Hot answers tagged

5

This is a feature that most VPN platforms have. It's called 'split-tunneling'. And this is up to the VPN administrator. Some decide to send all traffic through the VPN tunnel and others don't.


4

SCEP (https://en.wikipedia.org/wiki/Simple_Certificate_Enrollment_Protocol) is another protocol to get CSRs from and certificates back to a large number of devices - provided they can generate their own key pairs, pack half of it into a CSR, an submit them using some HTTPish request. I used to run SCEP on Cisco gear for a few banks' IKEv2 based site to site ...


3

Because you don't currently have any group-url or group-alias definitions on any tunnel-groups, your users will use DefaultWEBVPNGroup's settings, which use local authentication (rather than something like RADIUS, TACACS, or LDAP) and will use the default group-policy DfltGrpPolicy. Because of this, you have 3 options. Option 1: You can edit DfltGrpPolicy so ...


3

What you want is called a VPN-filter. It’s just a normal extended ACL, but how you apply it is what makes it a “VPN-filter”. So, if you want to allow your VPN subnet to only talk with something specific, you would build an ACL such as: access-list VPN-Filter extended permit tcp 192.168.100.0 255.255.255.0 host 192.168.200.200 eq 3389 access-list VPN-Filter ...


3

From ASA 8.x Dynamic Access Policies (DAP) Deployment Guide : Note: The dap.xml file, which contains the DAP policies selection attributes, is stored in the ASA's flash. Although you can export the dap.xml file off-box, edit it (if you know about xml syntax), and re-import it back, be very careful, because you can cause ASDM to stop processing DAP records ...


3

Whether or not a VPN tunnel is used, network administrators cannot inspect SSL traffic unless they either have access to the server's private key or use SSL deep inspection. SSL deep inspection replaces the server certificate and requires an alternative CA root certificate to be installed on all clients. You can easily detect this by inspecting the ...


3

To answer your question: it depends on how the SSL VPN profile is configured. I cannot speak specifically to F5's client or Juniper but typically you can send all traffic or partial traffic through the VPN. The SSL Client software may be able to tell you what "networks" or "subnets" are entering the tunnel. Cisco's AnyConnect Secure Mobility Client ...


3

The answer appears to be: the Commodo cert is SHA-2, which 8.3(2) doesn't support. So, either get the cert re-cut as SHA-1 (not a good idea) or upgrade to a newer firmware. Nuts.


2

A VPN just sets up a logical network interface, and traffic can be, or not, forwarded through it as a network designer sees fit, just as it can through any other router interface. Don't confuse VPN client software, which is really off-topic here. Some host software prevents split tunneling as a security measure.


2

Many companies implement SSL VPN as the preferred method of choice for accessing internal resources securely. Mainly, the rise in SSL VPN popularity is due to the ease of deploying the software -- often as simple as going to a web URL and installing the plug in that the browser automatically asks you to install. Much like installing Flash or Silverlight. ...


2

The definition of two factor authentication is having a variety of methods. These are the methods: What you know, like a login account's username and password What you have, like an RSA keyfob that generates numbers or a certificate file What you are, like retinal scans and fingerprint scanners Two factor authentication is not having two different login ...


2

You are hitting the following bug: CSCva87160 OTP authentication is not working for clientless ssl vpn (Cisco login required) If you want to stay on 9.1, you can go to 9.1(7.11), otherwise you have a choice of fixed releases: 9.1(7.11) 9.2(4.17) 9.4(3.12) 9.5(3.2) 9.6(2.1) But note that since this is a relatively recent bugfix, not all of the above ...


2

I haven't done this since Anyconnect 2.x and IOS 12.4T so things may have changed, but one of the things I remember is that you need to upload an Anyconnect package (pkg file) to the router. Not sure how it works for Android, since there is no pkg for that platform - it may be sufficient to install e.g. the Windows or Linux version. See also "AnyConnect: ...


2

TCP doesn't have security. TCP creates connections between peers, and it sends segments back and forth in a handshake to create the peer connection. If your hacker tries to connect to a destination (TCP doesn't have clients or servers, which are application concepts), the destination would need to handshake back to the source, and the hacker doesn't actually ...


2

The client just connects to an IP address so the ASA doesn't know which name the client resolved to get that IP address, and hence it cannot do any redirection. The only 2 options I see are: create a new profile (containing the new name) and distribute this to your users somehow out-of-band (e.g. email it to them or email them a URL where to download it) ...


2

B a r r a c u d a S S L V P N A d m i n i s t r a t o r ’ s G u i d e


2

If both sides indicate that there is a security association established, then it's like the encryption is working and there is some other problem. One thing to check out is what is the default gateway for the machines that are on the LAN and do they have a way to route packets to 192.168.1.0/24.


2

Is it possible that a user can change his VPN IP? and if it is, can we protect this in a scalable way with having less as possible management effort? E.g. only allow a specific IP range (e.g. 10.10.10.0/24 - 10.10.10.255/24) for a specific certificate? It depends on the VPN software and configuration, but probably not. Even if they were, it would ...


1

I believe every device which supports a FIPS mode will allow generating encryption keys and certificate signing requests locally (JunOS KB example.) This allows you to avoid extracting crypto material from the device. It shouldn't be possible to be FIPS-compliant without these features. That doesn't necessarily mean they'll support specific key management ...


1

The ability to specify TLS version was added in IOS-XE 16.4.1 so you will want to make sure you have that version or later. To specify version you can use the following commands: ip http server tls-version TLSv1.2 ip http client tls-version TLSv1.2 Reference document: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/https/configuration/xe-16-5/https-xe-16-...


1

Is it possible that a user can change his VPN IP? That depends on your VPN solution. With most, it's not possible for a client to change their address. You should put that on your requirement list. and if it is, can we protect this in a scalable way with having less as possible management effort? Potentially, you could use user authentication at the ...


1

You can configure email 2FA for a user like this: #config user local edit {username} set type password set two-factor email set email-to {user_email_address} set passwd {password} next end https://kb.fortinet.com/kb/documentLink.do?externalID=FD45585 SMS or certificate authentication is also possible: https://www....


1

One way to find that (when you can't find documentation to point you in the right direction) is to add one via ASDM, and then go to the CLI so you can issue a show run to find where your changes show up. If they aren't visible in the output, it may be one of the few things you have to do via ASDM (unfortunately, there are a few of those) because there is no ...


1

One real problem right off the bat is that your switch loopback is 10.0.0.2/24, and your statically configured default route is to 10.0.0.1/24, so all you default traffic is sent to the loopback. You have some serious design problems. Your switch interface to the ASA is on VLAN 1 (10.0.1.0/24), but the ASA interface is a routed interface on a different ...


1

I found a solution for this and was actually really simple. I was running ping 192.168.78.100. I just needed to instead run ping inside 192.168.78.100.


1

This was a bug in ASA 9.8.1. It is fixed in ASA 9.8.2 which is already available.


1

Pro IPsec VPN: you can create site-to-site VPNs, allowing multiple hosts to access a remote network at the same time in this scenario, hosts don't need any additional software to participate in the VPN, allowing for arbitrary operating systems as long as they are able to network supports client-to-network as well, using a client software encrypted traffic ...


Only top voted, non community-wiki answers of a minimum length are eligible