Solved: redirect Web SSL VPN to another outside ip possible?

born.jason · ‎09-29-2010

Hi it is possible to redirect the web ssl vpn to another outside ip from my external range or could i only use the outside interface?

For example:

ASA outside: 213.23.4.50 (https://213.23.4.50)

Redirect to oustide: 213.23.4.51 (https://213.23.4.51)

same question for redirect the vpn client external ip to another than the outside ip of asa.

regards

jason

Marcin Latosiewicz · ‎09-30-2010

Jason,

Fairly easy

bsns-asa5520-10(config)# webvpn
bsns-asa5520-10(config-webvpn)# port ?

webvpn mode commands/options:
<1-65535> The WebVPN server's SSL listening port. TCP port 443 is the
default.

Please note though that your users will have to use

https://My.domain.tld:PORT

to connect ... same for clientless and SVC.

Marcin

View solution in original post

Marcin Latosiewicz · ‎09-29-2010

Jason,

As far as I know ASA willonly terminate on interface IP which you enable under webvpn (unlike IOS ...)

But I may have pre-8.x knowledge on this.

What would be the point?

Marcin

born.jason · ‎09-30-2010

Thanks for the answer Marcin.

The point is that on the same IP (outside) https is enable for exchange webmail (owa).

and if i connect through the ssl vpn ip i connect to the exchange iis and not ssl vpn login side..... is there a solution for that or do i have to re adress the dns mail record or change the outside ip of the asa and change the nat rules?

Marcin Latosiewicz · ‎09-30-2010

Jason,

Wouldn't you rather consider moving your webvpn to a different TCP port than moving whole IP?

If that's not a possibility, changing your NAT + MX records to accmodate exchange on different IP would be more approachable solution.

Marcin

born.jason · ‎09-30-2010

thats a good idea. How could i move the port?

Marcin Latosiewicz · ‎09-30-2010

Jason,

Fairly easy

bsns-asa5520-10(config)# webvpn
bsns-asa5520-10(config-webvpn)# port ?

webvpn mode commands/options:
<1-65535> The WebVPN server's SSL listening port. TCP port 443 is the
default.

Please note though that your users will have to use

https://My.domain.tld:PORT

to connect ... same for clientless and SVC.

Marcin

born.jason · ‎10-01-2010

thanks Marcin.