ASA 5510 split-tunneling with ssl vpn

[burtsbees]

Are there really any issues these days with split tunneling in an ASA 5510 with a good firewall config behind it? The only issue I ever knew of with split tunneling was that a vpn connected user would then also be connected to the insecure network known as the internet, and could potentially be a gateway for a hacker/cracker to jump through the vpn...

Burt

 

[garnetbobcat]

The concern about becoming a conduit into the VPN is the most prominent one I can think of.

A slightly more secure possibility is to allow Local LAN Access:

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080702992.shtml

You put "ssl vpn" in your title. Is there an SSL angle here that I missed?

Matt
CCIE Security

http://www.wr-mem.com

 

[burtsbees]

Actually, maybe there's an ssl angle that I missed...as far as I can tell, the only difference between a regular remote-access vpn and an ssl vpn is the way they authenticate (like username/password), and the ssl vpn seems more user friendly and there is no need to install the Cisco VPN Client on each machine (it gets installed through the web vpn). Is this all correct?
Our users where I work are now going to connect to the company vpn via ssl vpn configured in a new ASA 5510, and some were not able to connect to the internet (to still receive emails, mainly) when connected to the VPN. The document you provided seems very similar to the "include-local-lan" command under the "crypto isakmp client configuration group" command in a router when configuring a remote-access vpn in a router. I advised that they do not split-tunnel, but was really unaware of an alternative. Thanks for the response.

Burt

 

[garnetbobcat]

Burt,

Be cautious when you say "difference...is they way they authenticate". All the VPN types can use the same methods to authenticate, like RADIUS, TACACS+, LDAP, etc.

That said, SSL VPN users often authenticate at the ASA's webpage, but if you have a profile configured locally you can connect an AnyConnect client without needing to browse to the ASA. Meanwhile, IPsec client users must authenticate within the IPsec client.

We had a discussion about the different types of VPN, here:

http://www.tek-tips.com/viewthread.cfm?qid=1444519&page=1

"include-local-lan" looks like the same thing to me. Referenced here:

http://www.cisco.com/en/US/docs/rou...e_manager/24/software/user/guide/EZVPN-S.html

Matt
CCIE Security

http://www.wr-mem.com