Hot answers tagged

13

The two paths I can think of are as follows: You want to use the built-in Cisco ASA secondary authentication You are open to using a radius server. The Concept for #2: Pick an authenticator. For example, Google, LDAP, AD, etc... Setup a Radius Server (FreeRADIUS, Windows NPM, Cisco ACS, etc...) that supports the authenticator. Configure the authentication ...


6

Would using Radius be an option? You can differentiate AD groups using radius attribute 25 (class). Full walk through from Jeff Boyer on the Cisco forums may be found at: https://supportforums.cisco.com/docs/DOC-15074


4

This is a feature that most VPN platforms have. It's called 'split-tunneling'. And this is up to the VPN administrator. Some decide to send all traffic through the VPN tunnel and others don't.


3

From ASA 8.x Dynamic Access Policies (DAP) Deployment Guide : Note: The dap.xml file, which contains the DAP policies selection attributes, is stored in the ASA's flash. Although you can export the dap.xml file off-box, edit it (if you know about xml syntax), and re-import it back, be very careful, because you can cause ASDM to stop processing DAP records ...


3

Whether or not a VPN tunnel is used, network administrators cannot inspect SSL traffic unless they either have access to the server's private key or use SSL deep inspection. SSL deep inspection replaces the server certificate and requires an alternative CA root certificate to be installed on all clients. You can easily detect this by inspecting the ...


3

The answer appears to be: the Commodo cert is SHA-2, which 8.3(2) doesn't support. So, either get the cert re-cut as SHA-1 (not a good idea) or upgrade to a newer firmware. Nuts.


3

Since you're not changing the netmask or default gateway I'd expect this not to be a problem at all, but I don't have the means to test this right now.


2

The definition of two factor authentication is having a variety of methods. These are the methods: What you know, like a login account's username and password What you have, like an RSA keyfob that generates numbers or a certificate file What you are, like retinal scans and fingerprint scanners Two factor authentication is not having two different login ...


2

A VPN just sets up a logical network interface, and traffic can be, or not, forwarded through it as a network designer sees fit, just as it can through any other router interface. Don't confuse VPN client software, which is really off-topic here. Some host software prevents split tunneling as a security measure.


2

To answer your question: it depends on how the SSL VPN profile is configured. I cannot speak specifically to F5's client or Juniper but typically you can send all traffic or partial traffic through the VPN. The SSL Client software may be able to tell you what "networks" or "subnets" are entering the tunnel. Cisco's AnyConnect Secure Mobility Client ...


2

You are hitting the following bug: CSCva87160 OTP authentication is not working for clientless ssl vpn (Cisco login required) If you want to stay on 9.1, you can go to 9.1(7.11), otherwise you have a choice of fixed releases: 9.1(7.11) 9.2(4.17) 9.4(3.12) 9.5(3.2) 9.6(2.1) But note that since this is a relatively recent bugfix, not all of the above ...


2

I haven't done this since Anyconnect 2.x and IOS 12.4T so things may have changed, but one of the things I remember is that you need to upload an Anyconnect package (pkg file) to the router. Not sure how it works for Android, since there is no pkg for that platform - it may be sufficient to install e.g. the Windows or Linux version. See also "AnyConnect: ...


2

The client just connects to an IP address so the ASA doesn't know which name the client resolved to get that IP address, and hence it cannot do any redirection. The only 2 options I see are: create a new profile (containing the new name) and distribute this to your users somehow out-of-band (e.g. email it to them or email them a URL where to download it) ...


2

B a r r a c u d a S S L V P N A d m i n i s t r a t o r ’ s G u i d e


2

Many companies implement SSL VPN as the preferred method of choice for accessing internal resources securely. Mainly, the rise in SSL VPN popularity is due to the ease of deploying the software -- often as simple as going to a web URL and installing the plug in that the browser automatically asks you to install. Much like installing Flash or Silverlight. ...


2

TCP doesn't have security. TCP creates connections between peers, and it sends segments back and forth in a handshake to create the peer connection. If your hacker tries to connect to a destination (TCP doesn't have clients or servers, which are application concepts), the destination would need to handshake back to the source, and the hacker doesn't actually ...


2

If both sides indicate that there is a security association established, then it's like the encryption is working and there is some other problem. One thing to check out is what is the default gateway for the machines that are on the LAN and do they have a way to route packets to 192.168.1.0/24.


1

One way to find that (when you can't find documentation to point you in the right direction) is to add one via ASDM, and then go to the CLI so you can issue a show run to find where your changes show up. If they aren't visible in the output, it may be one of the few things you have to do via ASDM (unfortunately, there are a few of those) because there is no ...


1

One real problem right off the bat is that your switch loopback is 10.0.0.2/24, and your statically configured default route is to 10.0.0.1/24, so all you default traffic is sent to the loopback. You have some serious design problems. Your switch interface to the ASA is on VLAN 1 (10.0.1.0/24), but the ASA interface is a routed interface on a different ...


1

This was a bug in ASA 9.8.1. It is fixed in ASA 9.8.2 which is already available.


1

Pro IPsec VPN: you can create site-to-site VPNs, allowing multiple hosts to access a remote network at the same time in this scenario, hosts don't need any additional software to participate in the VPN, allowing for arbitrary operating systems as long as they are able to network supports client-to-network as well, using a client software encrypted traffic ...


Only top voted, non community-wiki answers of a minimum length are eligible