I would like to configure our ASA 5520 so that clientless SSL VPN connections can browse the internet. In essence, I'd like to use the ASA as a secure proxy for browsing the web.
I already have several VPN groups configured and it does work for accessing the internal resources for those groups.
I'm assuming that I create a new VPN group and configure it accordingly.
How do I route *all* traffic to the internet via the ASA?
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
cstosgale,
Thanks for the post, and I apologize for not getting back into this sooner; other issues took precedence to this one.
You are correct in that a user can use the URL entry bar to browse any URL, including internet URLs. However, this behavior is still controlled by the ACLs which define what traffic is being sent across the tunnel.
I was able to achieve what I wanted to by creating a new group and not configuring split-tunneling.
Thanks, anyway.
Business Accounts
Answer for Membership
by: cstosgalePosted on 2009-03-16 at 15:23:37ID: 23903080
Without using the SSL VPN client, you could simply use the URL entry bar in the portal to allow the user to enter any URL, including internet URLs. This will allow the ASA to proxy traffic destined for the internet. Alternatively, you could even set up google as the home page for the VPN group (via group policy) and then anything they browse to via google would be going through the SSL VPN.
As an alternative you could create a smart tunnel for internet explorer but this would require and activex download I believe.
One question, why do you want to do this? They may be a more elegant way of achieving this.