Monday, December 1, 2008

Configuring WebVPN (SSL VPN)


For this lab you'll need 12.4T image. I'm using:


We have to configure this on 3 main steps:

  1. Configure WebVPN gateway (hostname, IP, certificate)
  2. Configure WebVPN context (URL lists, Port forwarding, acl, nbns list..)
  3. Configure WebVPN group policy (Look and feel on the web interface, access to the resources)

To be sure that I'll be tunneled and not routed, I've applied an access list on the router A. I was very surprised when I logged in on the web server on win2003 host, for which I had a url-list added, and just from modifying the URL from:

to: , I was able to reach the Monkey Web Server on the DSL Linux box. After that I've found out that we can apply an ACL to the policy itself, and I got this syslog message:

*Nov 29 23:27:58.883: %SSLVPN-6-WEBVPN_APP_ACL_NET: The request( source ip:, destion ip : ) from user cisco is denied by ACL, and also:

*Nov 30 00:37:03.803: %SSLVPN-6-WEBVPN_APP_ACL_NET: The request( source ip:, destion ip : ) from user cisco is permitted by ACL

All the syntax:

webvpn gateway VPN-SSL
hostname SSL-GW
ip address port 443
http-redirect port 80
ssl trustpoint TP-self-signed-4294967295
webvpn context SSLCTX
title "VPN-SSL Page"
ssl authenticate verify all
url-list "MYLINKS"
   heading "Quicklinks"
   url-text "Homepage" url-value ""
   url-text "Homepage2" url-value ""
   url-text "IIS Start page" url-value ""
acl "TEST"
   permit http any syslog
nbns-list "NBNS"
login-message "User/Pass Please"
port-forward "PF"
   local-port 25555 remote-server "" remote-port 25 description "MAIL"
policy group SSL-Policy
   url-list "MYLINKS"
   acl "TEST"
   port-forward "PF"
   nbns-list "NBNS"
   functions file-access
   functions file-browse
   functions file-entry
   banner "Eureka!"
   timeout idle 1800
   timeout session 36000

default-group-policy SSL-Policy
gateway VPN-SSL

For some reason the port forwarding was recognized as local port 25 instead of 25555 as it is in the config. Also I haven't tested the windows file shares, because my win2003 and my laptop were in different workgroups, and I was too lazy to reboot :-)

No comments: