3

I'm trying to implement the answer from a previous question I've asked (Cisco ASA Clientless SSL VPN Restrict Network Access)

My ultimate aim is to set up an SSL VPN on a Cisco ASA device to allow access to a specific DMZ area for clients of an imaginary company (uni project).

I've added the below lines to the config but I'm stuck with how to "apply" or "enable" this tunnel group separately from the default webvpn enabled in the first lines. Do I apply it to the outside interface somehow, or is it something to do with the IP Address/URL that the user uses to access the service?

webvpn
enable outside
exit

access-list CLIENT-VPN-LIST extended permit tcp object net-outside object net-dmz-client-server eq 3389
access-list CLIENT-VPN-LIST extended deny ip any any

group-policy CLIENT-VPN-POLICY internal
group-policy CLIENT-VPN-POLICY attributes
vpn-filter value CLIENT-VPN-LIST

tunnel-group CLIENT-VPN-GROUP type webvpn
tunnel-group CLIENT-VPN-GROUP general-attributes
authorization-required
default-group-policy CLIENT-VPN-POLICY

Edited to remove various outputs requested to help me get things correct that will only make this question confusing.

Improve this question
6
  • 1
    I assumed on the previous question that you at least had the rest of the tunnel-group defined already. Can you type show run all tunnel-group and show me the output so I can see what you do have?
    – Jesse P.
    Nov 19, 2021 at 12:31
  • 1
    Thanks. I’ll take a look and respond in a little bit. Gotta get my oldest kid to school.
    – Jesse P.
    Nov 19, 2021 at 12:49
  • 1
    I don't see any definitions in what you've already provided but, just to be safe, can you please show me the outputs from show webvpn group-url and show webvpn group-alias? Also, your users will need to go to something to access the VPN login page, which is usually a URL with an FQDN with or without a group/alias (such as https://vpn.company.com or https://vpn.company.com/group), but could just be a URL with an IP address and group/alias (such as https://100.200.100.200/group). Please clarify what it is that your users go (will go) to, to access the VPN.
    – Jesse P.
    Nov 19, 2021 at 14:59
  • 1
    Nothing shows up for either of those show commands. Sorry I'm a bit out of my depth with this stuff. For accessing the VPN so far I have just been navigating to the IP address for the outside interface. I'd probably just stick to the IP address plus a group/alias to keep it simple.
    – DavidM
    Nov 19, 2021 at 15:37
  • 1
    That's okay. That’s exactly what I expected. I added an answer to explain your next steps.
    – Jesse P.
    Nov 19, 2021 at 16:18

1 Answer 1

Reset to default
3

Because you don't currently have any group-url or group-alias definitions on any tunnel-groups, your users will use DefaultWEBVPNGroup's settings, which use local authentication (rather than something like RADIUS, TACACS, or LDAP) and will use the default group-policy DfltGrpPolicy.

Because of this, you have 3 options.

Option 1: You can edit DfltGrpPolicy so that it uses the VPN filter you previously created (alternatively you could also set it to use different authentication methods). If you do this, it will also affect your site-to-site tunnel and anything else using DfltGrpPolicy (because you don't have another policy defined for them to use instead).

To do so, you can type:

group-policy DfltGrpPolicy attributes
 vpn-filter value CLIENT-VPN-LIST

Note: I strongly recommend against Option 1.

Option 2: You can edit DefaultWEBVPNGroup so that it uses a different group-policy than the tunnel-groups for DefaultRAGroup, DefaultL2LGroup, and 10.1.1.2, so they won't be impacted.

To do so, you can type:

tunnel-group DefaultWEBVPNGroup general-attributes
 default-group-policy CLIENT-VPN-POLICY

Note: Option 2 is okay to use if you want there to be a catch-all for users that don't use a group-alias or group-url to direct them somewhere more specific, but I usually don't recommend modifying it for most setups.

Option 3: You can use the tunnel-group you already previously created, called CLIENT-VPN-GROUP, and add a group-alias to it so that users can be mapped to the appropriate policy.

To do so, you can type:

tunnel-group CLIENT-VPN-GROUP webvpn-attributes
 group-alias vpn enable

If you choose Option 3, users would then be able to access your VPN by going to a URL such as https://<public IP address>/vpn. As long as the /vpn is appended to the end, it will map the users to the tunnel-group that is configured with that alias/group and subsequently map them to the appropriate policy.

Edit: It was my mistake for forgetting that clientless VPN doesn't use vpn-filters like client VPN does, and you have to use a WebType ACL to filter traffic based on either URL or TCP-based destinations.

You can still keep the existing VPN-filter in place in case you want the same filtering on a client as well, but it can't be the same ACL since they're different types, meaning you will have 2 ACLs to maintain if you want to make modifications later. Another caveat is that WebType ACLs can't use objects or object-groups - they need to be literal.

To create a WebType ACL, you can add the following to your policy:

access-list CLIENT-VPN-LIST-WebType webtype permit tcp host 192.168.50.2 eq 3389
access-list CLIENT-VPN-LIST-WebType webtype deny tcp any
access-list CLIENT-VPN-LIST-WebType webtype deny url any

And then to add it to your existing group-policy, you can type:

group-policy CLIENT-VPN-POLICY attributes
 webvpn
  filter value CLIENT-VPN-LIST-WebType

You will need to log out of the VPN portal and back in for it to take effect.

Improve this answer
15
  • 1
    @DavidM No, it doesn’t have anything to do with the authentication method. I’m not sure you can use an IP address as a group-url at all since it expects an FQDN (which is why I suggested using a group-alias). Any particular reason why you chose to use group-url instead of group-alias?
    – Jesse P.
    Nov 21, 2021 at 12:53
  • 1
    @DavidM If you want to see which policy your VPN user is mapped to, you can see that as part of the output from show vpn-sessiondb webvpn once your user is connected. There will be a line that says Group Policy.
    – Jesse P.
    Nov 21, 2021 at 13:00
  • 1
    @DavidM It looks like you have both group-url and group-alias configured. What happens when you go to https://192.168.20.2 and then select clientvpn from the drop-down menu it should show you?
    – Jesse P.
    Nov 21, 2021 at 13:05
  • 1
    @DavidM Can you log into the VPN and then use the command I listed above to see which policy you’re being mapped to?
    – Jesse P.
    Nov 21, 2021 at 14:06
  • 1
    @DavidM Yeah. That’s good. So, give me an example of something else you’re able to hit that should be blocked by the vpn-filter.
    – Jesse P.
    Nov 21, 2021 at 14:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.