up vote 0 down vote favorite
share [g+] share [fb]

I would like internal users to be able to connect to the ASA's outside interface https server, to be able to download the AnyConnect client while in the office. Currently, this isn't working.

I've setup a static NAT entry with internal sources, and the outside/tcp/https as the destination. We've got an allow any any ACL on the inside interface. On the outside interface ACL, I've added ACEs for internal traffic to the outside interface https.

Running Wireshark from my workstation, I am seeingg RST, ACKs from the ASA when trying to connect to the https server.

link|improve this question
feedback

2 Answers

up vote 0 down vote

Why not just have the HTTPS service listen on the inside interface, too, and have them connect to that address instead?

http 10.0.0.0 255.0.0.0 inside

If you do need to keep having them try to connect to the outside interface for some reason, then configuring it to allow the cross-interface input to there might do the trick:

management-access outside
link|improve this answer
To clarify, it's the webvpn service's https listener that I'm talking about, rather than the management https listener. It's possible that what I want won't work in the way I want to do it. – bill Jan 4 at 20:42
I'd say still try the management-access command. – Shane Madden Jan 4 at 20:53
feedback
up vote 0 down vote

(not exactly what you're looking for...)

I provide a 'public' wifi network for guests. (on a cheap dsl or cable line)

This gives you a completely segmented environment for visitors AND can be used to test an verify things like VPN connectivity.

Doing something similar may help you.

Alternatively a tethered phone or mifi device can help.

link|improve this answer
:) Actually, we've got another ISP, that we can, and have, used for things like this. To date, it involved a physical jack connection. But, good point on making it wifi enabled. That could be useful. But, you're right, it's not exactly what I was hoping for. Mostly just because we've got a doc circulated to users to download the client, and I just want to keep it simple for them. I.e. I want the same url to work regardless of location. I guess I could put an internal DNS entry to send the link over the 2nd ISP connection... hmmm... that might work. – bill Jan 4 at 20:40
if it's always downloading the same content, you could also just host it somewhere internally to avoid having to hit the ASA at all. (maybe include it in your stock system install image?) – Joel K Jan 5 at 6:09
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.