Few questions about ASA ssl vpn

[SDKIM]

Hello,

I got a few requests from the customer and i also thought that these are impossible to be done.

But I just want to get confirmations from the experts staying here :)

1. Per user based the firewall feature : Client wants to apply the firewall policies per each ssl vpn local users.

2. Two different domains to access two different ssl connection profiles(SSL connection through the web browser) : For example, https://user.vpn.com >> user profile, https://adm.vpn.com >> adm profile.

Kindly request you to confirm these items.

Thanks in advance, Good luck!!

[Bogdan Nita]

1. Had the same request once, but with AD users. We used IDFW and we configured ACLs with AD users as source. I do not think it can be done for local users.

2. Not sure if I understood the question or I am missing something. Couldn't you have 2 tunnel-groups with different group-url ?

[SDKIM]

Thanks for your reply.

Regarding the question 2, Currently I have 1 SSL vpn connection profile(Site to client) for the user access, then user would be able to access through the web browser with the certain URL, ex, https://user.vpn.com, otherwise also would be able to access through the anyconnect client software with ASA outside ip address.

Now client wants to add one more SSL vpn connection profile only for the admin and he wants to use the different URL such as https://adm.vpn.com. My understanding is that to use the different URL, ASA needs to have secondary outside ip address and this ip address should be registered on DNS server with the different URL. In this case, ASA also can sync up this secondary ip address with the new connection profile. And as far as I know, ASA doesn't support the secondary ip address on the outside interface.

Please let me know if there is any misunderstading.

[Marvin Rhoads · Accepted solution]

You don't need a new top-level URL. You can create a new connection profile for admins and give it a Group URL but NOT a connection alias. (The connection alias is what appears in the drop down list.)

It will thus be effectively "hidden" and when the admin users go to, for instance, https://user.vpn.com/it_admin they will be connected automatically to the alternate connection profile.

[SDKIM]

Appreciate your great help!!

[Bogdan Nita · Accepted solution]

If you want to have 2 URLs pointing to 2 different IPs, you will have to have 2 IPs on the ASA and you are right, ASA does not support secondary IP.

You could have the 2 names pointing to the same IP, configure a tunnel-group for each url and configure the url with group-url. If you don't configure the tunnel with group-alias it will not appear in the drop down list.

If you have certificates on the ASA, you will need a certificate with both URLs, but then both URLs will be visible. You can get around this if you use the names slightly different: vpn.com/user and vpn.com/admin.

This way the certificate will have to be issued only to vpn.com.

[SDKIM]

Appreciate your great help!!