Configuring Firewall Policies

The following example sets a URL list called FirstGroupURLs for the group policy named FirstGroup and specifies that this should be the first URL list displayed on the homepage:

hostname(config)# group-policy FirstGroup attributes hostname(config-group-policy)# webvpn hostname(config-group-webvpn)# url-list value FirstGroupURLs 1 hostname(config-group-webvpn)#

Enabling WebVPN Application Access for a Group Policy

To enable WebVPN application access for this group policy, enter the port-forward command in group-policy webvpn configuration mode. Port forwarding is disabled by default.

Before you can enter the port-forward command in group-policy webvpn configuration mode to enable application access, you must define a list of applications that you want users to be able to use in a WebVPN connection. Enter the port-forward command in global configuration mode to define this list.

To remove the port forwarding attribute from the group-policy configuration, including a null value created by issuing the port-forward none command, enter the no form of this command. The no option allows inheritance of a list from another group policy. To prevent inheriting a port forwarding list, enter the port-forward command with the none keyword. The none keyword indicates that there is no filtering. It sets a null value, thereby disallowing a filtering, and prevents inheriting filtering values.

The syntax of the command is as follows:

hostname(config-group-webvpn)# port-forward {value listname | none} hostname(config-group-webvpn)# no port-forward

The listname string following the keyword value identifies the list of applications WebVPN users can access. Enter the port-forward command in webvpn configuration mode to define the list.

Using the command a second time overrides the previous setting.

The following example shows how to set a port-forwarding list called ports1 for the internal group policy named FirstGroup:

hostname(config)# group-policy FirstGroup internal attributes hostname(config-group-policy)# webvpn hostname(config-group-webvpn)# port-forward value ports1 hostname(config-group-webvpn)#

Configuring the Port-Forwarding Display Name

Configure the display name that identifies TCP port forwarding to end users for a particular user or group policy by using the port-forward-name command in group-policy webvpn configuration mode. To delete the display name, including a null value created by using the port-forward-name none command, enter the no form of the command. The no option restores the default name, Application Access. To prevent a display name, enter the port-forward none command. The syntax of the command is as follows:

hostname(config-group-webvpn)# port-forward-name {value name | none} hostname(config-group-webvpn)# no port-forward-name

The following example shows how to set the name, Remote Access TCP Applications, for the internal group policy named FirstGroup:

hostname(config)# group-policy FirstGroup internal attributes hostname(config-group-policy)# webvpn hostname(config-group-webvpn)# port-forward-name value Remote Access TCP Applications hostname(config-group-webvpn)#

Configuring the Maximum Object Size to Ignore for Updating the Session Timer

Network devices exchange short keepalive messages to ensure that the virtual circuit between them is still active. The length of these messages can vary. The keep-alive-ignore command lets you tell the security appliance to consider all messages that are less than or equal to the specified size as keepalive messages and not as traffic when updating the session timer. The range is 0 through 900 KB. The default is 4 KB.

To specify the upper limit of the HTTP/HTTPS traffic, per transaction, to ignore, use the keep-alive-ignore command in group-policy attributes webvpn configuration mode:

hostname(config-group-webvpn)# keep-alive-ignore size hostname(config-group-webvpn)#

The no form of the command removes this specification from the configuration: hostname(config-group-webvpn)# no keep-alive-ignore hostname(config-group-webvpn)#

The following example sets the maximum size of objects to ignore as 5 KB:

hostname(config-group-webvpn)# keep-alive-ignore 5 hostname(config-group-webvpn)#

Specifying HTTP Compression

Enable compression of http data over a WebVPN connection for a specific group or user by entering the http-comp command in the group policy webvpn mode.

hostname(config-group-webvpn)# http-comp {gzip | none} hostname(config-group-webvpn)#

To remove the command from the configuration and cause the value to be inherited, use the no form of the command:

hostname(config-group-webvpn)# no http-comp {gzip | none} hostname(config-group-webvpn)#

The syntax of this command is as follows:

• gzip—Specifies compression is enabled for the group or user. This is the default value.

• none—Specifies compression is disabled for the group or user.

For WebVPN connections, the compression command configured from global configuration mode overrides the http-comp command configured in group policy and username webvpn modes.

In the following example, compression is disabled for the group-policy sales:

hostname(config)# group-policy sales attributes hostname(config-group-policy)# webvpn hostname(config-group-webvpn)# http-comp none hostname(config-group-webvpn)#

Specifying the SSO Server

Single sign-on support, available only for WebVPN, lets users access different secure services on different servers without reentering a username and password more than once. The sso-server value command, when entered in group-policy-webvpn mode, lets you assign an SSO server to a group policy.

To assign an SSO server to a group policy, use the sso-server value command in group-policy-webvpn configuration mode. This command requires that your configuration include CA SiteMinder command.

hostname(config-group-webvpn)# sso-server value server_name hostname(config-group-webvpn)#

To remove the assignment and use the default policy, use the no form of this command. To prevent inheriting the default policy, use the sso-server none command.

hostname(config-group-webvpn)# sso-server {value server_name | none} hostname(config-group-webvpn)# [no] sso-server value server_name

The default policy assigned to the SSO server is DfltGrpPolicy.

The following example creates the group policy "my-sso-grp-pol" and assigns it to the SSO server named "example":

hostname(config)# group-policy my-sso-grp-pol internal hostname(config)# group-policy my-sso-grp-pol attributes hostname(config-group-policy)# webvpn hostname(config-group-webvpn)# sso-server value example hostname(config-group-webvpn)#

Configuring SVC

The SSL VPN Client (SVC) is a VPN tunneling technology that gives remote users the benefits of an IPSec VPN client without the need for network administrators to install and configure IPSec VPN clients on remote computers. The SVC uses the SSL encryption that is already present on the remote computer as well as the WebVPN login and authentication of the security appliance.

To establish an SVC session, the remote user enters the IP address of a WebVPN interface of the security appliance in the browser, and the browser connects to that interface and displays the WebVPN login screen. If the user satisfies the login and authentication, and the security appliance identifies the user as requiring the SVC, the security appliance downloads the SVC to the remote computer. If the security appliance identifies the user as having the option to use the SVC, the security appliance downloads the SVC to the remote computer while presenting a link on the user screen to skip the SVC installation.

After downloading, the SVC installs and configures itself, and then the SVC either remains or uninstalls itself (depending on the configuration) from the remote computer when the connection terminates.

The security appliance might have several unique SVC images residing in cache memory for different remote computer operating systems. When the user attempts to connect, the security appliance can consecutively download portions of these images to the remote computer until the image and operating system match, at which point it downloads the entire SVC. You can order the SVC images to minimize connection setup time, with the first image downloaded representing the most commonly-encountered remote computer operating system. For complete information about installing and using SVC, see Chapter 38, "Configuring SSL VPN Client".

After enabling SVC, as described in Chapter 38, "Configuring SSL VPN Client", you can enable or require SVC features for a specific group. This feature is disabled by default. If you enable or require SVC, you can then enable a succession of svc commands, described in this section. To enable SVC and its related svc commands, do the following steps in group-policy webvpn configuration mode:

Step 1 To enable the security appliance to download SVC files to remote computers, enter the svc enable command. By default, this command is disabled. The security appliance does not download SVC files. To remove the svc enable command from the configuration, use the no form of this command.

hostname(config-group-webvpn)# svc {none I enable I required}

hostname(config-group-webvpn)# ^ _

Note Entering the no svc enable command does not terminate active SVC sessions.

hostname(config)# group-policy sales attributes hostname(config-group-policy)# webvpn hostname(config-group-webvpn)# svc enable hostname(config-group-webvpn)#

Step 2 To enable compression of HTTP data over an SVC connection, for a specific group, enter the svc compression command. By default, SVC compression is set to deflate (enabled). To disable compression for a specific group, use the none keyword. To remove the svc compression command and cause the value to be inherited, use the no form of the command:

hostname(config-group-webvpn)# svc compression {deflate | none} hostname(config-group-webvpn)#

The following example disables SVC compression for the group policy named sales:

hostname(config)# group-policy sales attributes hostname(config-group-policy)# webvpn hostname(config-group-webvpn)# svc compression none hostname(config-group-webvpn)#

Step 3 To enable dead-peer-detection (DPD) on the security appliance and to set the frequency with which either the SVC or the security appliance performs DPD, use the svc dpd-interval command. To remove the svc dpd-interval command from the configuration, use the no form of the command. To disable SVC DPD for this group, use the none keyword:

hostname(config-group-webvpn)# svc dpd-interval {[gateway {seconds | none}] | [client

hostname(config-group-webvpn)#

DPD checking is disabled by default.

The gateway refers to the security appliance. You can specify the frequency with which the security appliance performs the DPD test as a range of from 30 to 3600 seconds (1 hour). Specifying none disables the DPD testing that the security appliance performs.

The client refers to the SVC. You can specify the frequency with which the client performs the DPD test as a range of from 30 to 3600 seconds (1 hour). Specifying none disables the DPD testing that the client performs.

In the following example, the user configures the DPD frequency performed by the security appliance (gateway) to 3000 seconds, and the DPD frequency performed by the client to 1000 seconds for the existing group policy named sales:

hostname(config)# group-policy sales attributes hostname(config-group-policy)# webvpn hostname(config-group-webvpn)# svc dpd-interval gateway 3000 hostname(config-group-webvpn)# svc dpd-interval client 1000 hostname(config-group-webvpn)#

Step 4 You can adjust the frequency of keepalive messages (specified by seconds), to ensure that an SVC

connection through a proxy, firewall, or NAT device remains open, even if the device limits the time that the connection can be idle.

Adjusting the frequency also ensures that the SVC does not disconnect and reconnect when the remote user is not actively running a socket-based application, such as Microsoft Outlook or Microsoft Internet Explorer.

To configure the frequency (15 through 600 seconds) which an SVC on a remote computer sends keepalive messages to the security appliance, use the svc keepalive command. Use the no form of the command to remove the command from the configuration and cause the value to be inherited:

hostname(config-group-webvpn)# svc keepalive {none | seconds} hostname(config-group-webvpn)# no svc keepalive {none | seconds} hostname(config-group-webvpn)#

SVC keepalives are disabled by default. Using the keyword none disables SVC keepalive messages.

The following example configures the security appliance to enable the SVC to send keepalive messages, with a frequency of 300 seconds (5 minutes):

hostname(config-group-webvpn)# svc keepalive 300 hostname(config-group-webvpn)#

Step 5 To enable the permanent installation of an SVC onto a remote computer, use the svc keep-installer command with the installed keyword. To remove the command from the configuration, use the no form of this command:

hostname(config-group-webvpn)# svc keep-installer {installed | none} hostname(config-group-webvpn)# no svc keep-installer {installed | none} hostname(config-group-webvpn)#

The default is that permanent installation of the SVC is disabled. The SVC uninstalls from the remote computer at the end of the SVC session.

The following example configures the security appliance to keep the SVC installed on the remote computer for this group:

hostname(config-group-webvpn)# svc keep-installer installed hostname(config-group-webvpn)#

Step 6 To enable the SVC to perform a rekey on an SVC session, use the svc rekey command. To disable rekey and remove the command from the configuration, use the no form of this command:

hostname(config-group-webvpn)# svc rekey {method {ssl | new-tunnel} | time minutes | none}}

hostname(config-group-webvpn)# no svc rekey {method {ssl | new-tunnel} | time minutes | none}}

hostname(config-group-webvpn)#

By default, SVC rekey is disabled.

Specifying the method as new-tunnel specifies that the SVC establishes a new tunnel during SVC rekey. Specifying the method as none disables SVC rekey. Specifying the method as ssl specifies that SSL renegotiation takes place during SVC rekey. instead of specifying the method, you can specify the time; that is, the number of minutes from the start of the session until the re-key takes place, from 1 through 10080 (1 week).

For the no form of the command, only the minimum is necessary, as the following example shows:

hostname(config-username-webvpn)# no svc rekey method hostname(config-username-webvpn)#

If, however, you specify the method as new-tunnel:

hostname(config-username-webvpn)# no svc rekey method new-tunnel hostname(config-username-webvpn)#

but the current method is ssl, then the command fails, because the values don't match.

In the following example, the user configures the SVC to renegotiate with SSL during rekey and configures the rekey to occur 30 minutes after the session begins:

hostname(config-group-webvpn)# svc rekey method ssl hostname(config-group-webvpn)# svc rekey time 30 hostname(config-group-webvpn)#

Was this article helpful?