traffic redirects

[Sirajhussain]

Hi,

traffic redirects..

[Jouni Forss]

Hi,

Well I'm not exactly sure if this is what you are looking for but you can define on the ASA that when certain users initiate for example a http/https connection that they will have to authenticate with the ASA first either using LOCAL or AAA-SERVER.

Initiating a HTTP/HTTPS connection should direct the users connection to ASA which asks for authentication before allowing the connection.

I for example tested on my home ASA just now with following configurations (This was just something i configured fast so it might be lacking)

Basic Configuration

• username proxy password test privilege 0
• access-list PROXY-TEST permit tcp host 10.0.0.5 any eq http
• access-list PROXY-TEST permit tcp host 10.0.0.5 any eq https
• aaa authentication match PROXY-TEST LAN LOCAL
• aaa authentication listener http LAN port https redirect
• aaa authentication listener https LAN port https redirect

Where

• LAN = my LAN interface
• LOCAL = Refers to the ASAs LOCAL AAA

Additional Commands

• show uauth
  • Show Authenticated users
• clear uauth
  • Clear authenticated user (or without username all)
• timeout uauth xx:xx:xx absolute/inactivity
  • Set the timeout value for authenticated user

If you want to know more about this you should Google for ASA Cut Through Proxy or check the same thing from the Configuration Guide.

- Jouni

[Jouni Forss]

Also,

I think you can modify the Prompts the user gets when attempting the connection

There are commands:

• auth-prompt prompt
• auth-prompt accept
• auth-prompt reject

- Jouni

[Sirajhussain]

Yes, its the same

[Jouni Forss]

What I posted earlier will only make it so that certain users couldnt access the Internet unless they authenticate with the ASA first.

I dont think the ASA alone can do what you are asking with regards to redirecting users to a certain site. It would on the other hand block their connection attempts unless they had username/password needed to pass the authentication

- Jouni

[Sirajhussain]

I understand that but thats not i want achieve

[Sirajhussain]

Hi,

Can anyone tell me what is needed to achieve above requirement? I mean if ASA alone cannot fulfill the requirement.

Regards,

[Jernej Vodopivec]

You can redirect http traffic to certain IP address but not url if that solves your problem also?

1. create network object for those IPs that don't have access to internet:
object network banned-ips
subnet 1.2.3.0 255.255.255.0

2. create network object for all ip addresses:
object network internet
subnet 0.0.0.0 0.0.0.0

3. create network object for web server
object network web-server
host 11.22.33.44

4. create service object for http traffic
object service http-traffic
service tcp destination eq http

4. create nat rule to translate http traffic to web server
nat(inside,outside) 10 source static banned-ips interface destination static internet web-server service http-traffic http-traffic

Hope that solves your problem.

[Sirajhussain]

Well that command will not accept in current version

[Jernej Vodopivec]

Hi Sirajhusen,

sorry, I overlooked you're still running pre 8.3 version you mentioned in your first post.

I would recommend you upgrade to post 8.2 version which offers you much more flexibility when configuring nat rules. And you could also benefit from new features like AD integration, scansafe connector...

Is this possible in your case?

[Sirajhussain]

Thanks Jernej,

You mean the pre 8.3 version will not solve the problem, right? This an urgent requirement pls suggest if any other way.

I already gone through the below link of pre 8.3 to 8.3 NAT config examples

https://supportforums.cisco.com/docs/DOC-9129

Regards,