72-54
Cisco ASA 5500 Series Configuration Guide using ASDM
Chapter72 Configuring Clientless SSL VPN
Configuring Port Forwarding
•Make sure Sun Microsystems Java Runtime Environment (JRE) 1.5.x or later is installed on the
remote computers to support port forwarding (application access) and digital certificates. If JRE
1.4.x is running and the user authenticates with a digital certificate, the application fails to start
because JRE cannot access the web browser certificate store.
Restrictions
•Port forwarding supports only TCP applications that use static TCP ports. Applications that use
dynamic ports or multiple TCP ports are not supported. For example, SecureFTP, which uses port
22, works over clientless SSL VPN port forwarding, but standard FTP, which uses ports 20 and 21,
does not.
•Port forwarding does not support protocols that use UDP.
•Port forwarding does not support Microsoft Outlook Exchange (MAPI) proxy. However, you can
configure smart tunnel support for Microsoft Office Outlook in conjunction with Microsoft Outlook
Exchange Server.
•A stateful failover does not retain sessions established using Application Access (either port
forwarding or smart tunnel access). Users must reconnect following a failover.
•Port forwarding does not support connections to personal digital assistants.
•Because port forwarding requires downloading the Java applet and configuring the local client, and
because doing so requires administrator permissions on the local system, it is unlikely that users will
be able to use applications when they connect from public remote systems.
The Java applet displays in its own window on the end user HTML interface. It shows the contents
of the list of forwarded ports available to the user, as well as which ports are active, and amount of
traffic in bytes sent and received.
•The port forwarding applet displays the local port and the remote port as the same when the local IP
address 127.0.0.1 is being used and cannot be updated by the clientless SSL VPN connection from
the ASA. As a result, the ASA creates new IP addresses 127.0.0.2, 127.0.0.3, and so on for local
proxy IDs. Because you can modify the hosts file and use different loopbacks, the remote port is
used as the local port in the applet. To connect, you can use Telnet with the host name, without
specifying the port. The correct local IP addresses are available in the local hosts file.
Configuring DNS for Port Forwarding
Port Forwarding forwards the domain name of the remote server or its IP address to the ASA for
resolution and connection. In other words, the port forwarding applet accepts a request from the
application and forwards it to the ASA. The ASA makes the appropriate DNS queries and establishes
the connection on behalf of the port forwarding applet. The port forwarding applet only makes DNS
queries to the ASA. It updates the host file so that when a port forwarding application attempts a DNS
query, the query redirects to a loopback address.
Step1 Click Configuration > Remote Access VPN > Clientless SSL VPN Access > Connection Profiles.
The DefaultWEBVPNGroup entry is the default connection profile used for clientless connections.
Step2 Highlight the DefaultWEBVPNGroup entry, then click Edit if your configuration uses it for clientless
connections. Otherwise, highlight a connection profile used in your configuration for clientless
connections, then click Edit.
The Basic window opens.