nerdexam
Cisco

300-730 · Question #108

A clientless SSLVPN is set up to allow remote users to access internal HTTPS webservers. Users can access all but one server and see the message "Connection Failed. Server 192.168.0.101 unavailable".

The correct answer is A. Add an SSL cipher that can be negotiated with the webserver to the Cisco ASA.. In clientless SSLVPN the ASA acts as an SSL proxy between remote users and backend servers; if no common SSL cipher can be negotiated with the internal HTTPS server, the ASA reports the server as unavailable even when ICMP reachability is confirmed.

Troubleshooting VPNs

Question

A clientless SSLVPN is set up to allow remote users to access internal HTTPS webservers. Users can access all but one server and see the message "Connection Failed. Server 192.168.0.101 unavailable". Pings between the Cisco ASA and the webserver are successful, and users can connect to the webserver when they use their computer in the internal network. Which action resolves this issue?

Options

  • AAdd an SSL cipher that can be negotiated with the webserver to the Cisco ASA.
  • BAdd the http 192.168.0.101 255.255.255.255 inside command to the Cisco ASA.
  • CConfigure routing on the Cisco ASA so it can reach the webserver.
  • DConfigure a DNS server that can resolve the webserver domain on the Cisco ASA.

How the community answered

(44 responses)
  • A
    80% (35)
  • B
    11% (5)
  • C
    7% (3)
  • D
    2% (1)

Why each option

In clientless SSLVPN the ASA acts as an SSL proxy between remote users and backend servers; if no common SSL cipher can be negotiated with the internal HTTPS server, the ASA reports the server as unavailable even when ICMP reachability is confirmed.

AAdd an SSL cipher that can be negotiated with the webserver to the Cisco ASA.Correct

The ASA terminates the remote user's SSL session and opens a separate SSL session to the backend internal server, requiring its own cipher negotiation with that server. If no cipher in the ASA's configured SSL cipher list is supported by the internal server, the ASA cannot complete the proxy SSL handshake and reports the server as unavailable. Adding a compatible SSL cipher resolves the mismatch and allows the clientless SSLVPN proxy connection to succeed.

BAdd the http 192.168.0.101 255.255.255.255 inside command to the Cisco ASA.

The 'http' command grants ASDM or CLI management access to the ASA itself; it does not control access to internal webservers for clientless SSLVPN users.

CConfigure routing on the Cisco ASA so it can reach the webserver.

Routing is already confirmed working because pings from the ASA to 192.168.0.101 succeed; the problem exists at the SSL layer, not the network layer.

DConfigure a DNS server that can resolve the webserver domain on the Cisco ASA.

DNS resolution is not the issue because the error message references the server by IP address (192.168.0.101), indicating the problem is an SSL cipher negotiation failure, not a name resolution failure.

Concept tested: Clientless SSLVPN SSL cipher negotiation between ASA proxy and backend server

Source: https://www.cisco.com/c/en/us/td/docs/security/asa/asa96/configuration/vpn/asa-96-vpn-config/webvpn-configure-gateway.html

Topics

#clientless SSL VPN#SSL cipher mismatch#webserver access#ASA

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 300-730 Practice