SVC WebVPN (clientless) uses IP pool addressing or ASA inside interface IP

I'm trying to design something which requires ASA to uniquely assign one IP per clientless VPN user. it seems like all these web requests coming through the ASA are proxied via the ASA's inside IP for the source address of the Web request. Does ASA proxy requests through it by changing the VPN client request IP's from a POOL configuration. Or is it always going to use the ASA inside interface IP? Assuming a two NIC configuration (inside/outside)
NOTE: I'm not talking about AnyConnect, IKEV1/2 client based VPN's. I'm specifically talking about the client-free login connection method.
thx in advance,
Will

Hi Will,
Pls move your thread to here
https://supportforums.cisco.com/community/6001/vpn
HTH
Rasika

Similar Messages

VPN ASA inside Interface and ip pool are one same Subnet

Hi Everyone,
I have configured RA VPN full tunnel.
Inside interface of ASA is
Vlan1 inside 10.0.0.1 255.255.255.0 CONFIG
ip local pool 10-pool 10.0.0.51-10.0.0.100 mask 255.255.255.0
Need to know is it good design to have both on same subnet?
When i access the Switch connecting to VPN ASA inside interface via--https://10.0.0.2
which has IP 10.0.0.2 while using Remote VPN connection to ASA it does not work gives error
message as below
Jan 19 2014 19:42:46: %ASA-5-305013: Asymmetric NAT rules matched for forward and reverse flows; Connection for tcp src outside:10.0.0.51/51077(LOCAL\ipsec-user) dst inside:10.0.0.2/443 denied due to NAT reverse path failure.
Jan 19 2014 19:42:57: %ASA-5-305013: Asymmetric NAT rules matched for forward and reverse flows; Connection for tcp src outside:10.0.0.51/51078(LOCAL\ipsec-user) dst inside:10.0.0.2/443 denied due to NAT reverse path failure
Jan 19 2014 19:42:59: %ASA-6-302014: Teardown TCP connection 22418 for outside:10.0.0.51/51069(LOCAL\ipsec-user) to identity:10.0.0.1/443 duration 0:01:08 bytes 1035 TCP Reset-O (ipsec-user)
Jan 19 2014 19:42:59: %ASA-6-106015: Deny TCP (no connection) from 10.0.0.51/51069 to 10.0.0.1/443 flags FIN ACK on interface outside
Current NAT config is
nat (inside,outside) source dynamic any interface
Regards
MAhesh
Message was edited by: mahesh parmar

Hi Mahesh,
It should work but I generally would not suggest having the same network on the LAN and also configured partially as a VPN Pool network.
Your problem at the moment is simply lacking the NAT0 configuration for the traffic between LAN and VPN Pool.
I would suggest changing the VPN Pool first and then configuring this
object network LAN
subnet 10.0.0.0 255.255.255.0
object network VPN-POOL
subnet
nat (inside,outside) 1 source static LAN LAN destination static VPN-POOL VPN-POOL
We have to use the line number "1" in the above command so that it gets moved to the top since your current Dynamic PAT would otherwise override it.
In the future it would be best if you changed your current Dynamic PAT configuration to this
nat (inside,outside) after-auto source dynamic any interface
We simply add the "after-auto" to this Dynamic PAT configuration so that it gets moved down in priority. The "after-auto" refers to the fact that this NAT will be inserted after Auto NAT (after Section 2). Your current rule is Manual NAT (Sectiom 1). The new rule will be Manual NAT (Section 3)
- Jouni

Using main email address of contacts inside Address Book with Mail 3.5

Hi all,
I am organizing a christmas dinner for 20th of December and I have inside address book a group called dinner. I have got 100 contacts and some of them have two email addresses. Some people have told me to send all the information to personal addresses. So when I create the email and call address book from the email message, it let me choose between both email addresses with a blue line. This choice is kept for next time and when I send the email message works but some people is still receiving the mail at the office. I wonder... how can I select the main email address for next time so I would only need moving the "dinner group icon" over the recipient line and that´s all?. Does anybody knows the way of doing that?
Regards,

If you selected their home email address and some say they get it at their work email, then it would seem that they are forwarding their email to their work address. If that's the case, there's nothing you can do about that.
You could always duplicate the group with a different name (Dinner work, for example) and remove their personal email addresses from the contacts in the group, as well as removing the work addresses from the original group.
Mulder

ASA5510 RA VPN, ACS assigned address different subnet than inside interface

Currently we have our RA tunnels set up with IP Address pools that are in the same subnet as the ASA inside interface and that works to give the clients connectivity.
I have seen that this is not the best way to go with this and also have seen some config snippets.
But I have not seen exactly how this should be done, and I don't really see anything in the config examples.
For example, If my ASA is 10.10.10.1 and I want to assign each person a specific IP Address in an address pool and I want each group to be in a different subnet:
Eng = 192.168.100.0
Bob = 192.168.100.1
Bill = 192.168.100.2
Sales = 192.168.200.0
Sue = 192.168.200.1
Sam = 192.168.200.2
I have two core switches with the SVIs configured for these subnets.
But, I don't see how the routing is accomplised in the ASA.
Also, I can configure the ACS to give each person an IP Address, but not sure what is needed in the ASA.
Do the pools still need to be configured in the ASA and the ACS hands the client an address that I specify in that pool?

Better to reset an IP pool and reclaim all its IP addresses:
Use this User Guide for Cisco Secure Access Control Server 4.1 System Configuration: Advanced
http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.1/user/SCAdv.html

When I login on my When I sign in to a site on my ipad using my email address as ID a short cut of my email address comes up. How can I get rid of it?

When I sign in to a site on my iPad using my email address as ID a short cut of my email address comes up. How can I get rid of it?

You can edit keyboard shortcuts in Settings>General>Keyboard>Shortcuts>Edit.

Two apple I.D., one with the .me email address I want, how can I delete it so that I can use that .me address on my other account?

I have two apple I.D., one with the .me email address I want, how can I delete it so that I can use that .me address on my other account
Or is it possible to transfer the purchases (apps) to my new .me account so that I can re-download them in the future without having to switch accounts?

crazyshark wrote:
I have two apple I.D., one with the .me email address I want, how can I delete it so that I can use that .me address on my other account
Or is it possible to transfer the purchases (apps) to my new .me account so that I can re-download them in the future without having to switch accounts?
You can't do this, and you can't transfer purchases between accounts. There is no conflict about using one ID for iTunes, iTunes in the Cloud and iTunes Match (the ID you've been using for iTunes) and using the other ID for iCloud.

How can I use one gmail address on two different macbooks in 'mail'?

I'm using one business gmail address. Me and my girlfriend both have a macbook. Now the gmail address is linked to my macbook. But she wants to use it as well. Unfortunately the 'mail' system won't allow her to sync with the gmail address. And I get messages from gmail saying that someone tried to log in to my account. Which is something I certainly want, but can't change. Does anyone now how I can use 1 gmail address on two different mac's? Thanks

You may be able to change the suspicious account activity message alerts
in your Gmail settings, and check that side of it, since I can use several
means of accessing my Gmail and Google Accounts; and in the past had
shared an account (not google) with another party half a world away when
her email server went down for a month.
The Mail software should not know the difference, unless the setup in there
is not correct; if this is so, then more than what she says would be wrong.
The Google mail Support help site pages should cover this adequately.
Gmail Help - Google Help
https://support.google.com/mail/?hl=en

Calling a RFC using connection pool

Can I use connection pool to call a RFC from my R3? I'm using SAP Enterprise Connector but I don't want to pass user/password hardcoded.
Thanks in advance.

Hi Kiran,
Yes I used SAP JRA and it works.
You need JRA deployed and configured on WAS, your basis guy can do it for you. The next step is download this PDF <a href="https://www.sdn.sap.comhttp://www.sdn.sap.comhttp://www.sdn.sap.com/irj/servlet/prt/portal/prtroot/docs/library/uuid/ad09cd07-0a01-0010-93a9-933e247d3ba4">Accessing BAPIs Using the SAP Java Resource Adapter</a>.
Follow this document, it's very easy to do so.

HT204053 I have an iPhone 4S and the new Apple TV, both setup with my email as the Apple ID. I gave my wife an iPad 3 and set it up using her email address as the Apple ID. Is a second iTumes Match subscription required for her to use our music from iCl

I have an iPhone 4S and the latest Apple TV, both setup with my email address as the Apple ID. I subscribed to iTunes Match so our music could be played from iCloud. I gave my wife an iPad 3 and set it up using her email address as the Apple ID. When I try to turn on iMatch so she can play our music from iCloud on her new iPad it tells me that she needs a subscription to iTunes Match. Is it Apple's intent that we would need two iTunes Match subscriptions? If not, how do I accomplish what I want to get done?

The problem is that all services are bundled with your Apple ID ([email protected]):
Your iCloud account (Mail, Contacts, Calendars, Reminders, Notes, Backups, etc.),
also iTunes & App Store purchases (Music, Movies, TV Shows, etc.),
and the iTunes Match services.
(I guess that all your devices - yours and your wife's are connected to one iTunes library, right?)
If you want that your wife gets her own iCloud account for Mail, Contacts, Calendars, etc. but gets also access to your media then you have two set up two things on her device:
iCloud (Settings > iCloud) with her account (e.g. [email protected])
and
iTunes & App Stores (Settings > iTunes & App Stores) with your account (e.g. [email protected]).
In this case she gets access to your library and could use the same iTunes Match account.
(See also: Using one Apple ID for iCloud and a different Apple ID for Store Purchases http://support.apple.com/kb/HT4895)

How do i use Connection pool in JSP pages

Hey everyone,
I am using a connection pool in my web application. I am using DbConnectionBroker from Javaexchange.com. It has a class that creates a connection pool available for the servlets. I am trying to figure out that how to use connection pool within the JSP pages if I want to connect to the database. In the servlets i am using DBConnectionBroker pool = (DbConnectionBroker) getServletContext().getAttribute("dbPool") to get database connection. How Can i use this in JSP page to get a db connection.
Thanks

If the reference to the connection pool is already stored as an ServletContex attribute, try:
<jsp:useBean id="dbPool" scope="application" class="com.javaexchange.dbConnectionBroker" />
<%
Connection con = dbPool.getConnection();
%>

Can I use my email address as my iPad ID? Thanks., Can I use my email address as my iPad ID? Thanks.

Hi! Do I really have to enter my VISA info in order for me to access iTunes, App Store, etc? Can I download
Yahoo Messenger in my iPad? Thanks.

user1724 wrote:
You can use a non @me to set up iCloud, then add your @me address to that apple id. So you have your apple id as any addreee you want, and your @me address is attached to that apple id, but it is not the id. That is what I did, so I know that works.
If you open an iCloud account with an ID which is a non-Apple email address you will be asked to create a new @me.com address to go with it. People have reported that it is not possible to add an existing @me.com address to an iCloud account, so if that is what you've done I can't explain why you got away with it An @me.com address is an Apple ID in its own rigtht so you would be in effect merging IDs, which (despite many people's fervent wishes) is not possible.
And as said you can't use an alias address for anything else than an alias in the account by which it was created.

I have two Apple ID, how can I delete one and use the email address associates to the main one?

I have two Apple ID, how can I delete one and use the email address associates to the main one?

If you abandon one of the Apple IDs you will also basically be abandoning any content that you have acquired with that Apple ID. Content can only be updated and re-downloaded with the Apple ID that was used to buy it. Apple will not combine the content of Apple IDs and Apple will not transfer the content from one Apple ID to another Apple ID.

Is there ANY way to use another email address with iCloud?

Apple let you use any email address as an Apple ID, but I really want to be able to use a non-Apple email address with my iCloud mail. Just about every email service (Gmail, Hotmail, etc) allows you to send from a third-party address (once you've done a security verification) so that you don't have to change your email address when switching services. iCloud seems to have no such option. Is there any way round this, or any way to put pressure on Apple to add this basic feature???

rdepom wrote:
Is there any way round this
I'm afraid not
or any way to put pressure on Apple to add this basic feature???
http://www.apple.com/feedback/icloud.html - but I don't think it's very likely they'll change it.

How do I use Address Book to print multiple labels using just one address?

Hi. I'm trying to print multiple address labels using the same address on each label, but I'm stuck trying to make this happen in Address Book. Can anyone help?
Thanks!

The work-around that I've found to solve this issue is to create a new group in address book, then duplicate the contact 20 times or so, and drag the duplicates to the group you've created. Then, when you go to print, you will have a sheet of 20 or so duplicate labels. If you want to save it to repeat this task later, you can select "save as PDF" in the print menu, and simply print the PDF file next time. (assuming you use the same size labels next time, of course) Then, don't forget to delete the umteen duplicates from address book, taking care not to delete the original.
Not the perfect solution, but it gets the job done. Maybe somebody wants to make an automator action that will do this?

My new laptop says another computer is using my ip address. How do I stop this? I was trying to get all of my stuff off my parents desktop IMAC and think I screwed something up with the wifi because now my laptop won't connect to wifi

I bought my own laptop (Macbook Pro) and set it up and am using wifi that my parents use on their computer. Everything was working great until I wanted to put my itunes from the desktop to my laptop. I used my Mom's sign on of her apple id and since then when I log on to my laptop it says another computer is using my ip address...what do I do? Thanks!

Hey there Toni D.,
I suggest the troubleshooting outlined in this article here:
Wi-Fi: How to troubleshoot Wi-Fi connectivity
http://support.apple.com/kb/HT4628?viewlocale=en_US
Does the symptom occur with more than one Wi-Fi device?
Wi-Fi issues may be related to the network in question or they may be related to the Wi-Fi computer joining that network. Usually, if other computers or devices (such as the Apple TV or iPhone) are able to get on the Internet without issues, then your Wi-Fi router is probably fine.
If you only have one Wi-Fi device, proceed with this article.
Make sure your software is up-to-date.
Install all software updates available for your Mac.
If you use a third-party Wi-Fi router, check with the manufacturer to confirm that it has the latest firmware installed. If an update is available, follow the manufacturer's instructions for updating the firmware.
To determine if your Apple Wi-Fi base station firmware is up-to-date, see Updating your software.
Check your connections.
Some networking issues may be caused by loose or disconnected cables. Verify that all Ethernet and power cables connected between your modem and your Wi-Fi router are correct. Checking that devices such as your router and modem are on, disconnecting and carefully reconnecting Ethernet cables, and/or replacing damaged Ethernet cables may resolve the issue without any further troubleshooting.
Verify that you are using the recommended settings for your device.See Recommended settings for Wi-Fi routers and access points.
Restart your network devices.Powering your modem or router off for a few seconds and then on again may resolve network issues without any additional troubleshooting. If you have phone service through your ISP, power cycling your modem may interrupt that service. You may need to contact your ISP in order to restore your phone service if your modem is reset or powered off. Ensure that you have alternative means to contact your ISP (such as a cell phone) to avoid unnecessary delays in restoring your Internet or phone service
And if this does not get the network connection going again I would use the troubleshooting from down the bottom in the section labeled Symptom: My Mac does not connect to the Internet.
Take care,
Sterling

SVC WebVPN (clientless) uses IP pool addressing or ASA inside interface IP

Similar Messages

Maybe you are looking for