"clientless" in SSL VPN

[wfqk]

Hi I read several documents about SSL vpn. But I could not find what is exact meaning of "clientless". Anyone can give me explanation or link ? Thank you

[Kanwaljeet Singh]

Hi,

Clientless SSL VPN lets users establish a secure, remote-access VPN tunnel to an adaptive security appliance using a web browser. Users do not need a software like anyconnect, vpn client etc.

Clientless SSL VPN connections on the adaptive security appliance differ from remote access IPSec connections, particularly with respect to how they interact with SSL-enabled servers, and precautions to follow to reduce security risks.

In a clientless SSL VPN connection, the adaptive security appliance acts as a proxy between the end user web browser and target web servers. When a user connects to an SSL-enabled web server, the adaptive security appliance establishes a secure connection and validates the server SSL certificate. The browser never receives the presented certificate, so it cannot examine and validate the certificate.

The current implementation of clientless SSL VPN on the adaptive security appliance does not permit communication with sites that present expired certificates. Nor does the adaptive security appliance perform trusted CA certificate validation to those SSL-enabled sites. Therefore, users do not benefit from certificate validation of pages delivered from an SSL-enabled web server before they use a web-enabled service.

For more details:

http://www.cisco.com/c/en/us/td/docs/security/asa/asa83/configuration/guide/config/webvpn.html

Regards,

Kanwal

Note: Please mark answers if they are helpful.

[wfqk]

Thank you so much for your reply. SSL vpn has three modes. They are clientless, thin-client and full-tunnel client. Cisco document talked a lot about what they are, respectively. But I do not know why Cisco gave this name -- clientless. Can you tell a little about it ? 

[johnlloyd_13]

hi,

those 3 modes are just the different flavors or strategies in deploying VPNs.

please find helpful links with samples for clientless, thin client and full tunnel (now called Anyconnect)

http://ccnpsecuritywannabe.blogspot.com/2014/03/deploying-clientless-ssl-vpn-webvpn.html

http://ccnpsecuritywannabe.blogspot.com/2014/04/clientless-ssl-vpn-port-forwarding.html

http://ccnpsecuritywannabe.blogspot.com/2014/06/anyconnect-secure-mobility-client.html