A network engineer must design an clientless VPN solution for a company. VPN users must be able to access several internal web servers. When reachability to those web servers was tested, it was…

The correct answer is B. Set up a NAT rule that translates the ASA public address to the web server private address on port 80. In Cisco ASA clientless SSL WebVPN, the ASA acts as a reverse proxy that rewrites all web content-URLs, JavaScript, and embedded links-so that remote users can reach internal resources through the HTTPS portal without any VPN client installed. Some complex or JavaScript-heavy…

Remote Access VPN

Question

A network engineer must design an clientless VPN solution for a company. VPN users must be able to access several internal web servers. When reachability to those web servers was tested, it was found that one website is not being rewritten correctly by the ASA. What is a potential solution for this issue while still allowing it to be a clientless VPN setup?

Exhibits

Options

ASet up a smart tunnel with the IP address of the web server.
BSet up a NAT rule that translates the ASA public address to the web server private address on port 80.
CSet up Cisco AnyConnect with a split tunnel that has the IP address of the web server.
DSet up a WebACL to permit the IP address of the web server.

How the community answered

(58 responses)

A
2% (1)
B
84% (49)
C
10% (6)
D
3% (2)

Explanation

In Cisco ASA clientless SSL WebVPN, the ASA acts as a reverse proxy that rewrites all web content-URLs, JavaScript, and embedded links-so that remote users can reach internal resources through the HTTPS portal without any VPN client installed. Some complex or JavaScript-heavy web applications are not handled correctly by this rewriter, causing broken pages or failed access.

When a specific internal web server is not being rewritten correctly, one solution is to configure a static NAT (PAT) rule on the ASA that maps the ASA's public-facing IP address to the internal web server's private IP address on port 80. This allows the problematic server to be reached directly through the ASA's outside interface via standard HTTP, completely bypassing the WebVPN URL-rewriting engine that was causing the issue. Because users still connect through the ASA without installing any VPN client software, the solution remains clientless.

Why the other options are wrong:

A (Smart tunnel): Smart tunnels in clientless VPN are designed for non-browser TCP applications (e.g., Outlook, SSH clients), not for resolving HTTP URL-rewriting failures on web servers.
C (AnyConnect with split tunnel): AnyConnect requires a full VPN client to be installed, making this a client-based solution-not clientless. This violates the core requirement.
D (WebACL): A WebACL controls access to resources; it does not fix content rewriting failures.

Topics

#clientless VPN#web content rewriting#ASA#NAT

Community Discussion

No community discussion yet for this question.

Full 300-730 Practice