Example Network With Browser-Based Ssl Vpn Access - Cisco 5510 - ASA SSL / IPsec VPN Edition Getting Started Manual

Chapter 11 Scenario: SSL VPN Clientless Connections
Example Network with Browser-Based SSL VPN
Access
78-19186-01
To minimize the risks involved with SSL certificates:
Configure a group policy that consists of all users who need Clientless SSL
1.
VPN access and enable it only for that group policy.
Limit Internet access for Clientless SSL VPN users, for example, by limiting
2.
which resources a user can access using a clientless SSL VPN connection. To
do this, you could restrict the user from accessing general content on the
Internet. Then, you could configure links to specific targets on the internal
network that you want users of Clientless SSL VPN to be able to access.
Educate users. If an SSL-enabled site is not inside the private network, users
3.
should not visit this site over a Clientless SSL VPN connection. They should
open a separate browser window to visit such sites, and use that browser to
view the presented certificate.
The adaptive security appliance does not support the following features for
Clientless SSL VPN connections:
NAT, reducing the need for globally unique IP addresses.
•
PAT, permitting multiple outbound sessions appear to originate from a single
•
IP address.
Figure 11-1 shows an adaptive security appliance configured to accept SSL VPN
connection requests over the Internet using a web browser.

Example Network with Browser-Based SSL VPN Access

Cisco ASA 5500 Series Getting Started Guide
11-3