Cisco FirePOWER ASA 5500 series Configuration Manual page 865

Appendix B Sample Configurations
access-list maia2 remark -Permits access to the site using ssh.
access-list maia2 remark -To be enforced via Port-Forwarding application.
access-list maia2 webtype permit tcp asa-35.example.com 255.255.255.255 eq ssh
access-list maia2 remark -Denies access to the application on port 1533.
access-list maia2 webtype deny tcp im.example.com 255.255.255.255 eq 1533
access-list maia2 remark -Permits access to files on this file share via
access-list maia2 remark -WebVPN Common Internet File System (CIFS).
access-list maia2 webtype permit url cifs://server-bos/people/mkting log informational
3600
You can configure a list of pre-configured URLs presented on the WebVPN user's home page after login,
Step 3
which are defined per user or per group.
url-list HomeURL "Sales" https://sales.example.com
url-list HomeURL "VPN3000-1" http://vpn3k-1.example.com
url-list HomeURL "OWA-2000" http://10.160.105.2/exchange
url-list HomeURL "Exchange5.5" http://10.86.195.113/exchange
url-list HomeURL " Employee Benefits" http://benefits.example.com
url-list HomeURL "Calendar" http://http://eng.example.com/cal.html
Configure a list of non-web TCP applications that will be port-forwarded over WebVPN and enforced
Step 4
per user or per group-policy. These are defined globally but can be enforced per user or per group-policy.
port-forward Apps1 4001 10.148.1.81 telnet term-servr
port-forward Apps1 4008 router1-example.com ssh
port-forward Apps1 10143 flask.example.com imap4
port-forward Apps1 10110 flask.example.com pop3
port-forward Apps1 10025 flask.example.com smtp
port-forward Apps1 11533 sametime-im.example.com 1533
port-forward Apps1 10022 secure-term.example.com ssh
port-forward Apps1 21666 tuscan.example.com 1666 perforce-f1
port-forward Apps1 1030 sales.example.com https
Step 5 Configure the policy attributes enforced for users of the SSLVPNusers group-policy.
group-policy SSLVPNusers internal
group-policy SSLVPNusers attributes
banner value Welcome to Web Services !!!
vpn-idle-timeout 2
vpn-tunnel-protocol IPSec webvpn
webvpn
Next, configure the interface(s) where ASDM and WebVPN HTTPS sessions will terminate. Note that
Step 6
simultaneous ASDM/WebVPN use on the same interface is not supported.
! Enables the HTTP server to allow ASDM and WebVPN HTTPS sessions.
http server enable
! Allows ASDM session(s) from host 10.20.30.47 on the inside interface ; WebVPN sessions
! are not allowed on this interface.
http 10.10.10.45 inside
! Allows WebVPN sessions on outside interfce using HTTP to be re-directed to HTTPS.
! ASDM session is not allowed on this interface.
http redirect outside 80
! Allows WebVPN sessions on dmz1 interfce using HTTP to be re-directed to HTTPS.
! ASDM session is not allowed on this interface.
http redirect dmz161 80
Step 7 Next, allow HTTPS ASDM and WebVPN sessions to terminate on the security appliance using the
3DES-sha1 cipher. Requires that a proper 3DES activation-key be previously installed.
ssl encryption 3des-sha1
OL-10088-01
functions url-entry file-access file-entry file-browsing port-forward filter
url-list value HomeURL
port-forward value Apps1
Cisco Security Appliance Command Line Configuration Guide
Example 5: WebVPN Configuration
B-17