When your An圜onnect client connects to the ASA and you authenticate, it pulls down an An圜onnect client profile. Even if I could disable the proxy (which I couldn’t due to the connections tab being “gone”), that would be a pain in the butt and certainly not an option for regular users. How then could the client know about our proxy?Īs it turns out, An圜onnect by default pulls down the proxy information set in Microsoft Internet Explorer and uses that proxy information to attempt to build the initial tunnel. As I looked through the few options in the An圜onnect client itself, I realized there was no user selectable option to enable or disable a proxy server. WTF? I had not told An圜onnect to connect through a proxy. The IP address of our proxy server was already filled in and it wanted a username, password and domain. Then the problem occured - An圜onnect switched to a new screen I had never seen before asking for proxy credentials. I authenticated just fine as normal, and received my normal login banner.
I needed to access my home network for a second so I fired up An圜onnect as usual and started my session. We also do business with other companies that our users sometimes need to SSL VPN into from inside our network using the Cisco An圜onnect client. Well, I have an ASA firewall at home that runs SSL VPN. Great, so what does that have to do with An圜onnect
What they did is enter the proxy PAC file path in the IE proxy server settings area (under the options/connections tab) and then through group policy actually disabled users from seeing that tab at all, thus preventing people from changing it.
As part of the experimentation phase, the windows guys have also been experimenting with integrating the proxy configuration into MS IE. So, the team here at work has recently been experimenting with a new proxy server service from Cisco Scansafe. I would like to thank Jody Lemoine on twitter) for helping me solve this one! Also, the supporting documentation for much of this is here There were a few posts out there on this, but none that really solidified things for me. I did quite a bit of digging on it myself, and I learned a lot about how Cisco Anyconnect integrates with Microsoft Internet Explorer. I ran into an interesting problem at work yesterday, and wanted to share the solution.
0 kommentar(er)
