72-145
Cisco ASA 5500 Series Configuration Guide using ASDM
Chapter72 Configuring Clientless SSL VPN
Configuring Bookmarks
When the ASA recognizes one of these six variable strings in an end-user request—in a bookmark or a
post form—it replaces it with the user-specific value before passing the request to a remote server.
Note You can obtain the http-post parameters for any application by performing an HTTP Sniffer trace in the
clear (without the security appliance involved). Here is a link to a free browser capture tool, also called
an HTTP Analyzer: http://www.ieinspector.com/httpanalyzer/downloadV2/IEHttpAnalyzerV2.exe.
Using Variables 1 - 4
The ASA obtains values for the first four substitutions from the SSL VPN Login page, which includes
fields for username, password, internal password (optional), and group. It recognizes these strings in
user requests and replaces them with the value specific to the user before it passes the request on to a
remote server.
For example, if a URL list contains the link,
http://someserver/homepage/CSCO_WEBVPN_USERNAME.html, the ASA translates it to the
following unique links:
•For USER1 the link becomes http://someserver/homepage/USER1.html
•For USER2 the link is http://someserver/homepage/USER2.html
In the following case, cifs://server/users/CSCO_WEBVPN_USERNAME, lets the ASA map a file drive
to specific users:
•For USER1 the link becomes cifs://server/users/USER1
•For USER1 the link is cifs://server/users/USER2
Using Variables 5 and 6
Values for macros 5 and 6 are RADIUS or LDAP vendor-specific attributes (VSAs). These substitutions
let you set substitutions configured on either a RADIUS or an LDAP server.
Using Variables 7 - 10
Each time the ASA recognizes one of these four strings in an end-user request (a bookmark or a post
form), it replaces it with the user-specific value before passing the request to a remote server.
Example 1: Setting a Homepage
The following example sets a URL for the homepage:
•WebVPN-Macro-Value1 (ID=223), type string, is returned as wwwin-portal.example.com
•WebVPN-Macro-Value2 (ID=224), type string, is returned as 401k.com
7 CSCO_WEBVPN_PRIMARY_USERNAME Primary user login ID for double authentication.
8 CSCO_WEBVPN_PRIMARY_PASSWORD Primary user login password for double authentication.
9 CSCO_WEBVPN_SECONDARY_USERNAME Secondary user login ID for double authentication.
10 CSCO_WEBVPN_SECONDARY_PASSWORD Secondary user login ID for double authentication.
Table72-17 Clientless SSL VPN Variables
No. Variable Substitution Definition