74-66
Cisco ASA 5500 Series Configuration Guide using the CLI
Chapter74 Configuring Clientless SSL VPN
Configuring Port Forwarding
For details, go to the Safari, Mac OS X 10.5.3: Changes in client certificate authentication.
•Users of Microsoft Windows Vista who use port forwarding or smart tunnels must add the URL of
the ASA to the Trusted Site zone. To access the Trusted Site zone, they must start Internet Explorer
and choose the Tools > Internet Options > Security tab. Vista users can also disable Protected
Mode to facilitate smart tunnel access; however, we recommend against this method because it
increases the computer’s vulnerability to attack.
•Make sure Sun Microsystems Java Runtime Environment (JRE) 1.5.x or later is installed on the
remote computers to support port forwarding (application access) and digital certificates. If JRE
1.4.x is running and the user authenticates with a digital certificate, the application fails to start
because JRE cannot access the web browser certificate store.
Restrictions
•Port forwarding supports only TCP applications that use static TCP ports. Applications that use
dynamic ports or multiple TCP ports are not supported. For example, SecureFTP, which uses port
22, works over clientless SSL VPN port forwarding, but standard FTP, which uses ports 20 and 21,
does not.
•Port forwarding does not support protocols that use UDP.
•Port forwarding does not support Microsoft Outlook Exchange (MAPI) proxy. However, you can
configure smart tunnel support for Microsoft Office Outlook in conjunction with Microsoft Outlook
Exchange Server.
•A stateful failover does not retain sessions established using Application Access (either port
forwarding or smart tunnel access). Users must reconnect following a failover.
•Port forwarding does not support connections to personal digital assistants.
•Because port forwarding requires downloading the Java applet and configuring the local client, and
because doing so requires administrator permissions on the local system, it is unlikely that users will
be able to use applications when they connect from public remote systems.
The Java applet displays in its own window on the end user HTML interface. It shows the contents
of the list of forwarded ports available to the user, as well as which ports are active, and amount of
traffic in bytes sent and received.
•The port forwarding applet displays the local port and the remote port as the same when the local IP
address 127.0.0.1 is being used and cannot be updated by the clientless SSL VPN connection from
the ASA. As a result, the ASA creates new IP addresses 127.0.0.2, 127.0.0.3, and so on for local
proxy IDs. Because you can modify the hosts file and use different loopbacks, the remote port is
used as the local port in the applet. To connect, you can use Telnet with the host name, without
specifying the port. The correct local IP addresses are available in the local hosts file.
Configuring DNS for Port Forwarding
Port Forwarding forwards the domain name of the remote server or its IP address to the ASA for
resolution and connection. In other words, the port forwarding applet accepts a request from the
application and forwards it to the ASA. The ASA makes the appropriate DNS queries and establishes
the connection on behalf of the port forwarding applet. The port forwarding applet only makes DNS
queries to the ASA. It updates the host file so that when a port forwarding application attempts a DNS
query, the query redirects to a loopback address. Configure the ASA to accept the DNS requests from
the port forwarding applet as follows: