Cisco FirePOWER ASA 5500 series Configuration Manual page 575

Chapter 30 Configuring Tunnel Groups, Group Policies, and Users
hostname(config)# tunnel-group test type webvpn
hostname(config)# tunnel-group test webvpn-attributes
hostname(config-tunnel-webvpn)# customization value 123
hostname(config-tunnel-webvpn)#
Step 3 The security appliance queries NetBIOS name servers to map NetBIOS names to IP addresses. WebVPN
requires NetBIOS to access or share files on remote systems. WebVPN uses NetBIOS and the CIFS
protocol to access or share files on remote systems. When you attempt a file-sharing connection to a
Windows computer by using its computer name, the file server you specify corresponds to a specific
NetBIOS name that identifies a resource on the network.
To make the NBNS function operational, you must configure at least one NetBIOS server (host). You
can configure up to three NBNS servers for redundancy. The security appliance uses the first server on
the list for NetBIOS/CIFS name resolution. If the query fails, it uses the next server.
To specify the name of the NBNS (NetBIOS Name Service) server to use for CIFS name resolution, use
the nbns-server command. You can enter up to three server entries. The first server you configure is the
primary server, and the others are backups, for redundancy. You can also specify whether this is a master
browser (rather than just a WINS server), the timeout interval, and the number of retries. A WINS server
or a master browser is typically on the same network as the security appliance, or reachable from that
network. You must specify the timeout interval before the number of retries:
hostname(config-tunnel-webvpn)# nbns-server {host-name | IP_address} [master]
[timeout seconds] [retry number]
hostname(config-tunnel-webvpn)#
For example, to configure the server named nbnsprimary as the primary server and the server
192.168.2.2 as the secondary server, each allowing three retries and having a 5-second timeout, enter the
following command:
hostname(config)# name 192.168.2.1 nbnsprimary
hostname(config-tunnel-webvpn)# nbns-server nbnsprimary master timeout 5 retry 3
hostname(config-tunnel-webvpn)# nbns-server 192.168.2.2 timeout 5 retry 3
hostname(config-tunnel-webvpn)#
The timeout interval can range from 1 through 30 seconds (default 2), and the number of retries can be
in the range 0 through 10 (default 2).
The nbns-server command in tunnel-group webvpn-attributes configuration mode replaces the
deprecated nbns-server command in webvpn configuration mode.
To specify alternative names for the group, use the group-alias command. Specifying the group alias
Step 4
creates one or more alternate names by which the user can refer to a tunnel-group. The group alias that
you specify here appears in the drop-down list on the user's login page. Each group can have multiple
aliases or no alias, each specified in separate commands. This feature is useful when the same group is
known by several common names, such as "Devtest" and "QA".
For each group alias, enter a group-alias command. Each alias is enabled by default. You can optionally
explicitly enable or disable each alias:
hostname(config-tunnel-webvpn)# group-alias alias [enable | disable]
hostname(config-tunnel-webvpn)#
For example, to enable the aliases QA and Devtest for a tunnel-group named QA, enter the following
commands:
hostname(config-tunnel-webvpn)# group-alias QA enable
hostname(config-tunnel-webvpn)# group-alias Devtest enable
hostname(config-tunnel-webvpn)#
OL-10088-01
Cisco Security Appliance Command Line Configuration Guide
Configuring Tunnel Groups
30-21