Monitoring and Troubleshooting Ssl Vpn
The following sections discuss the monitoring and troubleshooting steps that are available to help you in running the SSL VPN solution smoothly on a security appliance.
Monitoring SSL VPN
To monitor the WebVPN sessions, first check how many active SSL VPN tunnels are established on the security appliance. You can do this by choosing Monitoring > VPN > VPN Statistics > Sessions. The security appliance shows you all the active VPN sessions, including the clientless and full tunnel client connections. As shown in Figure 5-67, an active clientless connection is created by a user called sslvpnuser. The user computer's IP address is 209.165.200.230, and the negotiated encryption type is RC4. The security appliance has received 75,283 bytes of traffic, whereas it has transmitted 153,387 bytes of data to the client. The user is connected for just over a minute. Should you prefer to get detailed information about a user's connection, select that specific user session and then click the Details button.
Figure 5-67 Monitoring SSL VPN Sessions Through ASDM
Figure 5-67 Monitoring SSL VPN Sessions Through ASDM
To view the DAP policies that are configured on the security appliance in Lua, issue the debug menu dap 2 command, as shown in Example 5-12. Two DAP records are configured: Clientless-DAP and Contractors-DAP. Example 5-12 debug menu dap Command
Chicago# debug menu dap 2
DAP record [ Clientless-DAP ]:
(EVAL(aaa.ldap.memberOf,"EQ","Employees","string") or EVAL(aaa.cisco.tunnelgroup,"EQ","SecureMeClientlessTunnel","string")) and ((EVAL(endpoint.os.version,"EQ","Windows XP","string") and EVAL(endpoint.os.servicepack,"EQ","2","integer"))) and ((EVAL(endpoint.policy.location,"EQ","Corp-Owned","string")))
DAP record [ Contractors-DAP ]:
(EVAL(aaa.radius["25"],"EQ","Contractors","string") and EVAL(aaa.cisco.tunnelgroup,"EQ","SecureMeClientlessTunnel","string")) and ((EVAL(endpoint.fw.McAfeeFW.exists,"EQ","true","string") and
EVAL(endpoint.fw.McAfeeFW.description,"EQ","McAfee Desktop Firewall","string"))) Chicago#
Additionally, if you want to monitor user sessions through syslogs, you can enable the webvpn, svc, csd, and dap classes. These classes are useful for understanding how users are getting authenticated, what information is being collected, and what type of attributes and policies are being applied on their sessions. As shown in Example 5-13, the administrator is collecting debug-level information for the webvpn, svc, csd, and dap classes. The syslog messages are being collected in the local buffer of the security appliance. Based on the syslog messages, an sslvpn user tries to connect to the SecureMeClientlessTunnel tunnel group. CSD determines that the host connects from the Internet cafe location, and the security appliance applies a DAP called Contractors-DAP. The user session is successfully authenticated, and the user is allowed to connect through a clientless SSL VPN (WebVPN) tunnel.
Example 5-13 class Syslog Commands
|
Chicago# show log |
||||
|
Chicago# logging enable |
||||
|
Chicago# logging buffer-size 1048576 |
||||
|
Chicago# logging class webvpn buffered debugging |
||||
|
Chicago# logging class svc buffered debugging |
||||
|
Chicago# logging class csd buffered debugging |
||||
|
Chicago# logging class dap buffered debugging |
||||
|
Syslog logging: enabled |
||||
|
Facility: 20 |
||||
|
Timestamp logging: disabled |
||||
|
Standby logging: disabled |
||||
|
Deny Conn when Queue Full: disabled |
||||
|
Console logging: disabled |
||||
|
Monitor logging: disabled |
||||
|
Buffer logging: class webvpn svc csd dap, 133 messages logged |
||||
|
Trap logging: disabled |
||||
|
History logging: disabled |
||||
|
Device ID: disabled |
||||
|
Mail logging: disabled |
||||
|
ASDM logging: disabled |
||||
|
%ASA-7-734003: DAP: User sslvpnuser, Addr 209.165 |
200 |
230: |
Session |
Attribute |
|
aaa.cisco.username = sslvpnuser |
||||
|
%ASA-7-734003: DAP: User sslvpnuser, Addr 209.165 |
200 |
230: |
Session |
Attribute |
|
aaa.cisco.tunnelgroup = SecureMeClientlessTunnel |
||||
|
%ASA-7-734003: DAP: User sslvpnuser, Addr 209.165 |
200 |
230: |
Session |
Attribute |
|
endpoint.os.version = "Windows XP" |
||||
|
%ASA-7-734003: DAP: User sslvpnuser, Addr 209.165 |
200 |
230: |
Session |
Attribute |
|
endpoint.os.servicepack = "2" |
||||
|
%ASA-7-734003: DAP: User sslvpnuser, Addr 209.165 |
200 |
230: |
Session |
Attribute |
|
endpoint.policy.location = "InternetCafe" |
||||
|
%ASA-7-734003: DAP: User sslvpnuser, Addr 209.165 |
200 |
230: |
Session |
Attribute |
|
endpoint.protection = "secure desktop" |
||||
|
<snip> |
||||
|
%ASA-7-734003: DAP: User sslvpnuser, Addr 209.165 |
200 |
230: |
Session |
Attribute |
|
endpoint.enforce = "success" |
||||
|
%ASA-6-734001: DAP: User sslvpnuser, Addr 209.165 |
200 |
230, |
Connection Clientless: |
|
|
The following DAP records were selected for this |
connection: Contractors-DAP |
|||
|
%ASA-6-716001: Group <ClientlessGroupPolicy> User <sslvpnuser> IP |
||||
|
<209.165.200.230> WebVPN session started. |
||||
|
%ASA-6-716038: Group <ClientlessGroupPolicy> User <sslvpnuser> IP <209.165.200.230> |
||||
|
Authentication: successful, Session Type: WebVPN |
||||
NOTE The debug-level syslogs should be used if you are monitoring sessions in a lab environment.
They should be used only for troubleshooting in the production environment and should be disabled when you have collected the necessary information.
Continue reading here: Initial Connectivity Issues
Was this article helpful?