Hot answers tagged

5 votes
Accepted

Does all IP traffic go throught a SSL VPN?

This is a feature that most VPN platforms have. It's called 'split-tunneling'. And this is up to the VPN administrator. Some decide to send all traffic through the VPN tunnel and others don't.
Algeriassic's user avatar
4 votes
Accepted

Cisco ASA Clientless SSL VPN Restrict Network Access

What you want is called a VPN-filter. It’s just a normal extended ACL, but how you apply it is what makes it a “VPN-filter”. So, if you want to allow your VPN subnet to only talk with something ...
Jesse P.'s user avatar
  • 4,690
4 votes

Do network encryption devices support KMIP / PKCS#11 for key management, or is it all done using the CLI?

SCEP (https://en.wikipedia.org/wiki/Simple_Certificate_Enrollment_Protocol) is another protocol to get CSRs from and certificates back to a large number of devices - provided they can generate their ...
Marc 'netztier' Luethi's user avatar
3 votes
Accepted

Cisco ASA Clientless SSL VPN Apply Tunnel Group

Because you don't currently have any group-url or group-alias definitions on any tunnel-groups, your users will use DefaultWEBVPNGroup's settings, which use local authentication (rather than something ...
Jesse P.'s user avatar
  • 4,690
3 votes
Accepted

Configuring Cisco ASA DAP policies from CLI! (Automating bulk task)

From ASA 8.x Dynamic Access Policies (DAP) Deployment Guide : Note: The dap.xml file, which contains the DAP policies selection attributes, is stored in the ASA's flash. Although you can export the ...
hertitu's user avatar
  • 2,638
3 votes
Accepted

Can Fortinet firewall's administrator decode SSL traffic to get logging information (Gmail/Skype/RDP password)?

Whether or not a VPN tunnel is used, network administrators cannot inspect SSL traffic unless they either have access to the server's private key or use SSL deep inspection. SSL deep inspection ...
Zac67's user avatar
  • 82.7k
3 votes

Does all IP traffic go throught a SSL VPN?

To answer your question: it depends on how the SSL VPN profile is configured. I cannot speak specifically to F5's client or Juniper but typically you can send all traffic or partial traffic through ...
TDurden's user avatar
  • 1,241
3 votes
Accepted

How Do I Install My Commodo SSL Cert Into A ASA 8.3(2)?

The answer appears to be: the Commodo cert is SHA-2, which 8.3(2) doesn't support. So, either get the cert re-cut as SHA-1 (not a good idea) or upgrade to a newer firmware. Nuts.
David Mackintosh's user avatar
2 votes

Does all IP traffic go throught a SSL VPN?

A VPN just sets up a logical network interface, and traffic can be, or not, forwarded through it as a network designer sees fit, just as it can through any other router interface. Don't confuse VPN ...
Ron Maupin's user avatar
  • 98.8k
2 votes
Accepted

ASA 5510 AnyConnect SSL VPN to Windows 3.1 client - connected but no traffic routed

If both sides indicate that there is a security association established, then it's like the encryption is working and there is some other problem. One thing to check out is what is the default ...
Todd Wilcox's user avatar
  • 1,135
2 votes
Accepted

Cisco ASA web portal clientless VPN login issues via RSA token authentication

You are hitting the following bug: CSCva87160 OTP authentication is not working for clientless ssl vpn (Cisco login required) If you want to stay on 9.1, you can go to 9.1(7.11), otherwise you ...
hertitu's user avatar
  • 2,638
2 votes

Issues configuring SSLVPN on Cisco Router

I haven't done this since Anyconnect 2.x and IOS 12.4T so things may have changed, but one of the things I remember is that you need to upload an Anyconnect package (pkg file) to the router. Not sure ...
hertitu's user avatar
  • 2,638
2 votes

How TCP and firewall handle security?

TCP doesn't have security. TCP creates connections between peers, and it sends segments back and forth in a handshake to create the peer connection. If your hacker tries to connect to a destination (...
Ron Maupin's user avatar
  • 98.8k
2 votes
Accepted

Cisco ASA, redirect Anyconnect SSL VPN to new address/url

The client just connects to an IP address so the ASA doesn't know which name the client resolved to get that IP address, and hence it cannot do any redirection. The only 2 options I see are: create ...
hertitu's user avatar
  • 2,638
2 votes
Accepted

allowing udp/443 on top of tcp/443 on ASA-5505

B a r r a c u d a S S L V P N A d m i n i s t r a t o r ’ s G u i d e
Ronnie Royston's user avatar
2 votes

Do i need VLAN per customer when i want to give users (secure) access to specific customer sites

Is it possible that a user can change his VPN IP? and if it is, can we protect this in a scalable way with having less as possible management effort? E.g. only allow a specific IP range (e.g. 10....
Ron Trunk's user avatar
  • 67.1k
1 vote
Accepted

Do network encryption devices support KMIP / PKCS#11 for key management, or is it all done using the CLI?

I believe every device which supports a FIPS mode will allow generating encryption keys and certificate signing requests locally (JunOS KB example.) This allows you to avoid extracting crypto ...
Jeff Wheeler's user avatar
  • 5,449
1 vote

Disable TLS v1.0 in Cisco ISR4321/K9

The ability to specify TLS version was added in IOS-XE 16.4.1 so you will want to make sure you have that version or later. To specify version you can use the following commands: ip http server tls-...
Brian Winning Jr.'s user avatar
1 vote
Accepted

Do i need VLAN per customer when i want to give users (secure) access to specific customer sites

Is it possible that a user can change his VPN IP? That depends on your VPN solution. With most, it's not possible for a client to change their address. You should put that on your requirement list. ...
Zac67's user avatar
  • 82.7k
1 vote

2FA Setup for FortiGate SSL VPN

You have the following options: E-Mail Token: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Email-Based-two-factor-Authentication/ta-p/193019 SMS Token: https://community.fortinet.com/t5/...
scherard's user avatar
  • 164
1 vote

2FA Setup for FortiGate SSL VPN

You can configure email 2FA for a user like this: #config user local edit {username} set type password set two-factor email set email-to {user_email_address} set ...
Zac67's user avatar
  • 82.7k
1 vote

Configuring Cisco ASA DAP policies from CLI! (Automating bulk task)

One way to find that (when you can't find documentation to point you in the right direction) is to add one via ASDM, and then go to the CLI so you can issue a show run to find where your changes show ...
Jesse P.'s user avatar
  • 4,690
1 vote

Need to configure site to site SSL VPN between two Cisco routers

From what I see, you want to establish a site-to-site, or LAN-to-LAN VPN from one Cisco router to another using SSL/WEB/ VPN. Firstly, SSL VPN is a remote-access type VPN, not site to site, this is ...
Emil Evlogiev's user avatar
1 vote

L3 core switch and VPN access

One real problem right off the bat is that your switch loopback is 10.0.0.2/24, and your statically configured default route is to 10.0.0.1/24, so all you default traffic is sent to the loopback. You ...
Ron Maupin's user avatar
  • 98.8k
1 vote
Accepted

Ping from ASA over Site to Site VPN

I found a solution for this and was actually really simple. I was running ping 192.168.78.100. I just needed to instead run ping inside 192.168.78.100.
Aaron D's user avatar
  • 181
1 vote
Accepted

ASA Update OpenConnect Fatal SSL error

This was a bug in ASA 9.8.1. It is fixed in ASA 9.8.2 which is already available.
SystemCookie's user avatar
1 vote

SSL VPN vs IPSec, pros and cons

Pro IPsec VPN: you can create site-to-site VPNs, allowing multiple hosts to access a remote network at the same time in this scenario, hosts don't need any additional software to participate in the ...
user1016274's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible