Howto to use CSCO_WEBVPN_PASSWORD in rdp:// bookmark, SSL VPN

Hi all
I got an ASA5510 (8.4.4, ASDM 6.4(7) with WEBVPN access.
Now I'm facing the problem, that the customer uses an OTP authentication.
I've changed the SSL portal login page with username / password (OTP) / internal password ( the AD-user password).
So the idea is, that those variables
- CSCO_WEBVPN_USERNAME
- CSCO_WEBVPN_INTERNAL_PASSWORD
are used for SSO purpose.
Here my bookmark:
rdp2://<IP>/?keymap=de&bpp=16&geometry=1024x768&FullScreen=true&RedirectDrives=true&domain=<DOMAIN>&username=CSCO_WEBVPN_USERNAME&password=CSCO_WEBVPN_INTERNAL_PASSWORD
The problem is, that the password will not be sent to the rdp session. When I enter the password hardcoded (e.g. passwort=secret) it works.
So, how can a variable be sent for the password? Or it's by design, that only a hardcoded password can be used?
Thanks a lot,
Norbert

Dear Norbert,
To get this to work, you must configure the bookmark as following:
server/?csco_sso=1&Parameter&Parameter
server/?Parameter&Parameter&csco_sso=1
Please notice that the key is csco_sso=1 to provide java plug-in SSO feature.
For example:
rdp://10.198.29.26/?geometry=1024x768&csco_sso=1&username=CSCO_WEBVPN_USERNAME
&password=CSCO_WEBVPN_PASSWORD
I just tested this locally
Please let me know.
Thanx.
Portu.

Similar Messages

  • HOWTO: Setting up Server-Side Authentication with SSL

    This howto covers the configuration of server-side SSL authentication for both Net8 and IIOP (JServer) connections. It documents the steps required to set up an SSL encrypted connection; it does not cover certificate authentication.
    It is worthwhile noting that although the setup of SSL requires the installation of certificates, these certificates do not have to be current, only valid. For some reason, in order to enable SSL connections, it is necessary to set up valid certificate file on the server whether you intend to use certificate authentication or not.
    NOTE: I have been unable to determine whether or not the above statement is entirely correct. If anyone can confirm or disprove it, please let me know.
    The steps described below must all be carried out from the same logon account. They have been tested on both 816 and 817 databases, but will probably work for all versions, including 9i (unless there have been some drastic changes in 9i that I'm not aware of).
    1. Log on to the database server with an administrative login.
    Configure the database and listener to run under the current login account (Control Panel -> Services). It is not necessary to restart these services at this time.
    2. Create an Oracle wallet and set up the required certificates
    (i) Open the Oracle Wallet Manager:
    Start -> Programs -> [Oracle Home] -> Network Administration -> Wallet Manager
    (ii) Create a new wallet (Wallet -> New).
    (iii) When prompted, elect to generate a certificate request.
    (iv) On the request form, the only field that matters is the Common Name. Enter the fully qualified domain name (FQDN) of the database server (i.e. the name with which the database server will be referenced by clients).
    (v) Export the certificate request to file (Operations -> Export Certificate Request).
    (vi) Obtain a valid server certificate from an authorised signing authority. It will also be necessary to download the signing authoritys publicly available trusted root certificate. Certificates can be obtained from Verisign (http://www.verisign.com/)
    (vii) Install the trusted root certificate obtained in (vi) into the wallet (Operations -> Import Trusted Certificate). Either paste the contents of the certificate file, or browse to the file on the file system.
    (viii) Install the server certificate obtained in (vi) into the wallet (Operations -> Import User Certificate). Either paste the contents of the certificate file, or browse to the file on the file system.
    (ix) Save the wallet (Wallet -> Save). The wallet will be saved to the [user home]\Oracle\Wallets directory.
    3. Configure the listener for SSL.
    (i) Open the Oracle Net8 Assistant:
    Start -> Programs -> [Oracle Home] -> Network Administration -> Net8 Assistant
    (ii) Select Net8 Configuration -> Local -> Profile.
    (iii) From the drop-down list at right, select Oracle Advanced Security. Select the SSL tab.
    (iv) Select the Server radio button.
    (v) In the wallet directory field, enter the location of the wallet created in step 2, e.g. C:\WINNT\Profiles\oracleuser\ORACLE\WALLET
    (vi) Uncheck the Require Client Authentication checkbox.
    (vii) Select Net8 Configuration -> Listeners -> [listener name].
    (viii) Add a new address:
    Protocol: TCP/IP with SSL
    Host: [database server FQDN] (e.g. oraserver)
    Port: 2484
    (ix) Add a second new address:
    Protocol: TCP/IP with SSL
    Host: [database server FQDN] (e.g. oraserver)
    Port: 2482
    Check the Dedicate this endpoint to IIOP connections checkbox.
    (x) Save the Net8 configuration (File p Save Network Configuration).
    (xi) Restart the listener service.
    4. Configure the database to accept SSL connections.
    (i) Open the database inti.ora file (\admin\[SID]\pfile\init.ora or equivalent).
    (ii) At the bottom of the file, uncomment the line that reads
    mts_dispatchers = "(PROTOCOL=TCPS)(PRE=oracle.aurora.server.SGiopServer)"
    (iii) Save the file and restart the database service.
    5. Test the SSL confi guration using the Net8 Assistant.
    (i) Open the Oracle Net8 Assistant.
    (ii) Select Net8 Configuration -> Local -> Service Naming.
    (iii) Add a new net service (Edit p Create).
    Net service name: [SID].auth (e.g. iasdb.auth)
    Protocol: TCP/IP with SSL
    Host: [database server] (e.g. oraserver)
    Port: 2484
    Service Name/SID: [SID] (e.g. iasdb.orion.internal)
    Note: at the end of the net service configuration, click Finish, not Test. The test can hang if run from the wizard.
    (iv) Test the connection (Command -> Test Service). If the only error to appear is username/password denied, the test has succeeded.
    null

    Dear Alex,
    Thank you for reaching the Small Business Support Community.
    I would first suggest you to uncheck the "Perfect Forward Secrecy" setting on the RVS4000 and if see if there is some similar setting enabled, then disable it, on the other side.  If still the same thing happens, then go to RVS4000, VPN Advanced settings, and disable the "Aggressive Mode" so it becomes "Main mode" and use the same on the other end of the tunnel.
    Just in case and as a VPN configuration guide, below is a document called "IPSec VPN setup" if it helps somehow;
    http://sbkb.cisco.com/CiscoSB/Loginr.aspx?login=1&pid=2&app=search&vw=1&articleid=587
    Besides my suggestions I would advise you to contact your ISP to make sure there is no IPSec traffic restrictions and/or if there is something in particular they require to make this happen and please do not hesitate to reach me back if there is any further assistance I may help you with.
    Kind regards,
    Jeffrey Rodriguez S. .:|:.:|:.
    Cisco Customer Support Engineer
    *Please rate the Post so other will know when an answer has been found.

  • User Created RDP bookmarks on ASA

    How to configure ASA for user created bookmarks for RDP and VNC connections to their respective resources?

    hi,
    are you referring to RDP and VNC plug-ins for clientless SSL VPN?
    AFAIK, you can create bookmarks for HTTP/HTTPS, CIFS and FTP only.

  • IP Phone SSL VPN to ASA using AnyConnect

    I have a CUCM 7.1.5. We are using Phone proxy today. I wanted to upgrade to IP phone SSL VPN.
    I know in 8.x and 9.x the Proxy phone is not supported and Cisco supports SSL VPN.
    However, The question is: if CUCM 7.1.5 supports Phone SSL VPN.
    Lastly,
    I hear about Collaboration Edge in CUCM 10.x
    If CUCM 10.x is deployed then how the ASA concept plays a role here.
    What type of license I would need for Collaboration Edge to register the endpoints\phones from outside of network. 
    I cant find any information about the Colaboration Edge on the Internet...
    Message was edited by: Sean Poure

    The embargo/NDA is being lifted. The ASA is not involved. Here's the jump page with info:
    http://www.cisco.com/en/US/netsol/ns1246/index.html
    PS- Jason could have found out details in advance since DiData has partner NDA status.
    Please remember to rate helpful responses and identify helpful or correct answers.

  • Problem with HowTo guide - Use the BI Java SDK in a Web Dynpro Application

    Hello,
    I am following the HowTo guide - Use the BI Java SDK in a Web Dynpro Application
    at <a href="https://www.sdn.sap.comhttp://www.sdn.sap.comhttp://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/e49be590-0201-0010-0c83-fc20e5da124f">this link</a>.
    I have configured the connector on the WAS as needed.
    The problem is that when I run the application I receive an Unauthorized error on the connector URL.
    If I open this URL on a browser I receive a pop-up for UID and PWD and when I enter the same UID and PWD I used to configure the connector I am able to login and see the WSDL.
    Any ideas?

    I've never tried using BI in WebDynpro !!!
    But i foond one posting on the connection problem https://forums.sdn.sap.com/click.jspa?searchID=955524&messageID=2133396
    Regards,Anilkumar

  • RV220W - Connect to SSL VPN using Win7 Built-In SSTP

    I'm relatively new to establishing VPN connections and I'm having one heck of a time getting everything configured.
    I'm setting up a RV220W at the office and trying to get VPN steup. I've have gotten Quick VPN connections working using the QuickVPN software. I've given up for now on IPsec VPN connactions and will come back to these later.
    What I'd like to get setup is the SSL VPN connections using the Win7 built in VPN client. Is this even possible? I initially tried to connect to the VPN via the SSL Web access but I cannot get the software/divers to install on any of the 3+ Win7 64 bit machines I tried.
    So can the SSL VPN on the RV220W be setup to connect to with the Win7 VPN Client using SSTP?
    Any links or guidance on how to setup the cerificates on the server and where to install them on the Client PCs? I think this is my major issue right now as the error I get when I try to connect is either: "The certificate's CN name does not match the passed value" (Error Code: 0x800B010F)  or " A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider" (Error Code: 0x800B0109). I'm trying to use self signed certifcates and I'm not sure if that is the issue (self signed vs genuine) but I really am not getting anywhere with this.
    Also, the VPN does not have a FQDN just a static IP if this matters.
    While I'm at it, I'd also gladly take any good links for IPsec on the RV220W but I wont be tackling that until SSL & the certificates are setup.
    Thanks,
    Justin

    OK. Sorry to reply to myself but I got a few steps further. I figured I'd post how in case anyone needs to references this in the future or correct something I've done wrong.
    So I've decided to use a Self Signed Certificate.
    First I went to the Certificate page on the RV220W Config
    Select Generate Certificate and fill in the info. As I'm not using a FQDN but a static IP, I set the Name, Subject & IP address all to the same, static IP.
    I generated that and then hit view to copy the CSR
    From there you need to generate a certificate.
    I used Getacert (http://www.getacert.com/signacert.html)
    I pasted the CSR into the text box and hit SubmitCSR
    Make sure you save the getacert public certificate and your own signed certificate
    Back in the RV220W Certificate page, upload the getacert.cer to the Trusted Certificate section and your own self certificate to Active Self Certificates Table
    This should generate a new Cert for the router and you will have to reaccept it to get back to the web config
    Back in the Cert page again, Download the routers certificate.
    Back on your client, import both the getacert.cer as well as the routers certificate to the "Trusted Root Certification Authorities"
    These steps got me closer.
    Now when I try to connect using the Win7 VPN Client with SSTP I get a new error: Error Description: 0x800704D4: The network connection was aborted by the local system.
    Any idea how to resolve this on the RV220W?
    - Justin

  • RDP with SSL via CSS

    I have been asked about providing this as a way to secure RDP connections - has anyone done this?
    I can see two potential ways, but do not know much about RDP.
    How is the SSL part of RDP initialised? would it be prractical to terminate the SSL on the CSS in a similar manner to SSl for HTTP?
    The other option would be to "blind" load balance the encrypted traffic straight to the servers, and let them sort SSL.
    Thanks,
    Paul.

    Hi Paul,
    what we have done here is to deploy an MS ISA Server farm behind the CSS: client SSL connection terminate at ISA external interface, and ISA starts a new internal SSL connection to a MS TS_Gateway . So RDP over SSL traffic is: internet client ---> Firewall ---> CSS ---> ISA farm (in DMZ) ---> Firewall ---> TS_Gateway (internal network)---> TS Server (internal network)
    (see for example: http://technet.microsoft.com/en-us/library/cc731353(WS.10).aspx)

  • Using Photoshop over RDP

    Hi,
    I'm asked to install Photoshop to a number of people.
    I'm looking for advices/opinion/experiences about using Photoshop over RDP served by a W2008R2 (virtual) and accessed by  Wyse ThinOS box, over a 100Mb/full, wired network.
    Is it total nonsense, due to lossy RDP compression ?
    Thanks

    Hi,
    Thank you for posting in Windows Server Forum.
    Sorry for late response. You can use Photoshop though RDP serer 2008 R2 but as you know that there is specific consideration which need to take place for RDP to any system and working with such kind of software. We need to have good network bandwidth, screen
    solution and many different aspects need to consider. For more details you can go through below article for performance tuning.
    Performance Tuning Guidelines for previous versions of Windows Server
    http://msdn.microsoft.com/en-us/library/windows/hardware/dn529134
    Hope it helps!
    Thanks.
    Dharmesh Solanki
    TechNet Community Support
    Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

  • Browsing Oracle application using CISCO SSL VPN forms not opening

    Hi all,
    Any idea why am not able to access my application using CISCO SSL VPN.Normal clients are able to use our application there is no problem.i have modifyed the "certdb.txt",still i am having the same problem.here am attaching the Java console output.
    java.net.ConnectException: Operation timed out: connect
         at java.net.PlainSocketImpl.socketConnect(Native Method)
         at java.net.PlainSocketImpl.doConnect(Unknown Source)
         at java.net.PlainSocketImpl.connectToAddress(Unknown Source)
         at java.net.PlainSocketImpl.connect(Unknown Source)
         at java.net.Socket.<init>(Unknown Source)
         at java.net.Socket.<init>(Unknown Source)
         at oracle.jinitiator.protocol.https.HttpsClient.doConnect(Unknown Source)
         at sun.net.www.http.HttpClient.openServer(Unknown Source)
         at sun.net.www.http.HttpClient.openServer(Unknown Source)
         at sun.net.www.http.HttpClient.<init>(Unknown Source)
         at sun.net.www.http.HttpClient.<init>(Unknown Source)
         at sun.plugin.protocol.jdk12.http.HttpClient.<init>(Unknown Source)
         at oracle.jinitiator.protocol.https.HttpsClient.<init>(Unknown Source)
         at oracle.jinitiator.protocol.https.HttpsClient.New(Unknown Source)
         at oracle.jinitiator.protocol.https.HttpsURLConnection$1.run(Unknown Source)
         at java.security.AccessController.doPrivileged(Native Method)
         at oracle.jinitiator.protocol.https.HttpsURLConnection.connect(Unknown Source)
         at sun.plugin.protocol.jdk12.http.HttpURLConnection.getInputStream(Unknown Source)
         at oracle.jre.protocol.jar.HttpUtils.followRedirects(Unknown Source)
         at oracle.jre.protocol.jar.JarCache$CachedJarLoader.download(Unknown Source)
         at oracle.jre.protocol.jar.JarCache$CachedJarLoader.load(Unknown Source)
         at oracle.jre.protocol.jar.JarCache.get(Unknown Source)
         at oracle.jre.protocol.jar.CachedJarURLConnection.connect(Unknown Source)
         at oracle.jre.protocol.jar.CachedJarURLConnection.getJarFile(Unknown Source)
         at sun.misc.URLClassPath$JarLoader.getJarFile(Unknown Source)
         at sun.misc.URLClassPath$JarLoader.<init>(Unknown Source)
         at sun.misc.URLClassPath$2.run(Unknown Source)
         at java.security.AccessController.doPrivileged(Native Method)
         at sun.misc.URLClassPath.getLoader(Unknown Source)
         at sun.misc.URLClassPath.getLoader(Unknown Source)
         at sun.misc.URLClassPath.getResource(Unknown Source)
         at java.net.URLClassLoader$1.run(Unknown Source)
         at java.security.AccessController.doPrivileged(Native Method)
         at java.net.URLClassLoader.findClass(Unknown Source)
         at sun.applet.AppletClassLoader.findClass(Unknown Source)
         at sun.plugin.security.PluginClassLoader.findClass(Unknown Source)
         at java.lang.ClassLoader.loadClass(Unknown Source)
         at sun.applet.AppletClassLoader.loadClass(Unknown Source)
         at java.lang.ClassLoader.loadClass(Unknown Source)
         at sun.applet.AppletClassLoader.loadCode(Unknown Source)
         at sun.applet.AppletPanel.createApplet(Unknown Source)
         at sun.plugin.AppletViewer.createApplet(Unknown Source)
         at sun.applet.AppletPanel.runLoader(Unknown Source)
         at sun.applet.AppletPanel.run(Unknown Source)
         at java.lang.Thread.run(Unknown Source)
    WARNING: Unable to cache https://212.72.22.86/+CSCO+1a756767633A2F2F62656E6A726F322E7A75712E70622E627A++/forms/java/frmwebutil.jar
    java.net.ConnectException: Operation timed out: connect
         at java.net.PlainSocketImpl.socketConnect(Native Method)
         at java.net.PlainSocketImpl.doConnect(Unknown Source)
         at java.net.PlainSocketImpl.connectToAddress(Unknown Source)
         at java.net.PlainSocketImpl.connect(Unknown Source)
         at java.net.Socket.<init>(Unknown Source)
         at java.net.Socket.<init>(Unknown Source)
         at oracle.jinitiator.protocol.https.HttpsClient.doConnect(Unknown Source)
         at sun.net.www.http.HttpClient.openServer(Unknown Source)
         at sun.net.www.http.HttpClient.openServer(Unknown Source)
         at sun.net.www.http.HttpClient.<init>(Unknown Source)
         at sun.net.www.http.HttpClient.<init>(Unknown Source)
         at sun.plugin.protocol.jdk12.http.HttpClient.<init>(Unknown Source)
         at oracle.jinitiator.protocol.https.HttpsClient.<init>(Unknown Source)
         at oracle.jinitiator.protocol.https.HttpsClient.New(Unknown Source)
         at oracle.jinitiator.protocol.https.HttpsURLConnection$1.run(Unknown Source)
         at java.security.AccessController.doPrivileged(Native Method)
         at oracle.jinitiator.protocol.https.HttpsURLConnection.connect(Unknown Source)
         at sun.plugin.protocol.jdk12.http.HttpURLConnection.getInputStream(Unknown Source)
         at oracle.jre.protocol.jar.HttpUtils.followRedirects(Unknown Source)
         at oracle.jre.protocol.jar.JarCache$CachedJarLoader.download(Unknown Source)
         at oracle.jre.protocol.jar.JarCache$CachedJarLoader.load(Unknown Source)
         at oracle.jre.protocol.jar.JarCache.get(Unknown Source)
         at oracle.jre.protocol.jar.CachedJarURLConnection.connect(Unknown Source)
         at oracle.jre.protocol.jar.CachedJarURLConnection.getJarFile(Unknown Source)
         at sun.misc.URLClassPath$JarLoader.getJarFile(Unknown Source)
         at sun.misc.URLClassPath$JarLoader.<init>(Unknown Source)
         at sun.misc.URLClassPath$2.run(Unknown Source)
         at java.security.AccessController.doPrivileged(Native Method)
         at sun.misc.URLClassPath.getLoader(Unknown Source)
         at sun.misc.URLClassPath.getLoader(Unknown Source)
         at sun.misc.URLClassPath.getResource(Unknown Source)
         at java.net.URLClassLoader$1.run(Unknown Source)
         at java.security.AccessController.doPrivileged(Native Method)
         at java.net.URLClassLoader.findClass(Unknown Source)
         at sun.applet.AppletClassLoader.findClass(Unknown Source)
         at sun.plugin.security.PluginClassLoader.findClass(Unknown Source)
         at java.lang.ClassLoader.loadClass(Unknown Source)
         at sun.applet.AppletClassLoader.loadClass(Unknown Source)
         at java.lang.ClassLoader.loadClass(Unknown Source)
         at sun.applet.AppletClassLoader.loadCode(Unknown Source)
         at sun.applet.AppletPanel.createApplet(Unknown Source)
         at sun.plugin.AppletViewer.createApplet(Unknown Source)
         at sun.applet.AppletPanel.runLoader(Unknown Source)
         at sun.applet.AppletPanel.run(Unknown Source)
         at java.lang.Thread.run(Unknown Source)
    WARNING: Unable to cache https://212.72.22.86/+CSCO+1a756767633A2F2F62656E6A726F322E7A75712E70622E627A++/forms/java/frmall_jinit.jar
    java.net.ConnectException: Operation timed out: connect

    Hi,
    From your description, my understanding is that you get invalid workflowinstanceid error when you click on workflow link like "inprogress” in the current list.
    Please check the URL of workflow “inprogress” (also URL for workflow approval instance to open task form) to see if it’s correct.
    Please use your company network directly instead of CISCO SSL VPN, then access SharePoint portal url “https://vpnssl.companyname.com/”,  see if the issue still occur.
    Also, check the ULS log on the SharePoint server based on the Correlation ID value, get more detailed information about this error message.
    And you could refer to this similar issue:
    https://social.technet.microsoft.com/Forums/en-US/08aa6b33-cef6-4b01-8af7-6c25ed7d9953/invalid-workflowinstanceid-parameter-in-url?forum=sharepointgeneralprevious.
    Best Regards
    Vincent Han
    TechNet Community Support

  • Unable to use iTunes to replace bookmarks on iPhone with Internet Explorer.

    I'm unable to use iTunes to replace bookmarks on iPhone with Internet Explorer.   Get message the sync was terminated by iPhone.  Why?

    If you have a program called MultiScreen installed, look to remove it. I just did and my iTunes is working fine.

  • Jabber client and IP Phone SSL VPN to ASA using AnyConnect

    Also for Jabber 9.1 can the Jabber for X softphone client (CUCM) can fireup a SSL VPN direct to ASA, similar to how 7965s can? Anyone aware if Jabber 10 or next version will support Jabber client with ASA? I have this delpoyed with 7965s and certificates but I have to manually start a AnyConnect session for Jabber for Windows on my laptop.
    https://supportforums.cisco.com/docs/DOC-9124

    The embargo/NDA is being lifted. The ASA is not involved. Here's the jump page with info:
    http://www.cisco.com/en/US/netsol/ns1246/index.html
    PS- Jason could have found out details in advance since DiData has partner NDA status.
    Please remember to rate helpful responses and identify helpful or correct answers.

  • Anyone using Cisco Clean Access with Juniper SSL VPN?

    We're testing Cisco Clean Access with Juniper SSL VPN, and are running into a problem with single sign on. The Juniper box is sending the user's source IP as the framed-ip-address, and not the Network Connect assigned IP, which is why we need to get SSO to work. Has anyone done this, and what did you do to get it working? Thanks.

    Hi,
    I've no experience with this app but it does list
    Juniper as a sujpported client:
    http://www.equinux.com/us/products/vpntracker/interoperability.html

  • ASA 5505 8.2 - SSL VPN - Cannot Ping inside host's

    Hello All,
    I'm an ASA Newb. 
    I feel like I have tried everything posted and still no success.
    PROBLEM:  When connected to the SSL VPN I cannot ping any internal host's.  I cannot ping anything on this inside?
    Result of the command: "show running-config"
    : Saved
    ASA Version 8.2(5)
    hostname MCASA01
    domain-name mydomain.org
    enable password xxbtzv6P4Hqevn4N encrypted
    passwd 2KFQnbNIdI.2KYOU encrypted
    names
    name 192.168.2.0 VLAN
    name 192.168.5.0 VPNPOOL
    interface Ethernet0/0
    switchport access vlan 2
    interface Ethernet0/1
    interface Ethernet0/2
    interface Ethernet0/3
    interface Ethernet0/4
    interface Ethernet0/5
    switchport access vlan 3
    interface Ethernet0/6
    interface Ethernet0/7
    interface Vlan1
    nameif inside
    security-level 100
    ddns update hostname MC_DNS
    dhcp client update dns server both
    ip address 192.168.1.1 255.255.255.0
    interface Vlan2
    no forward interface Vlan1
    nameif outside
    security-level 0
    ip address 11.11.11.202 255.255.255.252
    interface Vlan3
    no nameif
    security-level 50
    ip address 192.168.2.1 255.255.255.0
    ftp mode passive
    clock timezone PST -8
    clock summer-time PDT recurring
    dns server-group DefaultDNS
    domain-name mydomain.org
    access-list SPLIT-TUNNEL standard permit 192.168.1.0 255.255.255.0
    pager lines 24
    logging enable
    logging asdm informational
    mtu inside 1500
    mtu outside 1500
    ip local pool VPNPOOL 192.168.5.1-192.168.5.10 mask 255.255.255.0
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    global (outside) 1 interface
    nat (inside) 1 0.0.0.0 0.0.0.0
    route outside 0.0.0.0 0.0.0.0 74.7.217.201 1
    timeout xlate 3:00:00
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    aaa authentication ssh console LOCAL
    http server enable
    http 192.168.1.0 255.255.255.0 inside
    http 0.0.0.0 0.0.0.0 outside
    http authentication-certificate inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart
    crypto ipsec security-association lifetime seconds 28800
    crypto ipsec security-association lifetime kilobytes 4608000
    crypto ca trustpoint ASDM_TrustPoint0
    enrollment terminal
    subject-name CN=vpn.mydomain.org,OU=IT,O="mydomain",C=US,St=CA,L=Chino
    keypair digicert.key
    crl configure
    crypto ca certificate chain ASDM_TrustPoint0
    certificate 00b63edadf5efa057ea49da56b179132e8
        3082051c 30820404 a0030201 02021100 b63edadf 5efa057e a49da56b 179132e8
        300d0609 2a864886 f70d0101 05050030 72310b30 09060355 04061302 4742311b
        30190603 55040813 12477265 61746572 204d616e 63686573 74657231 10300e06
        03550407 13075361 6c666f72 64311a30 18060355 040a1311 434f4d4f 444f2043
        41204c69 6d697465 64311830 16060355 0403130f 45737365 6e746961 6c53534c
        20434130 1e170d31 33313130 35303030 3030305a 170d3134 30323033 32333539
        35395a30 52312130 1f060355 040b1318 446f6d61 696e2043 6f6e7472 6f6c2056
        616c6964 61746564 3111300f 06035504 0b130846 72656520 53534c31 1a301806
        03550403 13117670 6e2e6d65 74726f63 656c6c2e 6f726730 82012230 0d06092a
        864886f7 0d010101 05000382 010f0030 82010a02 82010100 a0d97d51 fcd18293
        eaf8e9b2 d632b2e3 e4d92eb1 5b639766 52677a26 2aa7d09d 437be3b6 dfb8649c
        4d715278 e1745955 27e8aab2 9c9da997 694a73e8 c1c426f3 a519adba acc2ad94
        aa0e09af 6db7bfc6 bad90bf2 b057dc56 c69a4276 1b826c83 6cd7ae09 af39bd7d
        4abe60b4 9b04613a 287a1ae6 9d117d05 c7cdc15f 09d588b0 fcc05c47 c1cb6d67
        c3701389 d3b7691d b05ff82c b0be475d 746a4916 0bbf11a6 7ee1b7ec bd05e1d2
        dda305a6 918bfd35 17447b04 bca1e6d9 10955649 d8211878 168c4c21 279a6584
        4b560a9f 414aea15 91e21581 a71d6b98 86d9eac3 47ea3a1d a172c71a ecf77aaa
        536d73e4 bc53eb68 c7bfacdd fab87ea5 121baf55 067dbd19 02030100 01a38201
        cb308201 c7301f06 03551d23 04183016 8014dacb eaad5b08 5dccfffc 2654ce49
        e555c638 f4f8301d 0603551d 0e041604 14fabb1d f439c41f e59207c7 202c2fda
        b46bcacc ee300e06 03551d0f 0101ff04 04030205 a0300c06 03551d13 0101ff04
        02300030 34060355 1d25042d 302b0608 2b060105 05070301 06082b06 01050507
        0302060a 2b060104 0182370a 03030609 60864801 86f84204 01304f06 03551d20
        04483046 303a060b 2b060104 01b23101 02020730 2b302906 082b0601 05050702
        01161d68 74747073 3a2f2f73 65637572 652e636f 6d6f646f 2e636f6d 2f435053
        30080606 67810c01 0201303b 0603551d 1f043430 323030a0 2ea02c86 2a687474
        703a2f2f 63726c2e 636f6d6f 646f6361 2e636f6d 2f457373 656e7469 616c5353
        4c43412e 63726c30 6e06082b 06010505 07010104 62306030 3806082b 06010505
        07300286 2c687474 703a2f2f 6372742e 636f6d6f 646f6361 2e636f6d 2f457373
        656e7469 616c5353 4c43415f 322e6372 74302406 082b0601 05050730 01861868
        7474703a 2f2f6f63 73702e63 6f6d6f64 6f63612e 636f6d30 33060355 1d11042c
        302a8211 76706e2e 6d657472 6f63656c 6c2e6f72 67821577 77772e76 706e2e6d
        6574726f 63656c6c 2e6f7267 300d0609 2a864886 f70d0101 05050003 82010100
        2484b72c 56161585 c9caa1a3 43cbc754 d3b43cef 7902a775 d40d064f 6918d52f
        0aaaea0c ad873124 11b68847 406812da fd0c5d71 6e110898 1ebddcab ddf980e4
        b95be4e2 0633cc23 7a4cbc27 f1f5e4e8 1de3c127 2b28a364 f1f26764 98afe871
        45547855 c0ceaf39 256f46db 4ac412a7 2b594817 a967ba5a 24986b24 57002ce4
        f046c6b3 5f7c9cc2 e6cd8ede 8fbcac60 b87fd497 71328783 8b148f7f affec249
        191c460b 3d46d352 0651f35e 96a60fbe 7b22e057 06aa7722 da447cd3 0ea72e7f
        5ec8c13c b550f502 b020efdc 35f62b89 52d7e6e3 14ade632 802dee70 1cdbf7ad
        a39a173b 916406e4 887ba623 4813b925 8a63a300 fd016981 a8d70651 a736267a
      quit
    no crypto isakmp nat-traversal
    telnet timeout 5
    ssh 192.168.1.0 255.255.255.0 inside
    ssh 0.0.0.0 0.0.0.0 outside
    ssh timeout 5
    console timeout 0
    dhcpd auto_config outside vpnclient-wins-override
    dhcpd address 192.168.1.100-192.168.1.200 inside
    dhcpd dns 66.180.96.12 64.238.96.12 interface inside
    dhcpd lease 86400 interface inside
    dhcpd ping_timeout 4000 interface inside
    dhcpd domain mydomain.org interface inside
    threat-detection basic-threat
    threat-detection statistics access-list
    threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
    ntp server 64.147.116.229 source outside
    ssl trust-point ASDM_TrustPoint0 outside
    webvpn
    enable outside
    svc image disk0:/anyconnect-win-2.5.2014-k9.pkg 1
    svc enable
    tunnel-group-list enable
    group-policy DfltGrpPolicy attributes
    vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn
    group-policy VPNGP internal
    group-policy VPNGP attributes
    vpn-tunnel-protocol svc
    split-tunnel-policy tunnelspecified
    split-tunnel-network-list value SPLIT-TUNNEL
    username GaryC password TGbvzEO3d6HlfU66 encrypted privilege 15
    username GaryC attributes
    vpn-group-policy VPNGP
    tunnel-group MCVPN type remote-access
    tunnel-group MCVPN general-attributes
    address-pool VPNPOOL
    default-group-policy VPNGP
    tunnel-group MCVPN webvpn-attributes
    group-alias MCVPN enable
    group-url https://11.11.11.202/MCVPN enable
    class-map inspection_default
    match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
    parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
    class inspection_default
      inspect dns preset_dns_map
      inspect ftp
      inspect h323 h225
      inspect h323 ras
      inspect rsh
      inspect rtsp
      inspect esmtp
      inspect sqlnet
      inspect skinny 
      inspect sunrpc
      inspect xdmcp
      inspect sip 
      inspect netbios
      inspect tftp
      inspect ip-options
    service-policy global_policy global
    prompt hostname context
    no call-home reporting anonymous
    call-home
    profile CiscoTAC-1
      no active
      destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
      destination address email [email protected]
      destination transport-method http
      subscribe-to-alert-group diagnostic
      subscribe-to-alert-group environment
      subscribe-to-alert-group inventory periodic monthly
      subscribe-to-alert-group configuration periodic monthly
      subscribe-to-alert-group telemetry periodic daily
    Cryptochecksum:1e950c041cc2c25116d30e5c884abbfc
    : end
    My goal is to allow Remote Users to RDP(3389) through VPN.
    Thank you,
    Gary
    Message was edited by: Gary Culwell

    Hello Jon,
      Thank you so much for your response. Clients will not be connect to a specific RDP server.  I was hoping if we were to establish a VPN Client tunnel I would like that tunnel to provide full local are access.  So the way the clients are used to is while in the field they use RDP to connect to their desktops on the internal LAN.
    Would you say this would work:
    route inside 192.168.1.0 255.255.255.0 192.168.1.1 1
    Do you have examples?
    Thank you,
    Gary

  • ASA 5505 WebVPN - It has taken a while for SSL VPN Relay to load. You need to verify Java is enabled in your browser

    ASA 5505
    ASA Version 9.0.(2)
    Suddently on the webvpn Interface when i click on my web bookmarks (and java launches in browser) i get this fail in Chrome and FF 'It has take a while for SSL VPN Relay til load. You need to verify Java is enabled in your browser' and nothing happens...
    Java IS enabled and running. Tried this in both 7.45 and 7.51
    No problem in IE 11 and java 7.45 and 7.51
    I've googled alot but have not been able to find any suggetions
    Hope you have a solution
    Best Regards.

    Any resolution on this?  Firefox/Chrome my cifs work but smart tunnel RDP doesn't, and in IE my shares don't work but RDP smart tunnel does....
    Cisco, if you're not going to do something good, just don't do it.  The SSL VPN is a hack job.

  • SSL VPN Login failure issue

    Hello,
    I am having an issue with some users trying to login to our SSL VPN (Anyconnect) via ASA5505 8.2(1).  Authentication is done via AD.  From the same computer, the client finds the DNS name and unlocks the login username and password.  When I enter a username and password and click connect, it is instantly rejected with login failure with the following event log:
    Function: ConnectMgr::setPromptAttributes
    File: .\ConnectMgr.cpp
    Line: 2657
    Invoked Function: setPromptAttributes
    Return Code: -33554423 (0xFE000009)
    Description: GLOBAL_ERROR_UNEXPECTED
    Error text:
    Login failed.
    If I change the user account to another user (from the same PC), login works perfectly fine - this is only happening with 3 or 4 users - I have compared the user accounts of a failing account and a successful account and they are identical in AD. 
    This has been driving me crazy - as a work around for the failing users, I just created a temporary account which works perfectly fine.  The request doesn't even seem to hit the ASA (there is nothing in the logs that show a failed attempt).  Still troubleshooting and looking at certificate's at this point.  Any help/suggestions would be greatly appreciated!!  Thanks.
    Regards.
    After a little more testing, seems somehow related to users being in to many groups in AD.      
    Message was edited by: Rich Viola

    Hello,
    If the website is unavailable or in this case, the website is missing several characters(charts, canvas, etc or some other objects), usually could be an issue with the rewrite engine.
    Solution (workaround):
    You may use smart tunnel for this website, so the rewrite engine will not override any content, and it will display the website as it should.
    You can implement it as follow:
    Add a Bookmark
    Bookmark for the service and clicking the Enable Smart Tunnel option in the Add or Edit Bookmark dialog box.
    For further information you can find it here:
    http://www.cisco.com/c/en/us/td/docs/security/asa/asa83/configuration/guide/config/webvpn.html#wp1272236
    Let me know how tit works out!
    Please don't forget to rate and mark as correct the helpful Post!
    David Castro,
    Regards,

Maybe you are looking for