5
votes
Accepted
Does all IP traffic go throught a SSL VPN?
This is a feature that most VPN platforms have. It's called 'split-tunneling'.
And this is up to the VPN administrator. Some decide to send all traffic through the VPN tunnel and others don't.
- 166
4
votes
Accepted
Cisco ASA Clientless SSL VPN Restrict Network Access
What you want is called a VPN-filter. It’s just a normal extended ACL, but how you apply it is what makes it a “VPN-filter”.
So, if you want to allow your VPN subnet to only talk with something ...
- 4,670
4
votes
Do network encryption devices support KMIP / PKCS#11 for key management, or is it all done using the CLI?
SCEP (https://en.wikipedia.org/wiki/Simple_Certificate_Enrollment_Protocol) is another protocol to get CSRs from and certificates back to a large number of devices - provided they can generate their ...
- 8,122
3
votes
Accepted
Cisco ASA Clientless SSL VPN Apply Tunnel Group
Because you don't currently have any group-url or group-alias definitions on any tunnel-groups, your users will use DefaultWEBVPNGroup's settings, which use local authentication (rather than something ...
- 4,670
3
votes
Accepted
Configuring Cisco ASA DAP policies from CLI! (Automating bulk task)
From ASA 8.x Dynamic Access Policies (DAP) Deployment Guide :
Note: The dap.xml file, which contains the DAP policies selection attributes, is stored in the ASA's flash. Although you can export the ...
- 2,628
3
votes
Accepted
Can Fortinet firewall's administrator decode SSL traffic to get logging information (Gmail/Skype/RDP password)?
Whether or not a VPN tunnel is used, network administrators cannot inspect SSL traffic unless they either have access to the server's private key or use SSL deep inspection.
SSL deep inspection ...
- 78.2k
3
votes
Does all IP traffic go throught a SSL VPN?
To answer your question: it depends on how the SSL VPN profile is configured.
I cannot speak specifically to F5's client or Juniper but typically you can send all traffic or partial traffic through ...
- 1,241
3
votes
Accepted
How Do I Install My Commodo SSL Cert Into A ASA 8.3(2)?
The answer appears to be: the Commodo cert is SHA-2, which 8.3(2) doesn't support. So, either get the cert re-cut as SHA-1 (not a good idea) or upgrade to a newer firmware.
Nuts.
- 151
2
votes
Does all IP traffic go throught a SSL VPN?
A VPN just sets up a logical network interface, and traffic can be, or not, forwarded through it as a network designer sees fit, just as it can through any other router interface.
Don't confuse VPN ...
- 97.2k
2
votes
Accepted
SSL VPN Security
Many companies implement SSL VPN as the preferred method of choice for accessing internal resources securely. Mainly, the rise in SSL VPN popularity is due to the ease of deploying the software -- ...
- 14.4k
2
votes
Accepted
Cisco ASA web portal clientless VPN login issues via RSA token authentication
You are hitting the following bug:
CSCva87160 OTP authentication is not working for clientless ssl vpn
(Cisco login required)
If you want to stay on 9.1, you can go to 9.1(7.11), otherwise you ...
- 2,628
2
votes
Issues configuring SSLVPN on Cisco Router
I haven't done this since Anyconnect 2.x and IOS 12.4T so things may have changed, but one of the things I remember is that you need to upload an Anyconnect package (pkg file) to the router. Not sure ...
- 2,628
2
votes
How TCP and firewall handle security?
TCP doesn't have security. TCP creates connections between peers, and it sends segments back and forth in a handshake to create the peer connection. If your hacker tries to connect to a destination (...
- 97.2k
2
votes
Accepted
Cisco ASA, redirect Anyconnect SSL VPN to new address/url
The client just connects to an IP address so the ASA doesn't know which name the client resolved to get that IP address, and hence it cannot do any redirection.
The only 2 options I see are:
create ...
- 2,628
2
votes
Accepted
allowing udp/443 on top of tcp/443 on ASA-5505
B a r r a c u d a S S L V P N A d m i n i s t r a t o r ’ s G u i d e
- 4,349
2
votes
Accepted
ASA 5510 AnyConnect SSL VPN to Windows 3.1 client - connected but no traffic routed
If both sides indicate that there is a security association established, then it's like the encryption is working and there is some other problem.
One thing to check out is what is the default ...
- 1,125
2
votes
Do i need VLAN per customer when i want to give users (secure) access to specific customer sites
Is it possible that a user can change his VPN IP? and if it is, can we
protect this in a scalable way with having less as possible management
effort? E.g. only allow a specific IP range (e.g. 10....
- 65.2k
1
vote
Accepted
Do network encryption devices support KMIP / PKCS#11 for key management, or is it all done using the CLI?
I believe every device which supports a FIPS mode will allow generating encryption keys and certificate signing requests locally (JunOS KB example.) This allows you to avoid extracting crypto ...
- 5,354
1
vote
Disable TLS v1.0 in Cisco ISR4321/K9
The ability to specify TLS version was added in IOS-XE 16.4.1 so you will want to make sure you have that version or later.
To specify version you can use the following commands:
ip http server tls-...
1
vote
Accepted
Do i need VLAN per customer when i want to give users (secure) access to specific customer sites
Is it possible that a user can change his VPN IP?
That depends on your VPN solution. With most, it's not possible for a client to change their address. You should put that on your requirement list.
...
- 78.2k
1
vote
2FA Setup for FortiGate SSL VPN
You have the following options:
E-Mail Token: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Email-Based-two-factor-Authentication/ta-p/193019
SMS Token: https://community.fortinet.com/t5/...
- 164
1
vote
2FA Setup for FortiGate SSL VPN
You can configure email 2FA for a user like this:
#config user local
edit {username}
set type password
set two-factor email
set email-to {user_email_address}
set ...
- 78.2k
1
vote
Configuring Cisco ASA DAP policies from CLI! (Automating bulk task)
One way to find that (when you can't find documentation to point you in the right direction) is to add one via ASDM, and then go to the CLI so you can issue a show run to find where your changes show ...
- 4,670
1
vote
Need to configure site to site SSL VPN between two Cisco routers
From what I see, you want to establish a site-to-site, or LAN-to-LAN VPN from one Cisco router to another using SSL/WEB/ VPN.
Firstly, SSL VPN is a remote-access type VPN, not site to site, this is ...
1
vote
L3 core switch and VPN access
One real problem right off the bat is that your switch loopback is 10.0.0.2/24, and your statically configured default route is to 10.0.0.1/24, so all you default traffic is sent to the loopback.
You ...
- 97.2k
1
vote
Accepted
Ping from ASA over Site to Site VPN
I found a solution for this and was actually really simple.
I was running ping 192.168.78.100.
I just needed to instead run ping inside 192.168.78.100.
- 181
1
vote
Accepted
ASA Update OpenConnect Fatal SSL error
This was a bug in ASA 9.8.1. It is fixed in ASA 9.8.2 which is already available.
- 363
1
vote
SSL VPN vs IPSec, pros and cons
Pro IPsec VPN:
you can create site-to-site VPNs, allowing multiple hosts to access
a remote network at the same time
in this scenario, hosts don't need any additional software to
participate in the ...
- 880
Only top scored, non community-wiki answers of a minimum length are eligible