Cisco 5510 Getting Started Guide - Page 139

Chapter 11 Scenario: SSL VPN Clientless Connections Example Network with Browser-Based SSL VPN Access To minimize the risks involved with SSL certificates: 1. Configure a group policy that consists of all users who need Clientless SSL VPN access and enable it only for that group policy. 2. Limit Internet access for Clientless SSL VPN users, for example, by limiting which resources a user can access using a clientless SSL VPN connection. To do this, you could restrict the user from accessing general content on the Internet. Then, you could configure links to specific targets on the internal network that you want users of Clientless SSL VPN to be able to access. 3. Educate users. If an SSL-enabled site is not inside the private network, users should not visit this site over a Clientless SSL VPN connection. They should open a separate browser window to visit such sites, and use that browser to view the presented certificate. The adaptive security appliance does not support the following features for Clientless SSL VPN connections: • NAT, reducing the need for globally unique IP addresses. • PAT, permitting multiple outbound sessions appear to originate from a single IP address. Example Network with Browser-Based SSL VPN Access Figure 11-1 shows an adaptive security appliance configured to accept SSL VPN connection requests over the Internet using a web browser. 78-19186-01 Cisco ASA 5500 Series Getting Started Guide 11-3