1

I'm configuring a clientless VPN on an ASA 5505, and have a few questions:

  • I assume that, when accessing CIFS, if they delete a file it just goes bye-bye? (i.e. no recycle bin equivalent on the client side... I also can't find one on the server side for a regular Windows file server. Noticed a few NASs have some sort of CIFS recycle bin feature, but don't see a way to turn this on for Windows.)

  • Is it possible to have some sort of confirmation dialog before they can delete? I know they're irritating, but with no trash it seems a reasonable precaution.

  • I can add individual Windows file servers as CIFS addresses, and that works fine. However, if I click the "Network" button, I get the error "Failed to retrieve domains". Where would I start to look for this issue? It's definitely using the LDAP logins fine, seeing the files according to the user's permissions, etc... so I'm not sure where else to look to rectify this.

  • Is there a way to have links to pages on the VPN home page that don't get accessed through the VPN? One example would be our OWA. We use Office365 for our Exchange server. I'd like to have a link for the OWA login for this, that would ideally use SSO (but that might not be possible in this scenario). I want to have the SSL VPN be basically be a portal for them to see all of the links to our resources, and not have to log in multiple times, but not use our bandwidth when it's not necessary.

ETA: To clarify, by clientless VPN I'm referring to the Cisco VPN usable through a web browser - almost a sort of portal page. The one that looks basically like this, although the appearance has been updated slightly since - Cisco example screenshot

Improve this question
5
  • Do you already have the VPN configured and are now trying to access resources within the LAN from a remote location? When you refer to the clientless vpn are you referring to the Cisco AnyConnect SSL Tunnel?
    – Citizen
    Commented Mar 17, 2015 at 17:04
  • Yes - the VPN is configured and working. By clientless, I'm referring to the one accessed solely through a web browser.
    – teleute00
    Commented Mar 17, 2015 at 18:20
  • Regarding accessing the internal LAN. Are you trying to netbios to a CIFS share using the \\servername\sharename methodology from the remote system? Are you trying to access the OWA via internet explorer? Could this ultimately be a DNS issue? Have you tried to ping these resources from the remote system to see if you are getting a public IP back rather than the internal IP?
    – Citizen
    Commented Mar 17, 2015 at 18:48
  • I'm trying to access the CIFS shares from within the clientless VPN page framework (i.e. the one that looks basically like this, although the appearance has been update slightly since - goo.gl/xPd2CB). Again, any servers I add directly via name or IP work. It's just the "network" button that doesn't seem to work.
    – teleute00
    Commented Mar 17, 2015 at 21:56
  • As for the OWA comment, I'm not sure I'm clear. We use Office 365 for Exchange, and can use OWA regularly and all works fine (it doesn't require a VPN). But if I put it on this VPN page, just as a "keep all of our resources accessible from one portal" sort of idea, it works but only using the VPN connection. I'd ideally want to list it as a bookmark on the VPN page, but have it open separately (not using the VPN), to conserve our bandwidth. May not be possible, but just figured I'd check.
    – teleute00
    Commented Mar 17, 2015 at 21:58

1 Answer 1

Reset to default
2

After a long period of experimentation and follow-up with Cisco, I've got the following answers:

  1. There is no recycle bin equivalent when deleting CIFS files from a Windows server via the clientless VPN.

  2. There is no way to enable any kind of confirmation dialogue for file deletions at this point in time. So people can be trying to click the "favourite" button, be off by a millimetre, and accidentally delete with no confirmation and no trash to recover from. :-( They've put in the ability to turn on confirmations as a feature request, but there's no timeline on when it might be implemented. So guess we won't be using this feature, which is sad.

  3. I added our nbns server to the Cisco config, and now clicking the Browse entire network button shows me the domain. However, when I click on the domain, it says "Failed to retrieve servers". A had a support tech look at this, and he said the config all looks fine, and he found a few other instances of this for other users. He said he'd investigate and get back to me.

While waiting, I disabled file browsing. A few days later, when he wanted me to show him the issue, I turned it back on and it was working! (There's still a second domain showing in there that isn't on my nbns server...still no idea what the deal is with that. But the real domain is working.) So I don't know if the browsing just basically needed a kick in the pants after I added the nbns server config? No idea. But it's okay now.

  1. Having some links that use the clientless VPN and some that don't is in fact possible through content-rewrite rules (http://www.cisco.com/c/en/us/td/docs/security/asa/asa84/asdm64/configuration_guide/asdm_64_config/vpn_clientless_ssl.html#wp2389515)

"By default, the security appliance rewrites, or transforms, all clientless traffic. You might not want some applications and web resources (for example, public websites) to go through the ASA. The ASA therefore lets you create rewrite rules that let users browse certain sites and applications without going through the ASA. This is similar to split-tunneling in an IPSec VPN connection."

However - and I have confirmation of this from a Cisco support rep to back up my test results - this does not work in combination with SSO. If you're using the rewrite rules you cannot send parameters of any kind.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.