the writing so that it no longer impacted "TeamCenter", hoping that it might solve our issue as well, but no luck - same issue still occurs.

[Farrukh Haroon]

You best option is to open a Case with Cisco TAC. There is a WEBVPN capture tool, take a capture using that and send it to TAC.

The ASA is much more flexible in this regard (Smart Tunnel, APCF etc.)

Regards

Farrukh

[reed.savory]

For anyone else who encounters this: I opened a case with TAC.

The problem is a known bug, which I'm informed will not be fixed, since the VPN 3000 has an end-of-life schedule at this point.

[Farrukh Haroon]

OK great, thanks for the update.

Regards

Farrukh