Cut-through authentication vs. virtual telnet/http

Question

Hi,
I'm having difficulties understanding the meaning of the virtual telnet/http commands on the ASA.
I have configured an ASA and defined an access-list with all the traffic which is to be authenticated. These are protocols like RDP, which can't be intercepted by the ASA, but also HTTP and HTTPS which can indeed be intercepted (this is also referred as cut-trough authentication).
The setup principially works. Then a few consultants came and checked my config for errors. They also performed a portscan, where they found out that all protected services (which should only work after authenticating) were answered by the ASA (a tcp-session was started), so an attacker would know what potential services are behind the firewall.
The customer (and me) disliked this behaviour, and I thought this could be solved by using the virtual http feature. Define a seperate IP-Adress, to which you can connect via HTTPs and authenticate, after which you can reach all other services.
Can this be done with this feature? My testresults showed just the behaviour, that you can authenticate at the virtual http-address, but the cut-through authentication is still active, so that's not the solution.
To be honest, I even believe that the virtual telnet/http feature is completely useless! Why? Because to make it work, you have to
1) allow the ip an the inbound ACL
2) add the ip in the ACL where the authenticated traffic is defined
3) configure a NAT for this ip to be routed inside
I don't really see a practical reason for this command - Thanks for your thought...
Florian

Answer 1

Hi Florian / Jeff
I agree largely with what you are saying and have found similiar issues with it. if you are already authenticating to a web service the additional config of a virtual http service seems unnecessary.
But i think one instance where virtual telnet is useful is if you have services such as RDP etc. that you need to authenticate but you don't have a web server or telnet server to authenticate against.
Without virtual telnet i'm not sure how you could setup access to these services so you would need virtual telnet in this case.
Where i find the command particularly useless is that i want to authenticate people accessing for example terminal servers on a particular subnet. This subnet is also running web servers.
Now say i want to do this via http authentication. I'm trying to authentciate them because i don't know their IP addresses. So i enter an authentication command for http but now everyone who wants to use http has to authenticate and not just people who are going to be using terminal services.
Regards