In the diagram below, a User uses Internet Explorer on Windows 7 to access Clientless WEBVPN on FirePower 4100, with ASA version 9.7
When the user login to Clientless WEBVPN, he supposed to get an IP from the IP pool assigned for SSL WEBVPN (Anyconnect and Clientless), but I found that the user did not get an IP from the IP pool when he connects via clientless WEBVPN, but he is assigned an IP address from the IP pool, when he connects via AnyConnect client.
Question 1 : Why, the user does not get IP address from the IP pool when he connects via Clientless WEBVPN ?
Question 2 : It is required to tunnel all traffic into the WEBVPN tunnel, so the user gets access to Internet via the firewall, which represents hairpin/U-turn traffic. AnyConnect Configuration works fine with no issue, But Clientless WEBVPN Configuration give him access to Internal servers, but not to Internet.
No Smart Tunnels.
No Application Lists.
The user resolves URL via internal DNS server behind the same firewall.
The use of a proxy server is not required. The user will be assigned an IP address from a public IP pool which is owned by the client, and no NAT is used for all traffic traversing the firewall.
So, the user's WEBVPN assigned IP address will be the IP address shown at the destination web server (e.g. www.yahoo.com), not the public IP address which is assigned by the ISP which the user uses to access Internet from his location.
Of course, I know that all the above can work with AnyConnect with no issues.
The requirement is to make this work via Clientless WEBVPN, which has limitations compared to AnyConnect WEBVPN.
