Cisco SA520-K9 Administration Guide - Page 166

Configuring the SSL VPN Client, Full Tunnel Mode, > SSL VPN Client > SSL VPN Client

Get Cisco SA520-K9 - SA 500 Series Security Appliances PDF manuals and user guides
UPC - 882658266744
View all Cisco SA520-K9 manuals
Add to My Manuals
Save this manual to your list of manuals

Page 166 highlights

Configuring VPN Configuring SSL VPN for Browser-Based Remote Access 7 Make sure that the virtual (PPP) interface address of the VPN tunnel client does not conflict with the address of any physical devices on the LAN. The IP address range for the SSL VPN virtual network adapter should be either in a different subnet or non-overlapping range as the corporate LAN. If the SSL VPN client is assigned an IP address in a different subnet than the corporate network, a client route must be added to allow access to the private LAN through the VPN tunnel. In addition, a static route on the private LAN's firewall (typically this security appliance) is needed to forward private traffic through the VPN Firewall to the remote SSL VPN client. NOTE As in any IPsec tunnel deployment, the two networks that are joined by the tunnel must use different IP address ranges in their subnets. The security appliance allows Full Tunnel and Split Tunnel support. • Full Tunnel Mode: The VPN Tunnel handles all traffic that is sent from the client. • Split Tunnel Mode: The VPN Tunnel handles only the traffic that is destined for the specified destination addresses in the configured client routes. These client routes give the SSL client access to specific private networks, thereby allowing access control over specific LAN services. Configuring the SSL VPN Client STEP 1 Click VPN > SSL VPN Client > SSL VPN Client. The SSL VPN Client window opens. STEP 2 Enter the following information: • Enable Split Tunnel Support: Check this box to enable Split Tunnel Mode Support, or uncheck this box for Full Tunnel Mode Support. With Full Tunnel Mode, all of the traffic from the host is directed through the tunnel. By comparison, with Split-Tunnel Mode, the tunnel is used only for the traffic that is specified by the client routes. NOTE If you enable Split Tunnel Support, you also will need to configure SSL VPN Client Routes. After you complete this procedure, see Configuring Client Routes for Split Tunnel Mode, page 167. • DNS Suffix (Optional): Enter the DNS Suffix for this client. • Primary DNS Server (Optional): Enter the IP address of the primary DNS Server for this client. Cisco SA500 Series Security Appliances Administration Guide 166

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
  • 145
  • 146
  • 147
  • 148
  • 149
  • 150
  • 151
  • 152
  • 153
  • 154
  • 155
  • 156
  • 157
  • 158
  • 159
  • 160
  • 161
  • 162
  • 163
  • 164
  • 165
  • 166
  • 167
  • 168
  • 169
  • 170
  • 171
  • 172
  • 173
  • 174
  • 175
  • 176
  • 177
  • 178
  • 179
  • 180
  • 181
  • 182
  • 183
  • 184
  • 185
  • 186
  • 187
  • 188
  • 189
  • 190
  • 191
  • 192
  • 193
  • 194
  • 195
  • 196
  • 197
  • 198
  • 199
  • 200
  • 201
  • 202
  • 203
  • 204
  • 205
  • 206
  • 207
  • 208
  • 209
  • 210
  • 211
  • 212
  • 213
  • 214
  • 215
  • 216
  • 217
  • 218
  • 219
  • 220
  • 221
  • 222
  • 223
  • 224
  • 225
  • 226
  • 227
  • 228
  • 229
  • 230
  • 231
  • 232
  • 233
  • 234
  • 235
  • 236
  • 237
  • 238
  • 239
  • 240
Configuring VPN
Configuring SSL VPN for Browser-Based Remote Access
Cisco SA500 Series Security Appliances Administration Guide
166
7
Make sure that the virtual (PPP) interface address of the VPN tunnel client does not
conflict with the address of any physical devices on the LAN. The IP address
range for the SSL VPN virtual network adapter should be either in a different
subnet or non-overlapping range as the corporate LAN.
If the SSL VPN client is assigned an IP address in a different subnet than the
corporate network, a client route must be added to allow access to the private
LAN through the VPN tunnel. In addition, a static route on the private LAN’s firewall
(typically this security appliance) is needed to forward private traffic through the
VPN Firewall to the remote SSL VPN client.
NOTE
As in any IPsec tunnel deployment, the two networks that are joined by the tunnel
must use different IP address ranges in their subnets.
The security appliance allows Full Tunnel and Split Tunnel support.
•
Full Tunnel Mode:
The VPN Tunnel handles all traffic that is sent from the
client.
•
Split Tunnel Mode:
The VPN Tunnel handles only the traffic that is destined
for the specified destination addresses in the configured client routes.
These client routes give the SSL client access to specific private networks,
thereby allowing access control over specific LAN services.
Configuring the SSL VPN Client
STEP 1
Click
VPN
> SSL VPN Client > SSL VPN Client
.
The SSL VPN Client window opens.
STEP 2
Enter the following information:
•
Enable Split Tunnel Support:
Check this box to enable Split Tunnel Mode
Support, or uncheck this box for Full Tunnel Mode Support. With Full Tunnel
Mode, all of the traffic from the host is directed through the tunnel. By
comparison, with Split-Tunnel Mode, the tunnel is used only for the traffic that
is specified by the client routes.
NOTE
If you enable Split Tunnel Support, you also will need to configure SSL
VPN Client Routes. After you complete this procedure, see
Configuring
Client Routes for Split Tunnel Mode, page 167
.
•
DNS Suffix (Optional):
Enter the DNS Suffix for this client.
•
Primary DNS Server (Optional):
Enter the IP address of the primary DNS
Server for this client.