Clientless SSL VPN Smart Tunnels

Smart tunnels are the next in the evolution of application access. With smart tunnels, the requirement for a local user to have administrative rights on the client machine has now gone. The user no longer has to configure his local application settings to forward sessions to local loopback and pre-configured port, and the list of applications supported is more extensive.

Essentially, the operation of forwarding application traffic through the SSL VPN tunnel remains the same as with port forwarding and client-server plug-ins: Upon receiving the client application traffic, the ASA performs a proxy condition, and after creating a local TCP connection between itself and the application server, forwards the information to it.

The noticeable advantage smart tunnels have over client-server plug-ins is the speed in which the application operates over the tunnel (it is primarily a Java thing), and the client can make use of the full feature list available for the application. However, as with port forwarding, the drawback is that the application has to be locally installed on the remote user's PC. Therefore (and also for security reasons), smart tunnels are generally deployed to users on company- or employee-owned PCs/laptops and not those connecting from a public machine.

I prepared my ASA 5505 to allow RDP (TCP 3389) and VNC (TCP 590x) from outside network 192.168.1.0 /24 to my inside network 172.16.1.0 /24. There's a handy ping tcp command to verify if it's working.

I created a banner under Configuration > Remote Access > Clientless SSL VPN Access > Group Policies to inform outside users on which SSL VPN portal they're accesing.

Clientless SSL VPN Client-Server Plug-ins

One of the most robust and convenient way to allow application access to users is through the use of client-server plug-ins. The greatest benefit of using client-server plug-ins over the smart tunnel or port forwarding solution is connecting from anywhere using anything. This is a great benefit to users who are always out and connecting from different machines (for example, from an Internet cafe).

Because access is through a plug-in, the user does not need the full client (fat) version of the application. It operates directly within the remote user's browser, and the application traffic is sent and received through the SSL VPN tunnel to the ASA. There is also no requirement for the remote user to have administrative rights on the local PC. The ASA carries out the same action as it does for port forwarding (creates a TCP connection between itself and the application server), and then sends and receives application traffic from the server to the remote user and vice versa.

The main drawback with the plug-in solution is the lack of supported plug-ins available. The following plug-ins are currently available for download (at the time of this writing) at Cisco.com and can be imported the ASA flash:

* SSH/Telnet Client

* Citrix ICA Client

* RDP Client (used for Windows 2000 Pro, Server, and XP)

* RDP2 Client (used for Windows Vista, 7, and Server 2003 and 2008)

* VNC Client

ciscoasa(config)# import webvpn ?

exec mode commands/options:
  AnyConnect-customization  AnyConnect-customization
  customization             Configure customization file
  mst-translation           Configure MST component
  plug-in                   Configure plug-in options
  translation-table         Configure translation table
  url-list                  Configure a list of URLs for use with WebVPN
  webcontent                Configure webcontent
ciscoasa(config)# import webvpn plug-in ?

exec mode commands/options:
  protocol  Configure plug-in protocol
ciscoasa(config)# import webvpn plug-in protocol ssh ?

exec mode commands/options:
  WORD < 256 char  The URL containing data being imported
  stdin            Specifies that the data will be provided from stdin. If the
                   number of charcters is not specified after 'stdin' then the
                   data read from standard input is expected to be
                   base64-encoded followed by "\nquit\n".
ciscoasa(config)# import webvpn plug-in protocol ssh tftp://200.1.1.2/ssh.12.21.2013.jar
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

Clientless SSL VPN Port Forwarding

Port forwarding was the first method of application access deployed by Cisco for SSL VPN way back version numbers 7.x. The ASA admin must first create a new port forwarding list consisting of a name, the local forwarded port on the client machine, the remote/application server name, the application server's port, and a description. The port forwarding list is then made available through a Java applet that automatically opens when the user logs in to the SSL VPN portal or clicks the Application Access pane from within the portal and chooses Start Application Access.

Upon starting application access, a Java applet is downloaded to the client, and an entry is created in the local hosts file of the user's PC, which contains the application server's name and the local machine's loopback address. The application in use must be configured to send its traffic via the local port as configured in the port forwarding entry on the ASA. With the Java applet open, all traffic originating from Telnet is sent via the SSL tunnel to the ASA. The ASA then establishes a TCP session with the destination server and relays any application data between the client and server.

The drawbacks with this solution is that client application must be installed locally on the user's machine and it requires administrative access. It can also operate with simple applications that runs only on static TCP ports.


MY-ASA-FW(config)# webvpn
MY-ASA-FW(config-webvpn)# ?

WebVPN commands:
  anyconnect               AnyConnect configuration parameters
  anyconnect-essentials    Enable/Disable AnyConnect Essentials
  apcf                     Load Aplication Profile Customization Framework
                           (APCF) profile
  auto-signon              Configure auto-sign to allow login to certain
                           applications using the WebVPN session credentials
  cache                    Configure WebVPN cache
  certificate-group-map    Associate a tunnel-group with a certificate map rule
  character-encoding       Configures the character encoding for WebVPN portal
                           pages
  csd                      This specifies whether Cisco Secure Desktop is
                           enabled and the package file name to be used.
  default-idle-timeout     This is the default idle timeout in seconds
  default-language         Default language to use
  dtls                     Configure DTLS for WebVPN
  enable                   Enable WebVPN on the specified interface
  error-recovery           Contact TAC before using this command
  exit                     Exit from WebVPN configuration mode
  file-encoding            Configures the file encoding for a file sharing
                           server
  help                     Help for WebVPN commands
  http-proxy               This is the proxy server to use for HTTP requests
  https-proxy              This is the proxy server to use for HTTPS requests
  internal-password        Adds an option to input a different password for
                           accessing internal servers
  java-trustpoint          Configure WebVPN java trustpoint
  kcd-server               Configure an KCD-Server
  keepout                  Shows Web page when the login is disabled
  memory-size              Configure WebVPN memory size. CHECK MEMORY USAGE
                           BEFORE APPLYING THIS COMMAND. USE ONLY IF ADVISED BY
                           CISCO
  mobile-device            Configure access from mobile devices
  mus                      Configure Mobile User Security
  no                       Remove a WebVPN command or set to its default
  onscreen-keyboard        Adds WebVPN onscreen keyboard for typing password on
                           the WebVPN logon page and internal pages requiring
                           authentication
  port                     WebVPN should listen for connections on the
                           specified port
  port-forward             Configure the port-forward list for WebVPN
  portal-access-rule       Configuration related to portal access rules
  proxy-bypass             Configure proxy bypass
  rewrite                  Configure content rewriting rule
  smart-tunnel             Configure a list of programs to use smart tunnel
  sso-server               Configure an SSO Server
  tunnel-group-list        Configure WebVPN group list dropdown in login page
  tunnel-group-preference  Enable/Disable Tunnel Group Preference
MY-ASA-FW(config-webvpn)# port-forward ?

webvpn mode commands/options:
  WORD < 65 char  A name by which to identify the list of ports to be forwarded
                  via WebVPN
MY-ASA-FW(config-webvpn)# port-forward PF-TELNET ?

webvpn mode commands/options:
  <1-65535>  This is the port that the WebVPN user connects to on their local
             workstation. Enter a port number (1-65535) or port name. Use a
             port number greater than 1024 to avoid conflicts with existing
             services.
MY-ASA-FW(config-webvpn)# port-forward PF-TELNET 2300 ?

webvpn mode commands/options:
  A.B.C.D          Enter an IP address for the Remote Server
  WORD < 256 char  Enter a DNS name for the Remote Server
  X:X:X:X::X       Enter an IPv6 address for the Remote Server
MY-ASA-FW(config-webvpn)# port-forward PF-TELNET 2300 192.168.1.254 ?

webvpn mode commands/options:
  <1-65535>        This is the port on the remote server that connections to
                   the local port will be forwarded to. Enter a port number
                   (1-65535) or port name.
  aol
  bgp
  chargen
  cifs
  citrix-ica
  cmd
  ctiqbe
  daytime
  discard
  domain
  echo
  exec
  finger
  ftp
  ftp-data
  gopher
  h323
  hostname
  http
  https
  ident
  imap4
  irc
  kerberos
  klogin
  kshell
  ldap
  ldaps
  login
  lotusnotes
  lpd
  netbios-ssn
  nfs
  nntp
  pcanywhere-data
  pim-auto-rp
  pop2
  pop3
  pptp
  rsh
  rtsp
  sip
  smtp
  sqlnet
  ssh
  sunrpc
  tacacs
  talk
  telnet
  uucp
  whois
  www
MY-ASA-FW(config-webvpn)# port-forward PF-TELNET 2300 192.168.1.254 23 ?

webvpn mode commands/options:
  LINE < 65 char  A description of this port forward entry
  <cr>
MY-ASA-FW(config-webvpn)# port-forward PF-TELNET 2300 192.168.1.254 23 Telnet to R1
MY-ASA-FW(config-webvpn)# group-policy Engineering attributes
MY-ASA-FW(config-group-policy)# w?

group-policy mode commands/options:
  webvpn    wins-server

configure mode commands/options:
  wccp    webvpn

exec mode commands/options:
  webvpn-cache    who    write
MY-ASA-FW(config-group-policy)# webvpn ?

group-policy mode commands/options:
  <cr>

configure mode commands/options:
  <cr>

exec mode commands/options:
  remove  Remove cached object identified by URL
MY-ASA-FW(config-group-policy)# webvpn
MY-ASA-FW(config-group-webvpn)# ?

Group-policy WebVPN commands:
  activex-relay        Enable or disable activex relay
  always-on-vpn        Configure the always-on-vpn setting for AnyConnect
  anyconnect           AnyConnect Parameters configuration
  auto-signon          Configure auto-sign to allow login to certain
                       applications using the WebVPN session credentials
  customization        Configure a customization object
  deny-message         Configure the Deny message
  download-max-size    Set maximum object size to download
  exit                 Exit from user or group policy webvpn configuration mode
  file-browsing        Allow browsing for file servers and shares
  file-entry           Allow user entry of file server names to access
  filter               Configure the name of the webtype access-list
  help                 Help for group policy webvpn commands
  hidden-shares        CIFS hidden shares
  homepage             Configure URL of web page to be displayed upon login
  html-content-filter  Configures the content/objects to be filtered from the
                       HTML for this policy
  http-comp            HTTP Compression
  http-proxy           Controls HTTP Proxy port forwarding
  keep-alive-ignore    Maximum object size to ignore for updating the session
                       timer
  no                   Remove a command or set to its default
  port-forward         Configure the name of the Port Forwarding applet and
                       auto-download options
  post-max-size        Set maximum object size to post
  smart-tunnel         Configure smart tunnel
  sso-server           Configure SSO server name
  storage-key          Configure storage key for the data stored between
                       sessions.
  storage-objects      Configure storage objects for the data stored between
                       sessions.
  unix-auth-gid        Set the Unix group ID
  unix-auth-uid        Set the Unix user ID
  upload-max-size      Set maximum object size to upload
  url-entry            Control the ability of the user to enter any HTTP/HTTPS
                       URL
  url-list             Configure a list of WebVPN servers/URLs
  user-storage         Configure location for storing user data between
                       sessions.
MY-ASA-FW(config-group-webvpn)# port-forward ?

config-group-webvpn mode commands/options:
  auto-start  Enable and Auto Start port-forward
  disable     Disable port-forward
  enable      Enable port-forward
  name        port-forward-name
  none        (DEPRECATED) Disable port-forward
  value       (DEPRECATED) Specify a list of WebVPN forwarded ports
MY-ASA-FW(config-group-webvpn)# port-forward enable ?

config-group-webvpn mode commands/options:
  WORD < 100 char  A valid port forward list
MY-ASA-FW(config-group-webvpn)# port-forward enable PF-TELNET

Notice the Application Access appeared on the left navigation pane. Just click on the Start Application button and a pop-up window appears that runs Java. Open a command prompt and Telnet using the PC's loopback address 127.0.0.1 and the local port number defined on the ASA.

HTTP or HTTPS Bookmarks

HTTP or HTTPS bookmarks are generally used to grant access to an intranet portal (for example, a SharePoint or web mail access). These bookmarks are entered in the same format as a URL entered directly into your browser and the ASA rewrites or manages the individual bookmarks and sends them to the client browser. As a result of the rewrite, any requests for the bookmark travels to the ASA.

Whenever a user clicks an HTTPS bookmark, the ASA establishes a direct SSL session between itself and the web or mail server being accessed, and it performs the process of certificate validation on behalf of the client. The client never directly receives a copy of the server's certificate, and therefore the client cannot carry out its own verification/authentication of the server.

This is where ASDM comes in handy when importing the URL list.

Backup and Restore an ASA Config File

I was asked to backup an ASA 5510 firewall at work. This is in preparation for a possible upgrade to a 5525-X platform. A quick way to do this is via TFTP and using the write net command. We first make sure the TFTP server is reachable.

ciscoasa# ping 10.1.1.10
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.1.10, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/10 ms

ciscoasa# write ?

  erase     Clear flash memory configuration
  memory    Save active configuration to the flash
  net       Save the active configuration to the tftp server
  standby   Save the active configuration on the active unit to the flash on
            the standby unit
  terminal  Display the current active configuration
  <cr>
ciscoasa# write net ?

  WORD  IP address of tftp server and file name <tftp_ip>:<file>. Place IPv6
        address within square brackets.
  <cr>
ciscoasa# write net 10.1.1.10:fw-config   
Building configuration...
INFO: Default tftp-server not set, using highest security interface
Cryptochecksum: d18a5c1b a5542172 28c35cc0 5caa7ab3
!
[OK]


Once successfully transferred, it is preferred to open the backup file using a Word Pad. Alternatively, you can also use the more system command to view the ASA config. You can start copy and pasting the command lines to the new ASA device.

ciscoasa# more system:running-config
Cryptochecksum: d18a5c1b a5542172 28c35cc0 5caa7ab3
: Saved
: Written by enable_15 at 07:26:14.259 UTC Wed Mar 19 2014
!
ASA Version 8.4(2)
!
hostname ciscoasa
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted

<OUTPUT TRUNCATED>


To restore the ASA config, you issue the copy tftp startup-config command and perform a reload on the box.

ciscoasa# copy tftp startup-config

Address or name of remote host [10.1.1.10]?

Source filename [asdm-649.bin]? fw-config

Accessing tftp://10.1.1.10/fw-config...!
Writing system file...
!
2229 bytes copied in 0.20 secs

ciscoasa# reload
Proceed with reload? [confirm]


The same can be done using the ASDM (also restore startup-config). The ASA device uses a .zip compressed file.

Finally, reload the ASA device.