VPN remote site tunnel-all with web and email filtering at core

I'm helping a client setup a 'tunnel-all' VPN from remotes to the core. That's not difficult - there's enough commentary in the community and I can set it up in the lab. The rub comes with the location of the web filter box in particular - it's currently in-line with the inside interface of the ASA.
What does the topology for a typical tunnel-all VPN with web filtering at the core look like? Can't put my hands on any quickly.
We only have one ISP conn at this time. I have a layer-3 switch at the core too.
Thx

Hi,
Thats a good question.
I haven't thought about this part of VPN filtering much as I've usually had to open only a few ports. But if you really need to open all traffic from local to remote, you will also be doing the same for the other direction in the same ACL ACE rule.
The only thing I can come up with right now is to stop using VPN Filter list and change the "sysopt" setting so that ASA wont let VPN traffic past the outside interface without checing the outside interface ACL
The Configuration command (8.2) is the following:
sysopt connection permit-vpn
For traffic that enters the adaptive security appliance through a VPN tunnel and is then decrypted, use the sysopt connection permit-vpn command in global configuration mode to allow the traffic to bypass interface access lists. Group policy and per-user authorization access lists still apply to the traffic. To disable this feature, use the no form of this command. sysopt connection permit-vpn no sysopt connection permit-vpn
Though if you change this setting, you will have to take this into account with every VPN Client or L2L VPN you have configured so far.
After this you can create rules on your outside interface access-list to limit remote user access to your local network. From local to remote networks you can use the access-lists assigned to each interface in question.
Hope this helps
- Jouni

Similar Messages

I want to upgrade my iphone and want to make sure that all my phone and email contacts along with my photos and music get transfered to new phone. How do I go about doing that?

I want to upgrade my iphone and want to make sure that all my phone and email contacts get transfered along with my photos, videos and music to new phone. How do I go about doing that?

http://support.apple.com/kb/ht2109

My blogger sites are all messed up, and seem to be corupted.

my blogger sites are all messed up, and seem to be corrupted.

Try running Keychain First Aid and resetting the original keychain.
Keychain Reset
Keychain Issues - Resolve see post by Kappy

Multipe discussion boards within one site collection, each with their own email?

So we use several list servs and these have become an issue and the data is lost discussion based on you cannot collectively house and search for information and attachments.
I have a few questions that maybe you could help in my research:
1) Is SharePoint discussions capable of having multiple discussion boards in one site collection, each with their own email address to replace the function of a list serv (so at a minimum content can be organized, with attachments available, and replies
can be seen/sent via email.)
2) From an attachment perspective; what is the best way to ensure virus blocking in the above scenario IF the above scenario is able to be done
3) Is there OOTB functionality here or is there a recommended third party product? (I am not looking to build out a custom solution if at all possible to avoid that)
any thoughts or input here would be greatly appreciated!
~Kat

1) - Yes, discussion boards are just specially formatted lists and yes, each discussion board can have their own email address.
2) - Blocked file types can be configured in CA and I believe that SP will strip out any emails with blocked file types attached (not 100% on that, probably 95% sure)
3) All out of the box (assuming SP will block the attachments as I assumed in #2

Upgrading from 7.5 to version 8: Web and Email Collaboration problem

Hi All;
To be able to upgrade from 7.5 to version 8.x then the web and email collaboration should be removed and this is the hard thing !
To go through all the web collaboration objects and remove it one after one is something not possible, special when I am trying to remove for example an agent who is belonging to the skill group and it gives us: you do not have a permission !!
So I decided to do a clean at the database level (specially that the problem appears when running EDMT), I need a help to know the following to be able to do this cleaning:
1) Should I do this in the side_A database or on the AWDB?
2) If I removed the Application Instance that is related to the Collaboration, could this resolve the problem to do the upgrade from version 7.5 to 8.x? Or I have to delete all the values related to the Collaboration (for example, the media class, the used skill group and the used agents, ... etc)?
Looking to a help PLZ.
Regards
Bilal

Hi All;
To be able to upgrade from 7.5 to version 8.x then the web and email collaboration should be removed and this is the hard thing !
To go through all the web collaboration objects and remove it one after one is something not possible, special when I am trying to remove for example an agent who is belonging to the skill group and it gives us: you do not have a permission !!
So I decided to do a clean at the database level (specially that the problem appears when running EDMT), I need a help to know the following to be able to do this cleaning:
1) Should I do this in the side_A database or on the AWDB?
2) If I removed the Application Instance that is related to the Collaboration, could this resolve the problem to do the upgrade from version 7.5 to 8.x? Or I have to delete all the values related to the Collaboration (for example, the media class, the used skill group and the used agents, ... etc)?
Looking to a help PLZ.
Regards
Bilal

Using Mac email program with Web-based email

I'm wondering if there is a way to use the Mac email program with Web-based email (like Gmail, etc).
If this is possible then how can I set up my system.
Thanks much.

Yes you can use gmail using Mail software.
Following is prosidure:
1)-Login to ur gmail A/s
- Go to settings click Forward POP Settings the click Enable POP and click Save.
2) open mail-POP settings
-Type your Email address, Password,
Incoming server:pop.gmail.com
SMTP server: smtp.gmail.com
Type and give the Bolded server in specified path
and follow the instruction.

Why am I all of a sudden getting all my text and email notifications in Spanish? How do I change back to English? Can't find in profile settings?!

Why am I all of a sudden getting all my text and email notifications in Spanish? How do I switch back to English? I can't find that option in profile or notification settings . . .

elliew,
That's a great point! If all other messages and apps on your phone are in English, the preferred language may need to be updated on your account. If this is the case for any of our customers, just reach out to our customer support team at 800-922-0204 or http://vz.to/1vsIHJq .
BrianP_VZW
Follow Us on Twitter @VZWSupport

How can i transfer all my datas and email form old Mac G5 to new iMac ?

How can i transfer all my datas and email form old Mac G5 to new iMac ?

Generally Mugration Assistant will suffice importing all Data ito a new user, but you can manually import it...
Users/YourUserName/Library/Mail
Users/YourUserName/Library/Mail Downloads
(Could be a different folder here if you chose such in Mail Prefs)

HT201415 lost all my contacts and email

Hi There ,
Lost all my contacts and emails just want to restore back!
thank you
josefa

If you had never synced it before, you may have the options for "Sync Address Book Contacts" selected and not have your contacts in your address book on your computer. Hopefully you have a backup of your contacts somewhere that you can restore to (iCloud Maybe?). BTW, if you plug in your iPhone to your computer, open iTunes and click your phone. (Whatever you named it) You can click the second option name "Info" and see your options for contacts calendars, etc..

Poor performance with WebI and BW hierarchy drill-down...

Hi
We are currently implementing a large HR solution with BW as backend
and WebI and Xcelcius as frontend. As part of this we are experiencing
very poor performance when doing drill-down in WebI on a BW hierarchy.
In general we are experiencing ok performance during selection of data
and traditional WebI filtering - however when using the BW hierarchy
for navigation within WebI, response times are significantly increasing.
The general solution setup are as follows:
1) Business Content version of the personnel administration
infoprovider - 0PA_C01. The Infoprovider contains 30.000 records
2) Multiprovider to act as semantic Data Mart layer in BW.
3) Bex Query to act as Data Mart Query and metadata exchange for BOE.
All key figure restrictions and calculations are done in this Data Mart
Query.
4) Traditionel BO OLAP universe 1:1 mapped to Bex Data Mart query. No
calculations etc. are done in the universe.
5) WebI report with limited objects included in the WebI query.
As we are aware that performance is an very subjective issues we have
created several case scenarios with different dataset sizes, various
filter criteria's and modeling techniques in BW.
Furthermore we have tried to apply various traditional BW performance
tuning techniques including aggregates, physical partitioning and pre-
calculation - all without any luck (pre-calculation doesn't seem to
work at all as WebI apparently isn't using the BW OLAP cache).
In general the best result we can get is with a completely stripped WebI report without any variables etc.
and a total dataset of 1000 records transferred to WebI. Even in this scenario we can't get
each navigational step (when using drill-down on Organizational Unit
hierarchy - 0ORGUNIT) to perform faster than minimum 15-20 seconds per.
navigational step.
That is each navigational step takes 15-20 seconds
with only 1000 records in the WebI cache when using drill-down on org.
unit hierachy !!.
Running the same Bex query from Bex Analyzer with a full dataset of
30.000 records on lowest level of detail returns a threshold of 1-2
seconds pr. navigational step thus eliminating that this should be a BW
modeling issue.
As our productive scenario obviously involves a far larger dataset as
well as separate data from CATS and PT infoproviders we are very
worried if we will ever be able to utilize hierarchy drill-down from
WebI ?.
The question is as such if there are any known performance issues
related to the use of BW hierarchy drill-down from WebI and if so are
there any ways to get around them ?.
As an alternative we are currently considering changing our reporting
strategy by creating several higher aggregated reports to avoid
hierarchy navigation at all. However we still need to support specific
division and their need to navigate the WebI dataset without
limitations which makes this issue critical.
Hope that you are able to help.
Thanks in advance
/Frank
Edited by: Mads Frank on Feb 1, 2010 9:41 PM

Hi Henry, thank you for your suggestions although i´m not agree with you that 20 seconds is pretty good for that navigation step. The same query executed with BEx Analyzer takes only 1-2 seconds to do the drill down.
Actions
suppress unassigned nodes in RSH1: Magic!! This was the main problem!!
tick use structure elements in RSRT: Done it.
enable query stripping in WebI: Done it.
upgrade your BW to SP09: Has the SP09 some inprovements in relation to this point ?
use more runtime query filters. : Not possible. Very simple query.
Others:
RSRT combination H-1-3-3-1 (Expand nodes/Permanent Cache BLOB)
Uncheck prelimirary Hierarchy presentation in Query. only selected.
Check "Use query drill" in webi properties.
Sorry for this mixed message but when i was answering i tryied what you suggest in relation with supress unassigned nodes and it works perfectly. This is what is cusing the bottleneck!! incredible...
Thanks a lot
J.Casas

Dreamweaver creating duplicate sites when working with Contribute and CPS

I've set up many websites with Dreamweaver for a Contribute/CPS environment and each time I edit the Contribute admin setting and save them, Dreamweaver created a duplicate of that site. Then when I go into edit the Contribute admin settings again, it will not let me in, saying that there is already a site with that name. I then have to delete one of the duplicates which sometimes removes the connection to CPS. Has anyone else experienced this in a multi-site, multi-user environment with CPS??? See attached image to see the duplicate sites.

I have had the same problem.
Had Dreamweaver support on the phone yesterday, after receiving this email:
Please try resetting the preferences for Dreamweaver. Follow the steps given below.
/Users/Your User Name/Library/Preferences/Adobe Dreamweaver CC Prefs
/Users/Your User Name/Library/Preferences/com.adobe.Dreamweaver.13.0.plist
/Users/Your User Name/Library/Application Support/Adobe/Dreamweaver CC
/Users/Your User Name/Library/Application Support/Caches/ com.adobe.Dreamweaver.13.0
Macintosh /Library/Preferences/ Application Support/Adobe/Dreamweaver CC Prefs (if any)
Macintosh /Library/Preferences/com.adobe.Dreamweaver.13.0.plist
Note: Follow the help doc to access user library.
If this does not help can you please send me details below to isolate the issue further.
1)      Step by step workflow to reproduce the issue.
2)      Is this happening with multiple files? Few sample files to test the issue at my end.
3)      Complete System Information file of the computer having issues.
4)      Were there any H/w or S/w changes applied on the computer having issues. Since when are you getting this issue?
5)      Is the user on domain account or local user? Do they have admin rights?
6)      You BC site details, including FTP address, Login credentials.
After our telephone conversation:
I deleted all sites.
I have completely deleted all versions of Dreamweaver, deleted all preference files and reinstalled Dreamweaver CC.
It's still happening, so I will be back to them tomorrow.
Sorta glad it's not just me!!

Flex Application architecture with web and air interface both using common components.

We have a flex based e-learning application. It uses HTTP REST service and webservice to communicate with ASP.Net application to fetch and store data.
We now want to develop an adobe air version of the user interface, which the students can download on their desktop as well as mobiles (Android, others).
What would be a good architecture for such an application which has both web and windows interface. I can see that we can reuse almost 80% of the code of our web version. But I do not want to copy and create a new windows app from the flex web app. I would want to have both co-exist.
Let me know a good article that I can read on this.

I dug deeper and found the concept of Shared Common Library. I am trying to implement that.

Role creation: SAP ALL with SU01 and PFCG in display only

hi all,
I am looking for the easiest way to create a "sap all " like role with SU01 and PFCG in display only.
i found several solutions, which sound very complicated.
Thank you in advance,
Julien

Hi,
As per your query there is not profile of SAP to give display authorisation, for this you have to create new profile on module wise and assign to user.
Anil

Can't send mail with web based email (ipad)

My son is trying to set up his work based website email to his ipad home screen so he can directly send and receive emails.
He has set it up and he can receive emails but he can't send emails.
His web based mail (Mr Site) does not have an outgoing SMTP server and I have contacted BT who were less than helpful, he just said to use mail.btinternet.com but he still can't get it to work.
Any ideas please?

lavenderjade wrote:
My son is trying to set up his work based website email to his ipad home screen so he can directly send and receive emails.
He has set it up and he can receive emails but he can't send emails.
His web based mail (Mr Site) does not have an outgoing SMTP server and I have contacted BT who were less than helpful, he just said to use mail.btinternet.com but he still can't get it to work.
Any ideas please?
Hi. Welcome to the forums.
He will need to go through something called address verification using his BTinternet email address. See my shortcuts, option 0e. IN essence it needs the work email account associated with a BTinternet email address, then in his iPad mail client (or indeed via BTYahoo! webmail) he should be able to send emails "From" the non BTinternet account. Webmail is easy, but in a mail client it needs extra steps to get the smtp area correct.
If he doesn't have a BTinternet email address, then he will need one - which can be a sub account off of your primary.
http://www.andyweb.co.uk/shortcuts
http://www.andyweb.co.uk/pictures

TS2776 Was synking my I-phone for the first time and lost all my phone and email contacts. Previously have just been synking I-pod music. How can I restore my i-phone information?

I was synking my I-phone 4 for the first time. After synking I lost all phone and email contacts. How can I restore or undo the synking process?

If you have a backup, you can restore your last backup with itunes.
Regards,
Giuseppe Pignataro

VPN remote site tunnel-all with web and email filtering at core

Similar Messages

Maybe you are looking for