Configuring WebVPN (SSL VPN)

For this lab you'll need 12.4T image. I'm using:

c7200-advsecurityk9-mz.124-22.T

We have to configure this on 3 main steps:

1. Configure WebVPN gateway (hostname, IP, certificate)
2. Configure WebVPN context (URL lists, Port forwarding, acl, nbns list..)
3. Configure WebVPN group policy (Look and feel on the web interface, access to the resources)

To be sure that I'll be tunneled and not routed, I've applied an access list on the router A. I was very surprised when I logged in on the web server on win2003 host, for which I had a url-list added, and just from modifying the URL from: https://192.168.1.1/http/0/server.mydomain.com/

to:

https://192.168.1.1/http/0/10.10.4.70/ , I was able to reach the Monkey Web Server on the DSL Linux box. After that I've found out that we can apply an ACL to the policy itself, and I got this syslog message:

*Nov 29 23:27:58.883: %SSLVPN-6-WEBVPN_APP_ACL_NET: The request( source ip: 192.168.1.2, destion ip : 10.10.4.70 ) from user cisco is denied by ACL, and also:

*Nov 30 00:37:03.803: %SSLVPN-6-WEBVPN_APP_ACL_NET: The request( source ip: 192.168.1.2, destion ip : 10.10.4.60 ) from user cisco is permitted by ACL

All the syntax:

webvpn gateway VPN-SSL hostname SSL-GW ip address 192.168.1.1 port 443 http-redirect port 80 ssl trustpoint TP-self-signed-4294967295 inservice ! webvpn context SSLCTX title "VPN-SSL Page" ssl authenticate verify all ! url-list "MYLINKS"    heading "Quicklinks"    url-text "Homepage" url-value "server.mydomain.com"    url-text "Homepage2" url-value "server.mydomain.com/index2.htm"    url-text "IIS Start page" url-value "server.mydomain.com/iisstart.htm" ! acl "TEST"    permit http any 10.10.4.60 255.255.255.255 syslog ! nbns-list "NBNS"    nbns-server 10.10.4.60 login-message "User/Pass Please" ! port-forward "PF"    local-port 25555 remote-server "server.mydomain.com" remote-port 25 description "MAIL" ! policy group SSL-Policy    url-list "MYLINKS"    acl "TEST"    port-forward "PF"    nbns-list "NBNS"    functions file-access    functions file-browse    functions file-entry    banner "Eureka!"    timeout idle 1800    timeout session 36000 ! default-group-policy SSL-Policy gateway VPN-SSL inservice

For some reason the port forwarding was recognized as local port 25 instead of 25555 as it is in the config. Also I haven't tested the windows file shares, because my win2003 and my laptop were in different workgroups, and I was too lazy to reboot :-)