Hi All, I have setup a WebVPN for one of my customers and it is working fine.  When a user enters an intranet URL like below they expect that it is directed to the forms based authentication on the home page and once the user provides the credentials, it should redirect to the originally requested page. Intranet page: http://xx.abc.com/intra/news.nsf/support-Intranet?OpenDocument&bottomtabs=5 Home page:    http://xx.abc.com However, the user directly gets a "Wrong-URL.html".  Could you please suggest if the customer's request can be configured for the WebVPN? How do I do it? ... View more

Hi, I am facing issue with one of the VPNs setup for our customer. Once the tunnel is established, it works fine. But I suppose during the SA re-keying the ASA detects duplicate messages from Checkpoint and the tunnel is dropped briefly. Eventually one of the SPIs is accepted and the tunnel comes up without any intervention. I have compared the VPN config with the remote end and it seems to be correct. The renegotiation timings are as follows: Phase 1 Renegotiation time: 1440 minutes Phase 2 Renegotiation time: 480 minutes   Also find the attached logs from the ASA where, A.A.A.A is the IP of the Checkpoint firewall C.C.C.C is the IP on the ASA. B.B.B.B is the server IP behind the ASA and D.D.D.D is the server IP behind the Checkpoint firewall.   Any suggestions are highly appreciated.             ... View more

Hello,   I have a Cisco ASA 9.1(3) 5545 device. A request from my customer required that a few servers in DMZ be accessible from outside. The details are as follows:   Servers in DMZ: 10.20.30.40-49 Public IP used for static NAT: x.y.111.1 - 10   The DMZ interface IP: 10.20.30.1 The Outside interface IP: a.b.c.d   The customer has 2 different Public IP pools. The Outside interface is configured with an IP from one of these pools (a.b.c.*/26). While in this request the customer has asked us to use the other pool (x.y.111.1-10).   I have configured the following on the firewall   1] Static NAT:    object network 10.20.30.40                 nat (any , any) static x.y.111.1   and so on upto 10.20.30.49. I am skipping those for brevity.   2] ACL for inbound traffic from DMZ    access-list Dmz_access_in extended permit tcp object int-10.20.30.40 any    (Similar policies for other DMZ IPs)   3] ACL for inbound traffic from Outside    access-list Outside_access_in extended permit tcp any object int-10.20.30.40 eq www    access-list Outside_access_in extended permit tcp any object int-10.20.30.40 eq ftp    (Similar policies for other inbound traffic on Outside interface)   This config is not working. Please suggest if I am missing something. Also could anyone explain how Proxy-ARP would work in this scenario if the firewall gets an ARP request for x.y.111.1-10 IPs from a Router? ... View more