mopdf.com

LicensingInformation About SSL VPNwith each license, and the count indicates the instances of the feature available for use in the system. In thecase of SSL VPN, a seat refers to the maximum number of sessions allowed at a time.You can get the license at http://www.cisco.com/go/license.For instructions on installing a license using Cisco License Manager (CLM), see the User Guide for CiscoLicense Manager, Release 2.2 at http://www.cisco.com/en/US/docs/net mgmt/license manager/lm 2 2/2.2 user guide/clm book.html.For instructions on installing a license using Cisco CLI, see the “Cisco IOS Software Activation Tasks andCommands” chapter of the Software Activation Configuration Guide at ion/guide/csa commands ps6441 TSD Products Configuration Guide Chapter.html.SSL VPN supports the following types of licenses: Permanent licenses--No usage period is associated with these licenses. All permanent licenses are nodelocked and validated during installation and usage.Evaluation licenses--These are metered licenses that are valid for a limited period. The usage period ofa license is based on a system clock. The evaluation licenses are built into the image and are not nodelocked. The evaluation licenses are used only when there are no permanent, extension or grace periodlicenses available for a feature. An end-user license agreement (EULA) has to be accepted beforeusing an evaluation license.Extension licenses--Extension licenses are node-locked metered licenses. These licenses are installedusing the management interfaces on the device. A EULA has to be accepted as part of installation.Grace-rehost licenses--Grace period licenses are node locked metered licenses. These licenses areinstalled on the device as part of the rehost operation. A EULA has to be accepted as a part of therehost operation.For all the license types, except the evaluation license, a EULA has to be accepted during the licenseinstallation. This means that all the license types except the evaluation license are activated afterinstallation. In the case of an evaluation license, a EULA is presented during an SSL VPN gatewayconfiguration or an SSL VPN context configuration.An SSL VPN session corresponds to a successful login to the SSL VPN service. An SSL VPN session iscreated when a valid license is installed and the user credentials are successfully validated. On a successfuluser validation, a request is made to the licensing module to get a seat. An SSL VPN session is created onlywhen the request is successful. If a valid license is not installed, the SSL VPN gateway configuration andSSL VPN context configurations are successful, but the user cannot login successfully. When multiplegateways and contexts are configured, the total number of sessions are equal to the total sessions allowedby the license.The same user can create multiple sessions and for each session a seat count is reserved. The seatreservation does not happen in the following cases: Multiple TCP connections such as web server content, Outlook Web Access (OWA) and CommonIntermediate Format (CIF) file shares.Port forward session initiation.Full tunnel session creation from a browser session.Full tunnel session is up and a crypto rekey is done.When the total active sessions are equal to the maximum license count of the current active license, nomore new sessions are allowed.The reserved seat count or session is released when 6a user logs out.a Dead Peer Detection (DPD) failure happens.

Modes of Remote AccessRemote Access Overview a session timeout occurs.an idle timeout occurs.a session is cleared administratively using the clear webvpn session command.disconnected from the tunnel.context is removed even when there are active sessions.You can use the show webvpn license command to display the available count and the current usage. Todisplay the current license type and time period left in case of a nonpermanent license, use the show licensecommand. To get information related to license operations, events, and errors, use the debug webvpnlicense command.For migrating from any Cisco IOS 12.4T release to Cisco IOS 15.x release, use the license migration tool dminServlet/migrateLicense.New Cisco IOS SSL VPN licenses that are generated are cumulative. Therefore the old licenses becomeinactive when a new license is applied. For example, when you are upgrading your license from 10 countsto 20 counts (an increase of 10 counts on the current 10 counts), Cisco provides a single 20 count license.The old license for 10 counts is not required when a permanent license for a higher count is available.However, the old license will exist in an inactive state as there is no reliable method to clear the old license.In Cisco IOS Release 15.1(4)M1 and later releases, a Crypto Export Restrictions Manager (CERM) licenseis reserved only after the user logs in. If you have an Integrated Services Router Generation 2 (ISR G2)router with a CERM license, you must upgrade to Cisco IOS Release 15.1(4)M1 or later releases. BeforeCisco IOS Release 15.1(4)M1, a CERM license is reserved for every SSL or Transport Layer Security(TLS) session.Modes of Remote Access Remote Access Overview, page 7Clientless Mode, page 8Thin-Client Mode, page 9Tunnel Mode, page 11Remote Access OverviewEnd-user login and authentication is performed by the web browser to the secure gateway using an HTTPrequest. This process creates a session that is referenced by a cookie. After authentication, the remote useris shown a portal page that allows access to the SSL VPN networks. All requests sent by the browserinclude the authentication cookie. The portal page provides all the resources available on the internalnetworks. For example, the portal page could provide a link to allow the remote user to download andinstall a thin-client Java applet (for TCP port forwarding) or a tunneling client.7

Modes of Remote AccessClientless ModeThe figure below shows an overview of the remote access modes.Figure 2Modes of Remote Access OverviewThe following table summarizes the level of SSL VPN support that is provided by each access mode.Table 1Access Mode SummaryA-- ClientlessMode Browser-based(clientless)MicrosoftWindows orLinuxWeb-enabledapplications,file sharing,Outlook WebAccessGatewayperformsaddress orprotocolconversionand contentparsing andrewritingB--Thin-Client Mode TCP port forwardingUses Java AppletExtends application supportTelnet, e-mail, SSH, MeetingMaker, Sametime ConnectStatic port-based applicationsC--Tunnel Mode Works like “clientless” IPsec VPNTunnel client loaded through Javaor ActiveX (approximately 500 kB)Application agnostic--supports allIP-based applicationsScalableLocal administrative permissionsrequired for installationClientless ModeIn clientless mode, the remote user accesses the internal or corporate network using the web browser on theclient machine. The PC of the remote user must run the Windows 2000, Windows XP, or Linux operatingsystems.The following applications are supported in clientless mode:8

Modes of Remote AccessThin-Client Mode Web browsing (using HTTP and HTTPS)--provides a URL box and a list of web server links in theportal page that allows the remote user to browse the web.File sharing (using common Internet file system [CIFS])--provides a list of file server links in theportal page that allows the remote user to do the following operations: NoteBrowse a network (listing of domains)Browse a domain (listing of servers)Browse a server (listing of shares)List the files in a shareCreate a new fileCreate a directoryRename a directoryUpdate a fileDownload a fileRemove a fileRename a fileLinux requires that the Samba application is installed before CIFS file shares can be remotely accessed. Web-based e-mail, such as Microsoft Outlook Web Access (OWA) 2003 (using HTTP and HTTPS)with Web Distributed Authoring and Versioning (WebDAV) extensions--provides a link that allowsthe remote user to connect to the exchange server and read web-based e-mail.Thin-Client ModeThin-client mode, also called TCP port forwarding, assumes that the client application uses TCP to connectto a well-known server and port. In thin-client mode, the remote user downloads a Java applet by clickingthe link provided on the portal page, or the Java applet is downloaded automatically (see the Options forConfiguring HTTP Proxy and the Portal Page, page 10 section). The Java applet acts as a TCP proxy onthe client machine for the services that you configure on the gateway.The applications that are supported in thin-client mode are mainly e-mail-based (SMTP, POP3, and InternetMap Access Protocol version 4 [IMAP4]) applications.NoteThe TCP port-forwarding proxy works only with the Sun Microsystems Java Runtime Environment (JRE)version 1.4 or later versions. A Java applet is loaded through the browser that verifies the JRE version. TheJava applet will refuse to run if a compatible JRE version is not detected.The Java applet initiates an HTTP request from the remote user client to the SSL VPN gateway. The nameand port number of the internal e-mail server is included in the HTTP request (POST or CONNECT). TheSSL VPN gateway creates a TCP connection to that internal e-mail server and port.The Java applet starts a new SSL connection for every client connection.You should observe the following restrictions when using thin-client mode: The remote user must allow the Java applet to download and install.You cannot use thin-client mode for applications such as FTP, where the ports are negotiateddynamically. You can use TCP port forwarding only with static ports.9

Modes of Remote AccessOptions for Configuring HTTP Proxy and the Portal PageNoteThere is a known compatibility issue with the encryption type and Java. If the Java port-forwarding appletdoes not download properly and the configuration line ssl encryption 3des-sha1 aes-sha1 is present, youshould remove the line from the WebVPN gateway subconfiguration. Options for Configuring HTTP Proxy and the Portal Page, page 10Options for Configuring HTTP Proxy and the Portal PageEffective with Cisco IOS Release 12.4(11)T, administrators have more options for configuring the HTTPproxy and the portal page. If HTTP proxy is enabled, the Java applet acts as the proxy for the browser ofthe user, thereby connecting the client workstation with the gateway. The home page of the user (as definedby the user group) is opened automatically or, if configured by the administrator, the user is directed to anew website.HTTP proxy supports both HTTP and HTTPS.Benefits of Configuring HTTP ProxyHTTP supports all client-side web technologies (including HTML, Cascading Style Sheets [CSS],JavaScript, VBScript, ActiveX, Java, and flash), HTTP Digest authentication, and client certificateauthentication. Remote users can use their own bookmarks, and there is no limit on cookies. Because thereis no mangling involved and the client can cache the objects, performance is much improved over previousoptions for configuring the HTTP proxy and portal page.Illustrations of Port Forwarding with and Without an HTTP Proxy ConfigurationThe figure below illustrates TCP port forwarding without HTTP proxy configured.Figure 3TCP Port Forwarding Without HTTP Proxy ConfiguredIn the figure above, the following steps occur:1 User downloads the proxy applet.2 Applet updates the registry to add HTTP as a Remote Procedure Call (RPC) transport.3 Applet examines the registry to determine the exchange (and local catalog) server and create serverentries that refer to those servers.10

Modes of Remote AccessTunnel Mode45678910Applet opens local port 80 and listens for connections.User starts Outlook, and Outlook connects to 10.0.0.254:80.Applet opens a connection to the secure gateway and delivers the requests from Outlook.Secure gateway examines the requests to determine the endpoint exchange server.Data flows from Outlook, through the applet and the secure gateway, to the exchange server.User terminates Outlook.User closes the applet. Before closing, the applet undoes configuration Steps 3 and 4.The figure below illustrates TCP port forwarding when HTTP proxy is configured.Figure 4HTTP ProxyIn the figure above, the following steps occur:1 Proxy applet is downloaded automatically.2 Applet saves the original proxy configuration of the browser.3 Applet updates the proxy configuration of the browser to be the local loopback address with anavailable local port (by default, port 8080).4 Applet opens the available local port and listens for connections.5 Applet, if so configured, opens the home page of the user, or the user browses to a new website.6 Applet accepts and looks at the HTTP or HTTPS request to determine the destination web server.7 Applet opens a connection to the secure gateway and delivers the requests from the browser.8 Secure gateway examines the requests to determine the endpoint web server.9 Data flows from the browser, through the applet and the secure gateway, to the web server.10 User closes applet. Before closing, the applet undoes configuration Steps 2 and 3.NoteHTTP proxy can also be enabled on an authentication, authorization, and accounting (AAA) server. See thetable SSL VPN RADIUS Attribute-Value Pairs in the Configuring RADIUS Attribute Support for SSLVPN, page 51 section (port-forward-http-proxy and port-forward-http-proxy-url attributes).Tunnel ModeIn a typical clientless remote access scenario, remote users establish an SSL tunnel to move data to andfrom the internal networks at the application layer (for example, web and e-mail). In tunnel mode, remoteusers use an SSL tunnel to move data at the network (IP) layer. Therefore, tunnel mode supports most IP-11

SSL VPN FeaturesAccess Control Enhancementsbased applications. Tunnel mode supports many popular corporate applications (for example, MicrosoftOutlook, Microsoft Exchange, Lotus Notes E-mail, and Telnet).The tunnel connection is determined by the group policy configuration. The Cisco AnyConnect VPN Clientis downloaded and installed on the remote user PC, and the tunnel connection is established when theremote user logs into the SSL VPN gateway.By default, the Cisco AnyConnect VPN Client is removed from the client PC after the connection is closed.However, you have the option to keep the Cisco AnyConnect VPN Client installed on the client PC.SSL VPN Features Access Control Enhancements, page 12SSL VPN Client-Side Certificate-Based Authentication, page 13AnyConnect Client Support, page 14Application ACL Support, page 14Automatic Applet Download, page 14Backend HTTP Proxy, page 15Front-Door VRF Support, page 15Full-Tunnel Cisco Express Forwarding Support, page 16GUI Enhancements, page 16Internationalization, page 21Max-User Limit Message, page 23Netegrity Cookie-Based Single SignOn Support, page 23NTLM Authentication, page 23RADIUS Accounting, page 23Stateless High Availability with Hot Standby Router Protocol, page 23TCP Port Forwarding and Thin Client, page 24URL Obfuscation, page 26URL Rewrite Splitter, page 27User-Level Bookmarking, page 27Virtual Templates, page 27License String Support for the 7900 VPN Client, page 27SSLVPN DVTI Support, page 27SSL VPN Phase-4 Features, page 29DTLS Support for IOS SSL VPN, page 29Cisco AnyConnect VPN Client Full Tunnel Support, page 30Access Control EnhancementsEffective with Cisco IOS Release 12.4(20)T, administrators can configure automatic authentication andauthorization for users. Users provide their usernames and passwords via the gateway page URL and do nothave to reenter their usernames and passwords from the login page. Authorization is enhanced to supportmore generic authorization, including local authorization. In previous releases, only RADIUS authorizationwas supported.For information about configuring this feature, see the Configuring Automatic Authentication andAuthorization, page 88 section.12

SSL VPN FeaturesSSL VPN Client-Side Certificate-Based AuthenticationSSL VPN Client-Side Certificate-Based AuthenticationThis feature enables SSL VPN to authenticate clients based on the client’s AAA username and passwordand also supports WebVPN gateway authentication of clients using AAA certificates.SSL VPN Client-Side Certificate-Based Authentication feature includes the following features: Certificate-Only Authentication and Authorization Mode, page 13 Two-Factor Authentication and Authorization Mode, page 13 Identification of WebVPN Context at Runtime Using Certificate Map Match Rules, page 13 Support for AnyConnect Client to Implement Certificate Matching Based on Client ProfileAttributes, page 13Certificate-Only Authentication and Authorization ModeCertificate-only authorization requires the user to provide a AAA authentication certificate as part of theWebVPN request, but does not require the username and password for authorization. The user requestsWebVPN access with the AAA authentication certificate from the WebVPN gateway. The WebVPNgateway validates the identity of the client using the AAA authentication certificate presented to it. TheWebVPN extracts the username from the AAA authentication certificate presented to it and uses it as theusername in the AAA request. AAA authentication and AAA authorization are then completed with a hardcoded password. To configure certificate-only authorization use the authentication certificate command.Two-Factor Authentication and Authorization ModeTwo-factor authorization requires the user to request WebVPN access and present a AAA authenticationcertificate. The AAA authentication certificate is validated and the client’s identity is verified. TheWebVPN gateway then presents the login page to the user. The user enters their username and passwordand WebVPN sends AAA authentication and AAA authorization requests to the AAA server. The AAAauthentication list and the AAA authorization lists configured on the server are then used for authenticationand authorization. To configure two-factor authentication and authorization mode use the authenticationcertificate aaa command.NoteIf the username-prefill command is configured, the username textbox on the login page will be disabled.The user will be asked only for their password on the login page.Identification of WebVPN Context at Runtime Using Certificate Map Match RulesCertificate map match rules are used by SSL VPN to identify the WebVPN context at runtime. TheWebVPN context is required for AAA authentication and authorization mode and trustpoint configuration.When the user does not provide the WebVPN context, the identification of the WebVPN context at runtimeis possible using certificate map matching by matching the certificate presented by the client with thecertificate map match rules. To configure certificate map matching in WebVPN use the match-certificatecommand.Support for AnyConnect Client to Implement Certificate Matching Based on Client Profile AttributesCisco AnyConnect client has certificate match functionality allowing it to select a suitable certificate whileinitiating tunnel connection with SSL VPN. In the case of standalone mode, the certificate selection ismade based on the certificate match. When selecting a certificate, Cisco AnyConnect client can select the13

SSL VPN FeaturesAnyConnect Client Supportappropriate certificate based on the AnyConnect client profile attributes. This requires SSL VPN to supportAnyConnect client profiles. The profile file is imported after modification by the administrator using thesvc profile command. To create an AnyConnect client profile use the template that appears after installingCisco AnyConnect in this location: \Documents and Settings\All Users\Application Data\Cisco\Cis

Oct 19, 2011 · SSL VPN Last Updated: October 19, 2011 The SSL VPN feature (also known as WebVPN) provides support, in Cisco IOS software, for remote user access to enterprise networks from anywhere on the Internet. Remote access is provided through a Secure Socket Layer (SSL)-enabled SSL VPN gateway. The SS