https://mattdrew.net/tags/vpn/ Recent content in Vpn on Matt's Blog Hugo en-us Mon, 08 Mar 2021 00:00:00 +0000 https://mattdrew.net/posts/pbr-umbrella/ Mon, 08 Mar 2021 00:00:00 +0000 https://mattdrew.net/posts/pbr-umbrella/ <p>Network requirement: Stringent control over web traffic, even over clients that are not using the Umbrella roaming security client. Force internal to external web traffic to use the proxy. Exert absolute dominance over your office users!</p> <p>Scratch that last bit, but it DOES feel good, doesn’t it? Let’s get to cracking.</p> <p>Configuring the Umbrella tunnel ‘A side’</p> <p>This guide assumes you have already set up the Umbrella side of the tunnel using the below guide. It is a very simple procedure even without the guide so I’m not going to repeat it here. Your public IP must be configured so that they know to expect the incoming connection. You must also set your tunnel key which must be matched in the config below.</p> https://mattdrew.net/posts/asa-dst/ Thu, 09 Jul 2020 00:00:00 +0000 https://mattdrew.net/posts/asa-dst/ <div class="retro-alert retro-alert-warning"><div class="retro-alert-header">Careful</div> <div class="retro-alert-body"><p>Be sure that you are basing your ACL on the most current network lists posted by Microsoft/Zoom. These networks do change, and there are automations not mentioned here that can be used to dynamically update your ACL.</p> </div> </div> <p>CustomerA requires their AnyConnect full tunnel be converted to a dynamic split tunnel to improve cloud conferencing performance and to reduce network congestion.</p> <p>Initial config:</p> <pre tabindex="0"><code>group-policy grpISE internal group-policy grpISE attributes wins-server value 192.200.22.11 192.200.67.32 dns-server value 192.200.22.11 192.200.67.32 vpn-simultaneous-logins 1 vpn-idle-timeout 30 vpn-session-timeout 720 vpn-tunnel-protocol ssl-client ssl-clientless split-tunnel-policy excludespecified split-tunnel-network-list value SplitTunnelACL default-domain value customera.com client-bypass-protocol enable msie-proxy server value 192.200.72.91:80 msie-proxy method no-modify msie-proxy except-list value 127...*;localhost msie-proxy local-bypass enable msie-proxy lockdown disable webvpn anyconnect mtu 1300 anyconnect ssl keepalive 90 anyconnect dpd-interval client 90 anyconnect dpd-interval gateway 90 anyconnect modules value iseposture anyconnect profiles value acVPN type user anyconnect ssl df-bit-ignore enable</code></pre><p>Okay, so it’s a split exclude, excluding only 0.0.0.0/32 via SplitTunnelACL Excluding this address will result in your LAN subnet being excluded from the tunnel.</p>