ASA 5505 WebVPN - It has taken a while for SSL VPN Relay to load. You need to verify Java is enabled in your browser

ASA 5505
ASA Version 9.0.(2)
Suddently on the webvpn Interface when i click on my web bookmarks (and java launches in browser) i get this fail in Chrome and FF 'It has take a while for SSL VPN Relay til load. You need to verify Java is enabled in your browser' and nothing happens...
Java IS enabled and running. Tried this in both 7.45 and 7.51
No problem in IE 11 and java 7.45 and 7.51
I've googled alot but have not been able to find any suggetions
Hope you have a solution
Best Regards.

Any resolution on this? Firefox/Chrome my cifs work but smart tunnel RDP doesn't, and in IE my shares don't work but RDP smart tunnel does....
Cisco, if you're not going to do something good, just don't do it. The SSL VPN is a hack job.

Similar Messages

ASA 5505 -Can I use outside dynamic IP for webserver DMZ?

SETUP
ASA 5505
ASA Version 9.1(2)
ASDM Version 7.1(3)
I have basic license, using only three vlans (outside, inside, DMZ).
QUESTION:
I want to find a way (if possible) to use the single DYNAMIC IP (dhcp'd from ISP) on the "outside" interface, as a means to setup a web-server on the DMZ? I just want to allow my WHS-2011 (server) to talk to microsoft's free DDNS service where my domain name is hosted (ports 80,443,4125).
So far, every setup option I have tried does not make it past the implicit deny acl's (on the outside interface) to the web-server (DMZ).
I understand that the VLAN1 (inside) had to be disabled. I understand that objects now replace some of the older NAT'd components.
CONFIG:
object network webserver-external-ip
host <X.X.X.X>
! I had set this to match my ISP DHCP address
object network webserver
host 172.16.0.2
nat (DMZ,outside) static webserver-external-ip service tcp www www
nat (DMZ,outside) static webserver-external-ip service tcp 443 443
nat (DMZ,outside) static webserver-external-ip service tcp 4125 4125
access-list outside_acl extended permit tcp any object webserver eq www
access-list outside_acl_https extended permit tcp any object webserver eq 443
access-list outside_acl_rww extended permit tcp any object webserver eq 4125
access-group outside_acl in interface outside
access-group outside_acl_https in interface outside
access-group outside_acl_rww in interface outside
! added the dns statements below because the cisco doc (below) says it's required or dmz traffic can't get out despite default rule allowing it to do so.
! (ctrl-F) ... "all traffic would be blocked from the dmz to hosts on the internet"
! http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080bf150c.shtml
object network dns-server
host 8.8.8.8
exit
access-list dmz_acl extended permit udp any object dns-server eq domain
access-list dmz_acl extended permit ip any any
access-group dmz_acl in interface DMZ
SUMMARY:
I just want to allow my WHS-2011 (server) to talk to microsoft's free DDNS service where my domain name is hosted (ports 80,443,4125).
I want to find a way (if possible) to use the single DYNAMIC IP (dhcp'd from ISP) on the "outside" interface, as a means to setup a web-server on the DMZ?
Other:
As an interim alternative, I have been able to setup & connect to the ASA using clientless vpn (web-ssl), and from there getting over to my WHS2011 server...-but the problem is, I have no way of knowing, or updating my DDNS once that IP changes since the ASA keeps blocking the return traffic to theh outside interface. My only assumption is that becasue I am using a single dynamic IP (outside interface) that it has nothing to re-direct the traffic to....???
Thank You for any help you can provide!!
k/r

Hi,
I cant really help with the DDNS portion but I would imagine you already have that sorted out.
The ASA configurations however seem a bit off to me.
Here is what you should configure
STATIC PAT TO HOST SERVICES
There are some changes that need to be done to both ACL and NAT configurations. First of the NAT configurations for each port require their own "object network" to be configured.
Also since you are using a DHCP address from the ISP to act as the NAT address then you can use the keyword/parameter "interface" in the actual "nat" command. This basically tells the ASA that it should use whatever IP address is currently on the "outside" interface of the ASA. So you wont have to configure any separate "object network" for the public IP address every time it changes.
Also, with regards to the ACL configurations. You should only configure one ACL per interface in the "in" direction. So all the rules you need to configure for traffic inbound from the Internet need to be in the same ACL that you then attach to the "outside" interface with the command "access-group"
object network WEBSERVER-TCP80
host 172.16.0.2
nat (DMZ,outside) static interface service tcp www www
object network WEBSERVER-TCP443
host 172.16.0.2
nat (DMZ,outside) static interface service tcp 443 443
object network WEBSERVER-TCP4125
host 172.16.0.2
nat (DMZ,outside) static interface service tcp 4125 4125
access-list outside_acl extended permit tcp any object WEBSERVER-TCP80 eq www
access-list outside_acl extended permit tcp any object WEBSERVER-TCP443 eq https
access-list outside_acl extended permit tcp any object WEBSERVER-TCP4125 eq 4125
access-group outside_acl in interface outside
DYNAMIC PAT FOR LANs and DMZs
The above NAT configurations only handles the NAT for situations where the remote hosts on the Internet contact your DMZ server.
If you want to configure Dynamic PAT for all your LAN and DMZ users which basically enable them to use the "outside" interface public IP address for Internet traffic, then you could configure this single "nat" configuration
nat (any,outside) after-auto source dynamic any interface
This would enable Dynamic PAT for all users behind the ASA
I am not sure if you will run into problems since you are using a single public IP address and trying to forward TCP/443. This port is both used for SSL VPN and ASDM management of the ASA.
If you want to change the default port of the ASDM management you can use this command
http server enable
If you want to change the default port of SSL VPN you can use these commands
webvpn
port
Naturally before doing either of the above changes, make sure that you are not relying to them for management purposes if something was to go wrong. If you have SSH management access to the ASA then it should naturally be ok.
I am not sure if all of the above are enough to get your setup working but it should be the basics. Naturally if there is still problems after the above suggestions it might be helpfull to see the current ASA configurations. For example NAT might not work if the ordering of NAT rules is wrong even though the actual configurations are otherwise valid.
Hope this helps
Please do remember to mark a reply as the correct answer if it answered your question.
Feel free to ask more if needed
- Jouni

Anyconnect & WebVPN for ssl vpn

I already have anyconnect running in my network, planning to use Webvpn also to let specific users access the web based applications via webvpn( i believe for this they just have to put in the url and they would be prompted by SSL VPN's login page).
I followed some cisco documents but my ASA doesnt show any webvpn option on the left side pane.
Please help to set this up
Thanks.

Hi Sunny,
I attached our test config of the WebVPN of confirmed work for your reference.
HTH
Tomoyuki

Mail, I swear has taken on Nigeria for servers

Not once in 6 years have I had one false mail sent to me.
Now all of a sudden, see my Sign-in name.
Apple now forwards mail to me constantly from china
I'm tired of the lame option to bounce mail.
Not once does that option work. Iv'e been bouncing junk for 6 months.
I want severe block period if mail doesn't match my name exactly.
No wait,, this is not my job, I pay for this service.
This is starting to look like how Yahoo used to run their junk servers ten years ago.
Maybe I'm done with any of it.
<Emails Edited by Host>

Ernie,
I don't know about Tristan but I can say;
1- Previously left the SMTP servers I have (about 7 of them, mostly fully authenticated) using the 'typical ports' setting which presumably cycles between 25, 465 and 587.
2- I have had cases where 5 messages have failed to send but only 2 of them appear in the 'outbox'. In that case mail.app was showing as 'Sending' but I was unable to see what it was sending and which smtp server it was trying to use. There was no way to cancel it either (the activity window was no help).
3- I don't use 'Use this Server Only', I typically try every server I have.
The problem is that hotel ISPs typically even try to intercept SMTP over SSL, leading to Mail.app getting royally confused.
Is there any way I can get some better diagnostics on what's really happening here? I usually find that mail.app works OK until it starts trying to send a mail, so my feeling is that I should be concentrating on the SMTP stuff. I have now switched over to using port 587 (for SMTP over SSL) only in the vain hope that the hotel ISPs aren't watching that port- my suspicion is that mail.app is poking port 25 first, getting the intercepted server and then trying to use authenticated SMTP to that (spoofed) server and getting confused- that's born out by the certificate failures I often see when in hotels.
Thanks.

I cannot open any Word document or even Powerpoints or anything related to Office 2008, which has been working fine for the last 2 years. I need help...

I installed an application called "You SendIt" because some audio files were sent to me and I had to access them through it. My Mac is running Windows and OS-X. I bought an version of Office 2008 separately. I tried to uninstall it, to get rid of all my downloads and also to reinstall Office 2008 but nothing works...
Whenever I try to open a Word file, for example, it says:
"The application Microsoft Word quit unexpectedly. Mac OS-X and other applications are not affected. Click relaunch to launch the application again. CLick Report to see more details or send a report to Apple"
Of course I have tried to reset and relaunch... But it does not work. I realized today I have the same problem with Powerpoint.
I have looked at Mac help forums... but no results...
So, if you or your friend had any idea on how to solve this, it would help me A LOT!!
Thank you in advance.
Stephanie

Hi Chris,
Well, I tried to delete the Caches and I threw all the .plist files related to microsoft in the trash -- athough I don't know if this is the way to delete files but I haven't found another yet....
From your other suggestions, it seems to me that you have the impression that I want to stop using Microsoft Office (it was 2007, I made a mistake) though... but this is not the case.
So... tell me if I misunderstood correctly or if I did anything wrong, or if you have anything else to suggest...
Thanks a lot anyways!
Stephanie

I need a cable like the one that came with the iphone5-- to connect in my car-- my car has a USB port for my music?? Thank you!!

II'M a little confused on which cable I need for my car? I have the iphone5 and want to play my music in my car! Can someone please tell me which one to order??
Thanks!!
Mary

That would be this one.
http://store.apple.com/us/product/MD818ZM/A/lightning-to-usb-cable?fnode=45

Those who took a while to active then did activate, did you need the e-mail

Did you need the e-mail and have to click a link or something, or did your phone just start working? I am sitting on the computer waiting on an e-mail. Is this necessary, or will the phone just start working?
If you answer please be detailed....thanks!

The email I received was only to tell me that the activation (from T-Mobile) was in progress. They will send me another email in addition to an SMS to confirm when the process is complete.
Aside from all of that, I was able to synch my phone with all my contacts, music, etc., access my wifi, and try out the web and a few things. But I was not yet able to make/receive a call (or maybe I just didn't know what the heck I was doing).

ASA 5505 as a SSL VPN Server and Easy VPN Client at the same time?

Is it possible to configure and operate the ASA 5505 as a SSL VPN server and Easy VPN Client at the same time? We would like to configure a few of these without having to purchase additional ASA 5505 and use a 2 device method (1 SSL VPN Server and 1 Easy VPN Client). Thanks in advance.

I don't think it is possible. Following links may help you
http://www.cisco.com/en/US/products/ps6120/products_configuration_guide_chapter09186a008068dabe.html
http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a008071c428.shtml

ASA 5505 configured for WebVPN connecting to Citrix Web Interface

ASA 5505 configured for WebVPN connecting to Citrix Web Interface.
i have a ASA 5505 that I am attempting to configure for WebVPN with passthrough into Web Interface . The user authenticates into WebVPN OK and gets the option to click on the Citrix Link (which is i add bookmark citrix server http:// 172.30.40.5.) i enter the citrix and then for example i want to open to outlook it can not open. (when i want to open some application no application is open)).there is no alarm at asa. how i solve this issue?
thanks.

Teymur,
Can you confim that after disabling the ssl/tls on the Citrix server (secure connectivity) that you are getting exactly the same error. It is possible that it is generating a different error.
The bug where we have see the existing error was CSCtf06303 but that has been fixed in 8.4.1. Can you confirm the exact version of code you are running on the ASA.
If you have confirmed the above two notes it may be adventageous to open a TAC case as we may need to do some live additional troubleshooting.
Thanks
-Jay

Cisco ASA 5505 - problems getting support

My employer has an ASA 5505 device that has been here longer than any body working here. I've tried to get my hands on some updated software or support but to little avail. I've contacted Cisco support online and they keep telling me to contact my Cisco service sales representative. Now that would be fine if anybody could remember who they are. I suspect they are not even in business anymore.
Not particularly helpful at the end of the day.
I am very close to throwing in the towel with this Cisco. All I want to do is upgrade the firmware to address some known issues we are experiencing with our current firmware.
Any other avenues I am missing?

Hi Ferdinand. I don't know what a Smartnet contract is. How do I know if we have one? This ASA basically hasn't been touched for 5 years. Almost the entire staff has rotated through this company since then and nobody knowns anything. I found the invoice for it this morning after accounts searched for it, but it appears to have been purchased from a non services retailer. I contacted them and while they confirm they sold it to us they know nothing about it. They don't offer service.
What are my options?

ASA 5505 VPN Group Policies (RADIUS) and tunnel group

I have a single ASA firewall protecting a small private developing network, and I need it in order to access remotely to two distinct network spaces both of wich are VLAN tagged: 1 is LAN and 3 is management. Each net has its own IP address space and DNS server.
I'd like to set up Anyconnect to land on lan 1, and SSL VPN in order to see the IPMI and management websites sitting on VLAN 3. In order to make things "safer" I have found a free OTP solution, OpenOTP, and I decided to implement it on a virtual machine, setting up a radius bridge to allow user authentication for VPN. I can pass wichever attribute I'd like to using this radius bridge (for example "Class" or "Group-Policy" or whatever is included in the radius dictionaries).
Actually all I need is quite simple. I have to segregate my remote users in 2 groups, one for Anyconnect, and one for SSL based on the radius response from authentication. (I don't need authorization nor accounting) I'm no Cisco Pro, what I've learnt is based on direct "on the field" experience.
I'm using two radius users for testing right now, one is called "kaisaron78" associated to a group policy "RemoteAC" and a second one called "manintra" associated to a group policy called "SSLPolicy". "kaisaron78" after logging in should only see the Anyconnect "deployment portal", while "manintra" should see the webvpn portal populated with the links specified in the URL list "Management_List". However, no matter what I do, I only see the default "clean" webvpn page. This is an example of "sh vpn-sessiondb webvpn" for both users..
Session Type: WebVPN
Username     : kaisaron78             Index        : 1
Public IP    : 172.16.0.3
Protocol     : Clientless
License      : AnyConnect Premium
Encryption   : Clientless: (1)RC4     Hashing      : Clientless: (1)SHA1
Bytes Tx     : 518483                 Bytes Rx     : 37549
Group Policy : RemoteAC               Tunnel Group : DefaultWEBVPNGroup
Login Time   : 10:59:33 CEDT Mon Aug 18 2014
Duration     : 0h:00m:23s
Inactivity   : 0h:00m:00s
VLAN Mapping : N/A                    VLAN         : none
Audt Sess ID : c0a801fa0000100053f1c075
Security Grp : none
Asa5505# sh vpn-sessiondb webvpn
Session Type: WebVPN
Username     : manintra               Index        : 2
Public IP    : 172.16.0.3
Protocol     : Clientless
License      : AnyConnect Premium
Encryption   : Clientless: (1)RC4     Hashing      : Clientless: (1)SHA1
Bytes Tx     : 238914                 Bytes Rx     : 10736
Group Policy : SSLPolicy              Tunnel Group : DefaultWEBVPNGroup
Login Time   : 11:01:02 CEDT Mon Aug 18 2014
Duration     : 0h:00m:05s
Inactivity   : 0h:00m:00s
VLAN Mapping : N/A                    VLAN         : none
Audt Sess ID : c0a801fa0000200053f1c0ce
Security Grp : none
As you can see, it seems like the policies are assigned correctly by radius attribute Group-Policy. However, for example you'll notice no vlan mapping, even if I have declared them explicit in group policies themselves. This is the webvpn section of the CLI script I used to setup remote access.
! ADDRESS POOLS AND NAT
names
ip local pool AnyConnect_Pool 192.168.10.1-192.168.10.20 mask 255.255.255.0
object network NETWORK_OBJ_192.168.10.0_27
subnet 192.168.10.0 255.255.255.224
access-list Split_Tunnel_Anyconnect standard permit 192.168.1.0 255.255.255.0
nat (inside,outside) source static any any destination static NETWORK_OBJ_192.168.10.0_27 NETWORK_OBJ_192.168.10.0_27 no-proxy-arp route-lookup
! RADIUS SETUP
aaa-server OpenOTP protocol radius
aaa-server OpenOTP (inside) host 192.168.1.8
key ******
authentication-port 1812
accounting-port 1814
radius-common-pw ******
acl-netmask-convert auto-detect
webvpn
port 10443
enable outside
dtls port 10443
anyconnect image disk0:/anyconnect-win-3.1.05170-k9.pkg 1
anyconnect profiles AnyConnect_Profile_client_profile disk0:/AnyConnect_Profile_client_profile.xml
anyconnect enable
! LOCAL POLICIES
group-policy SSLPolicy internal
group-policy SSLPolicy attributes
vpn-tunnel-protocol ssl-clientless
vlan 3
dns-server value 10.5.1.5
default-domain value management.local
webvpn
url-list value Management_List
group-policy RemoteAC internal
group-policy RemoteAC attributes
vpn-tunnel-protocol ikev2 ssl-client
vlan 1
address-pools value AnyConnect_Pool
dns-server value 192.168.1.4
split-tunnel-policy tunnelspecified
split-tunnel-network-list value Split_Tunnel_Anyconnect
default-domain value home.local
webvpn
anyconnect profiles value AnyConnect_Profile_client_profile type user
group-policy SSLLockdown internal
group-policy SSLLockdown attributes
vpn-simultaneous-logins 0
! DEFAULT TUNNEL
tunnel-group DefaultRAGroup general-attributes
authentication-server-group OpenOTP
tunnel-group DefaultWEBVPNGroup general-attributes
authentication-server-group OpenOTP
tunnel-group VPN_Tunnel type remote-access
tunnel-group VPN_Tunnel general-attributes
authentication-server-group OpenOTP
default-group-policy SSLLockdown
!END
I had to set up DefaultWEBVPNGroup and RAGroup that way otherwise I couldn't authenticate using radius (login failed every time). Seems like in ASDM the VPN_Tunnel isn't assigned to AnyConnect nor to Clientless VPN client profiles. Do I have to disable both default tunnel groups and set VPN_Tunnel as default on both connections in ASDM ? I know I'm doing something wrong but I can't see where the problem is. I'm struggling since may the 2nd on this, and I really need to finish setting this up ASAP!!!!
Any help will be more than appreciated.
Cesare Giuliani

Ok, it makes sense.
Last question then I'll try and report any success / failure. In this Cisco webpage, http://www.cisco.com/c/en/us/td/docs/security/asa/asa84/configuration/guide/asa_84_cli_config/ref_extserver.html#wp1661512 there's a list of supported radius attributes. Actually I'm using number 25 Group-Policy, in order to get the correct group policy assigned to users. I see, in that list an attribute 146 Tunnel-Group-Name. Will it work out for the purpose you explained in the previous post ? I mean, if I set up two tunnel groups instead of 1, 1 for anyconnect with its own alias and its own url, and 1 for SSL VPN again with its own alias and url, do you think that using that attribute will place my users logging in into the correct tunnel group ?
Thank you again for your precious and kind help, and for your patience as well!
Cesare Giuliani

How Many Watts Do We Need? ASA 5505

My ASA 5505 getting pretty hot after a while and so I used a wattmeter to find out what´s happening.
260 watts is quite a lot if the device is running in idle mode and has no active device attached nor any config has been installed.
What's your experience of the ASA 5505 power consumption ?
Thanks

The PSU says output 48V DC 2.08A, which gives me around 100watts usage, so that would create alot of heat if the psu is burning 160 watts of in the ac/dc conversion. I have no measurements on my own, but i am definately not expecting that level of power usage

How to sync clock of Cisco ASA 5505 from NTP Server on internet

Hi there!
i've setup a site, with cisco ASA 5505. It has public ip also.
i want to sync the clock of firewall from on ntp server on internet, or with internal domain controller that is inside LAN.
The firewall has public IP also.
how can i do this?
Regards!

Hello Lasandro,
This should do it!
http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/basic_hostname_pw.html#wp1236530
Looking for some Networking Assistance?
Contact me directly at [email protected]
I will fix your problem ASAP.
Cheers,
Julio Carvajal Segura
http://laguiadelnetworking.com

Cisco ASA 5505 host license count?

Hi,
I have a ASA 5505 with base 50-user license deployed for a 15 people branch office. But recently ASA started to block internal host since license reached MAX 50.
I did show local-host on ASA and then manually filtered output in spreadsheet and there are only about 20 individual internal IP addresses.
According to Cisco,
In routed mode, hosts on the inside (Business and Home VLANs) count towards the limit when they communicate with the outside (Internet VLAN), including when the inside initiates a connection to the outside as well as when the outside initiates a connection to the inside. Note that even when the outside initiates a connection to the inside, outside hosts are not counted towards the limit; only the inside hosts count. Hosts that initiate traffic between Business and Home are also not counted towards the limit. The interface associated with the default route is considered to be the outside Internet interface. If there is no default route, hosts on all interfaces are counted toward the limit. In transparent mode, the interface with the lowest number of hosts is counted towards the host limit. See the show local-host command to view host limits.
So individual internal IP address will be counted against license on ASA, right? Then where are the other 30 hosts? The ASA is running 8.2(5).
Thanks,
/S

The 8.0 code only means that is the code that it has been reported in...doesn't necessarily mean that it is not found in the 8.2 code...but since you are not doing hairpinning this bug doesn't relate to your issue anyway.
Do your users connect their mobile phones and Tabs to the network as well? How many printers, servers, and any other none user devices connect to the network?
Please remember to select a correct answer and rate

X3500 wont work in Bridge mode with ASA 5505

Hi Everyone, I am currently running Linksys X3500 v1.0.0 and plan to use ASA 5505 as a PPPoE client. While PPPoE connection is working fine when i configure the linksys for PPoE, but When I configure the ASA 5505 to act as PPPoE client I'm unable to get the Linksys get the Internet up and running. I have opened support ticket with Cisco and per them X3500 is unable to provide PPPoE details in bridge mode. Cisco Ticket # 62968611 (PPPoE connection not working) The error on Cisco console is - asa5505# PPPoE: send_padiSnd) Dest:ffff.ffff.ffff Src:c8b3.735d.4e13 Type:0x8863=PPPoE-Discovery PPPoE: Ver:1 Type:1 Code:09=PADI Sess:0 Len:12 PPPoE: Type:0101VCNAME-Service Name Len:0 PPPoE: Type:0103:HOSTUNIQ-Host Unique Tag Len:4 PPPoE: 00000002 PPPoE: padi timer expired Can Linksys help.. What's the issue. Regards, Sumit

Hi! I'm not so familiar with the Cisco ASA 5505 device. If you set your X3500 to a Bridge Mode, it will not give any PPPoE mode details and vice versa. Which of the two devices would you like to connect to the ISP's connection, is it the X3500 or the ASA 5505?

ASA 5505 WebVPN - It has taken a while for SSL VPN Relay to load. You need to verify Java is enabled in your browser

Similar Messages

Maybe you are looking for