Configuring SSL VPN

Tommy Svensson · ‎04-08-2011

Hi.

I am trying to configure SSL VPN to fit my needs and im not sure how to do this.

What i want to accomplish is that people using the VPN should be able to use remote desktop protocol to work from home to a couple of machines on the network.

Another thing that im more confused about is that locally on the computers there is a program that can only be used when the license server can issue permission for them to use it. This means that it also must work as if they where on the same LAN.

How do i go about it for these two requirements?

Regards Tommy Svensson

Tommy Svensson · ‎04-08-2011

I also have this error message that i dont know hos to fix.

scanlaser-router-2(config-webvpn-context)#virtual-template 1

%ERROR: Please make context out of service before applying VT.

Tommy Svensson · ‎04-08-2011

Here is my current running config. I tried to access
https://192.168.96.20/vpn
&
https://192.168.96.20/

without success.

interface GigabitEthernet0/0
description LINK_TO_ADSL
bandwidth 24576
backup interface GigabitEthernet0/1
ip address 192.168.96.20 255.255.255.0
ip nbar protocol-discovery
ip nat outside
ip virtual-reassembly in
zone-member security WAN_ZONE
duplex auto
speed auto
service-policy output QOS_POLICY
!
interface GigabitEthernet0/1
description LINK_TO_VPN
ip address 192.168.98.241 255.255.255.0
ip nat outside
ip virtual-reassembly in
zone-member security WAN_ZONE
duplex auto
speed auto
service-policy output QOS_POLICY
!
interface FastEthernet0/0/0
description USED_WITH_SUBINTERFACE
!
interface FastEthernet0/0/1
description USED_WITH_SUBINTERFACE
!
interface FastEthernet0/0/2
description USED_WITH_SUBINTERFACE
!
interface FastEthernet0/0/3
description USED_WITH_SUBINTERFACE
!
interface Virtual-Template1
ip unnumbered GigabitEthernet0/0
!
interface Vlan1
ip address 10.0.0.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
zone-member security LAN_ZONE
!
ip local pool vpn_pool 10.0.0.240 10.0.0.250
ip forward-protocol nd
!
ip http server
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
!
ip dns server
ip nat inside source route-map isp1 interface GigabitEthernet0/0 overload
ip nat inside source route-map isp2 interface GigabitEthernet0/1 overload
ip route 0.0.0.0 0.0.0.0 192.168.96.1
ip route 0.0.0.0 0.0.0.0 192.168.98.254 10
!
ip access-list extended ALLOW_BACK
permit gre any any
permit tcp any any eq 587
permit tcp any any eq 465
ip access-list extended ALLOW_IN
permit tcp any any eq 987
ip access-list extended ALLOW_OUT
permit tcp any any eq 465
permit tcp any any eq 587
permit gre any any
permit tcp any any eq 987
!
access-list 7 permit 10.0.0.0 0.0.0.255
access-list 9 remark PERMIT_HTTP
access-list 9 permit 192.168.96.0 0.0.0.255
access-list 9 permit 10.0.0.0 0.0.0.255
access-list 105 permit ip 10.0.0.0 0.0.0.255 any
!
!
!
!
route-map isp2 permit 10
match ip address 105
match interface GigabitEthernet0/1
!
route-map isp1 permit 10
match ip address 105
match interface GigabitEthernet0/0
!
!
!
!
control-plane
!
!
line con 0
logging synchronous
line aux 0
line vty 0 4
logging synchronous
transport input ssh
line vty 5 15
logging synchronous
transport input ssh
!
scheduler allocate 20000 1000
!
webvpn gateway WAN_IP
ip address 192.168.96.20 port 443
ssl trustpoint TP-self-signed-2148026383
inservice
!
webvpn install svc flash0:/webvpn/sslclient-win-1.1.4.176.pkg sequence 1
!
webvpn context vpn
secondary-color white
title-color #CCCC66
text-color black
ssl authenticate verify all
!
login-message "Welcome!"
!
policy group policy_1
functions svc-enabled
svc address-pool "vpn_pool"
svc default-domain "scanlaserrouter.local"
svc keep-client-installed
svc split include 10.0.0.0 255.255.255.0
svc dns-server primary 8.8.8.8
default-group-policy policy_1
aaa authentication list vpn_auth
gateway WAN_IP domain vpn
inservice
!
end

scanlaser-router-2(config-webvpn-context)#

Robert Salazar · ‎04-08-2011

What error message are you seeing during a connection attempt to https://192.168.96.20/vpn?

If the portal page is not displayed, a wireshark capture on the pc used to bring up the portal may identify where the connection is breaking.

Robert Salazar · ‎04-08-2011

Regarding the message seen when applying the virtual template to the context.

You'll need to issue the command "no inservice" in the webvpn context mode and then add the VT.

The context can then be restored after applying the VT.

e.g.

conf t

webvpn context vpn

no inservice

virtual template 1

inservice