WHAT IS CISCO?

Cisco Systems, Inc. is an American multinational technology conglomerate headquartered in San Jose, California, in the center of Silicon Valley. Cisco develops, manufactures and sells networking hardware, software, telecommunications equipment and other high-technology services and products.

What is the meaning of web access?

Web access means having a connection to the World Wide Web through an access provider or an online service provider such as America Online. For data access, access is usually specified as read-only access and read/write access.

WHAT IS WEB ACCESS CONFIGURATION?

Access Policy Manager (APM) web access management provides the ability to access web applications through a web browser without the use of tunnels or specific resources. With this type of access, APM communicates with backend web servers, forwarding requests from the client to web servers within a local traffic pool.In a configuration that controls traffic and requests directed to your internal servers, using APM with Local Traffic Manager provides additional security. APM communicates with backend web servers, forwarding requests from the client to web servers within a local traffic pool. APM allows access to the local traffic pool only after the user passes through an access policy that typically contains authentication actions, endpoint security checks, and ACLs.

Ways to time out a web access management session

The web access management access type does not have a logout mechanism; as a result configuring a timeout is important. Access Policy Manager (APM) provides these options.The Windows Cache and Session Control access policy itemTerminates a user session when it detects that the browser screen has closed. You can also configure it to provide inactivity timeouts for the user session using the Terminate session on user inactivity setting.Maximum Session Timeout access profile settingProvides an absolute limit for the duration of the access policy connection, regardless of user activity. To ensure that a user session closes after a certain number of seconds, configure this setting.Inactivity Timeout access profile settingTerminates the session after there is no traffic flow for a specified number of seconds.Depending on the application, you might not want to set this to a very short duration, because many applications cache user typing and generate no traffic for an extended period. In this scenario, a session can time out while the application is still in use, but the content of the user input is not relayed back to the server..

WEB ACCESS CONFIGURATION PROCEDURES

Creating a pool of web servers

You can create a pool of servers for Access Policy Manager (APM) to perform access control for web application servers configured as local traffic pool members.

When you add web servers as members of the pool, select the HTTPS service if the web server uses SSL, to maintain consistency between APM and the web servers.

1. On the Main tab, click Local TrafficPools.The Pool List screen opens.
2. Click Create.The New Pool screen opens.
3. In the Name field, type a unique name for the pool.
4. In the Resources area, for the New Members setting, add to the pool the application servers that host the web application:
   1. Type an IP address in the Address field.
   2. In the Service Port field, type a port number (for example, type 80 for the HTTP service), or select a service name from the list.
   3. Click Add.
5. Click Finished.

The new pool appears in the Pools list.

Creating an access profile

You create an access profile to provide the access policy configuration for a virtual server that establishes a secured session.

1. On the Main tab, click AccessProfiles / Policies.The Access Profiles (Per-Session Policies) screen opens.
2. Click Create.The New Profile screen opens.
3. In the Name field, type a name for the access profile.A access profile name must be unique among all access profile and any per-request policy names.
4. From the Profile Type list, select SSL-VPN.Additional settings display.
5. From the Profile Scope list, retain the default value or select another.
   • Profile: Gives a user access only to resources that are behind the same access profile. This is the default value.
   • Virtual Server: Gives a user access only to resources that are behind the same virtual server.
   • Global: Gives a user access to resources behind any access profile that has global scope.
6. To configure timeout and session settings, select the Custom check box.
7. In the Inactivity Timeout field, type the number of seconds that should pass before the access policy times out. Type 0 to set no timeout.If there is no activity (defined by the Session Update Threshold and Session Update Window settings in the Network Access configuration) between the client and server within the specified threshold time, the system closes the current session.
8. In the Access Policy Timeout field, type the number of seconds that should pass before the access profile times out because of inactivity.Type 0 to set no timeout.
9. In the Maximum Session Timeout field, type the maximum number of seconds the session can exist.Type 0 to set no timeout.
10. In the Max Concurrent Users field, type the maximum number of users that can use this access profile at the same time.Type 0 to set no maximum.
11. In the Max Sessions Per User field, type the maximum number of concurrent sessions that one user can start.Type 0 to set no maximum.Only a user in the administrator, application editor, manager, or resource administrator role has access to this field.
12. In the Max In Progress Sessions Per Client IP field, type the maximum number of concurrent sessions that can be in progress for a client IP address.When setting this value, take into account whether users will come from a NAT-ed or proxied client address and, if so, consider increasing the value accordingly. The default value is 128.Only a user in the administrator, application editor, manager, or resource administrator role has access to this field.F5 does not recommend setting this value to 0 (unlimited).
13. Select the Restrict to Single Client IP check box to restrict the current session to a single IP address.This setting associates the session ID with the IP address.Only a user in the administrator, application editor, manager, or resource administrator role has access to this field.Upon a request to the session, if the IP address has changed the request is redirected to a logout page, the session ID is deleted, and a log entry is written to indicate that a session hijacking attempt was detected. If such a redirect is not possible, the request is denied and the same events occur.
14. To configure logout URIs, in the Configurations area, type each logout URI in the URI field, and then click Add.
15. In the Logout URI Timeout field, type the delay in seconds before logout occurs for the customized logout URIs defined in the Logout URI Include list.
16. To configure SSO:
    • For users to log in to multiple domains using one SSO configuration, skip the settings in the SSO Across Authentication Domains (Single Domain mode) area. You can configure SSO for multiple domains only after you finish the initial access profile configuration.
    • For users to log in to a single domain using an SSO configuration, configure settings in the SSO Across Authentication Domains (Single Domain mode) area, or you can configure SSO settings after you finish the initial access profile configuration.
17. In the Domain Cookie field, specify a domain cookie, if the application access control connection uses a cookie.
18. In the Cookie Options setting, specify whether to use a secure cookie.
    • If the policy requires a secure cookie, select the Secure check box to add the secure keyword to the session cookie.
    • If you are configuring an LTM access scenario that uses an HTTPS virtual server to authenticate the user and then sends the user to an existing HTTP virtual server to use applications, clear this check box.
19. If the access policy requires a persistent cookie, in the Cookie Options setting, select the Persistent check box.This sets cookies if the session does not have a webtop. When the session is first established, session cookies are not marked as persistent; but when the first response is sent to the client after the access policy completes successfully, the cookies are marked persistent. Persistent cookies are updated for the expiration timeout every 60 seconds. The timeout is equal to session inactivity timeout. If the session inactivity timeout is overwritten in the access policy, the overwritten value will be used to set the persistent cookie expiration.
20. From the SSO Configurations list, select an SSO configuration.
21. In the Language Settings area, add and remove accepted languages, and set the default language.A browser uses the highest priority accepted language. If no browser language matches the accepted languages list, the browser uses the default language.
22. Click Finished.

The access profile displays in the Access Profiles List. Default-log-setting is assigned to the access profile.To add an SSO configuration for multiple domains, click SSO / Auth Domains on the menu bar. To provide functionality with an access profile, you must configure the access policy. The default access policy for a profile denies all traffic and contains no actions. Click Edit in the Access Policy column to edit the access policy.

Verifying log settings for the access profile

Confirm that the correct log settings are selected for the access profile to ensure that events are logged as you intend.Log settings are configured in the AccessOverview Event Log Settings area of the product. They enable and disable logging for access system and URL request filtering events. Log settings also specify log publishers that send log messages to specified destinations.

1. On the Main tab, click AccessProfiles / Policies.The Access Profiles (Per-Session Policies) screen opens.
2. Click the name of the access profile that you want to edit.The properties screen opens.
3. On the menu bar, click Logs.The access profile log settings display.
4. Move log settings between the Available and Selected lists.You can assign up to three log settings that enable access system logging to an access profile. You can assign additional log settings to an access profile provided that they enable logging for URl request logging only.Logging is disabled when the Selected list is empty.
5. Click Update.

An access profile is in effect when it is assigned to a virtual server.

Creating an access policy for web access management

You create an access policy to specify, at a minimum, logon and authentication. You can add other items to the policy to direct traffic and grant or deny access appropriately, increasing your security.In an access policy for web access management, you do not need to assign resources, such as, webtops, portal access or network access resources, application access tunnels, or remote desktops.

1. On the Main tab, click AccessProfiles / Policies.The Access Profiles (Per-Session Policies) screen opens.
2. In the Per-Session Policy column, click the Edit link for the access profile you want to configure.The visual policy editor opens the access policy in a separate screen.
3. On a policy branch, click the (+) icon to add an item to the policy.A popup screen displays actions on tabs, such as General Purpose and Authentication, and provides a search field.
4. On the Logon tab, select Logon Page and click the Add Item button.The Logon Page Agent properties screen opens.
5. Make any changes that you require to the logon page properties and click Save.The properties screen closes and the policy displays.
6. On a policy branch, click the (+) icon to add an item to the policy.Repeat this action from the visual policy editor whenever you want to add an item to the policy.A popup screen displays actions on tabs, such as General Purpose and Authentication, and provides a search field.
7. From the Authentication tab, select an authentication item.
8. Configure the properties for the authentication item and click Save when you are done.You can configure multiple authentication items in an access policy.You have now configured a basic access policy.
9. Add endpoint security checks or other items that you require to the access policy.Optionally, you can assign a pool of web servers in the access policy using the Pool Assign action; if you do, this pool takes precedence over the pool you assign to the virtual server configuration.You can add a Windows Cache and Session Control item to configure a way to terminate the session.
10. To grant access at the end of any branch, change the ending from Deny to Allow:
    1. Click Deny.The default branch ending is Deny.A popup screen opens.
    2. Select Allow and click Save.The popup screen closes. The Allow ending displays on the branch.
11. Click the Apply Access Policy link to apply and activate the changes to the policy.

This creates an access policy that is appropriate for web access management connections.To apply this access policy to network traffic, add the access profile to a virtual server.To ensure that logging is configured to meet your requirements, verify the log settings for the access profile.

Creating a virtual server

This task creates a standard, host type of virtual server for application traffic. A host type of virtual server listens for traffic destined for the specified destination IP address and service. Using this virtual server, Access Policy Manager (APM^®) can provide access control for web applications on web servers in a local traffic pool without using tunnels or specific resources.By default, the health monitor is set to none and the load balancing method is set to Round Robin. You can add a health monitor or select an alternative load balancing method for this virtual server.

1. On the Main tab, click Local TrafficVirtual Servers.The Virtual Server List screen opens.
2. Click Create.The New Virtual Server screen opens.
3. In the Name field, type a unique name for the virtual server.
4. In the Destination Address field, type the IP address for a host virtual server.This field accepts an address in CIDR format (IP address/prefix). However, when you type the complete IP address for a host, you do not need to type a prefix after the address.
5. In the Service Port field, type 80 (for HTTP) or 443 (for HTTPS), or select HTTP or HTTPS from the list.
6. For the HTTP Profile setting, verify that the default HTTP profile, http, is selected.
7. For the SSL Profile (Client) setting, select a client SSL profile.If the web server uses SSL, the client should use SSL.
8. For the SSL Profile (Server) setting, select an SSL server profile.If the web server uses SSL, the virtual server should use SSL.
9. In the Content Rewrite area, retain the default settings.The web access management access type eliminates the need for content rewriting. The default values for the Rewrite Profile and the HTML Profile settings are None.
10. In the Access Policy area, from the Access Profile list, select the access profile you configured previously.Retain the default values for other settings in the Access Policy area.
11. From the HTTP Compression Profile list, select httpcompression.You can use compression to provide a better end user experience, particularly where there is limited bandwidth or high latency between the virtual server and the client.
12. In the Resources area of the screen, from the Default Pool list, select the relevant pool name.
13. Click Finished.

ADVANTAGES OF WEB ACCESS CONFIGURATION

What are the business advantages?

Cost effective development

With web-based applications, users access the system via a uniform environment—the web browser. While the user interaction with the application needs to be thoroughly tested on different web browsers, the application itself needs only be developed for a single operating system.

There is no need to develop and test it on all possible operating system versions and configurations. This makes development and troubleshooting much easier and for web applications that use a Flash front end testing and troubleshooting is even easier.

Accessible anywhere

Unlike traditional applications, web systems are accessible anytime, anywhere and via any PC with an Internet connection. This puts the user firmly in charge of where and when they access the application.

It also opens up exciting, modern possibilities such as global teams, home working and real-time collaboration. The idea of sitting in front of a single computer and working in a fixed location is a thing of the past with web-based applications.

Easily customisable

The user interface of web-based applications is easier to customise than is the case with desktop applications. This makes it easier to update the look and feel of the application or to customise the presentation of information to different user groups.

Therefore, there is no longer any need for everyone to settle for using exactly the same interface at all times. Instead, you can find the perfect look for each situation and user.

Accessible for a range of devices

In addition to being customisable for user groups, content can also be customised for use on any device connected to the internet. This includes the likes of PDAs, mobile phones and tablets.

This further extends the user’s ability to receive and interact with information in a way that suits them. In this way, the up to date information is always at the fingertips of the people who need it.

Improved interoperability

It is possible to achieve a far greater level of interoperability between web applications than it is with isolated desktop systems. For example, it is much easier to integrate a web-based shopping cart system with a web-based accounting package than it is to get two proprietary systems to talk to each other.

Because of this, web-based architecture makes it possible to rapidly integrate enterprise systems, improving work-flow and other business processes. By taking advantage of internet technologies you get a flexible and adaptable business model that can be changed according to shifting market demands.

Easier installation and maintenance

With the web-based approach installation and maintenance becomes less complicated too. Once a new version or upgrade is installed on the host server all users can access it straight away and there is no need to upgrade the PC of each and every potential user.

Rolling out new software can be accomplished more easily, requiring only that users have up-to-date browsers and plugins. As the upgrades are only performed by an experienced professional to a single server the results are also more predictable and reliable.

Adaptable to increased workload

Increasing processor capacity also becomes a far simpler operation with web-based applications. If an application requires more power to perform tasks only the server hardware needs to be upgraded.

The capacity of web-based software can be increased by “clustering” or running the software on several servers simultaneously. As workload increases, new servers can be added to the system easily.

For example, Google runs on thousands of inexpensive Linux servers. If a server fails, it can be replaced without affecting the overall performance of the application.

Increased Security

Web-based applications are typically deployed on dedicated servers, which are monitored and maintained by experienced server administrators. This is far more effective than monitoring hundreds or even thousands of client computers as is the case with desktop applications.

This means that security is tighter and any potential breaches should be noticed far more quickly.

Flexible core technologies

Any of three core technologies can be used for building web-based applications, depending on the requirements of the application. The JAVA Based Solutions (J2EE) from Sun Microsystems involve technologies such as JSP and Servlets.

The newer Microsoft .NET platform uses Active Server Pages, SQL Server and .NET scripting languages. The third option is the Open Source platform (predominantly PHP and MSQL), which is best suited to smaller websites and lower budget applications.

CISCO WEB ACCESS CONFIGURATION

Prerequisites for Cisco IOS Web Browser User Interface

• You must have Cisco IOS Release 12.2 or a later release installed and running on your network
• To use the Cisco IOS Web browser UI, your computer must have a World Wide Web browser application.
• Most Cisco routers and access servers automatically generate a password protected home page when the HTTP server is enabled on the device. To access the home page, your computer must be on the same network as the router.

Restrictions for Cisco IOS Web Browser User Interface

• The Web browser UI is automatically enabled on the Cisco 1003, Cisco 1004, or Cisco 1005 routers to allow you to use ClickStart to configure your router. For all other Cisco devices, you must enable the Cisco Web browser UI.
• You can issue most Cisco IOS commands using a Web browser by connecting to the home page generated by the Cisco IOS software for your system.
• The Cisco Web browser UI works with most web browsers. Your Web browser must be able to read and submit forms.

Information About Cisco IOS Web Browser User Interface

Customizing the Cisco Web Browser UI

You can customize the HTML pages used by the Cisco Web browser UI to display Cisco IOS command output and Cisco IOS platform-specific variables (for example, a router host name or router address). You can display this information using HTML formatted Server Side Includes (SSIs) that you insert into your custom HTML pages.

Understanding SSIs

SSIs are HTML formatted commands or variables that you insert into HTML pages when you customize Cisco IOS platform configuration pages for a Web browser. These SSI commands and SSI variables display Cisco IOS command output and Cisco IOS platform-specific variables.

Note	The majority of the customization features in this section are for the ClickStart EZsetup feature for the Cisco 1000 series, Cisco 1003/1004 series, and Cisco 1005 series routers only.

The Cisco IOS software supports two HTML SSI commands defined for customizing HTML pages: the SSI EXEC command and the SSI ECHO command. The HTML format of the SSI EXEC command is <!–#execcmd=“ xxx ”–> , and the HTML format of the SSI ECHO command is <!–#echovar=“ yyy ”–> . (See the section “Customizing HTML Pages Using SSIs” later in this chapter for a description of how to use these commands).

In addition to the two SSI commands, the Cisco IOS software supports several SSI variables defined for customizing HTML pages. SSI variables are used with the SSI ECHO command. One SSI variable is defined for all Cisco IOS platforms (SERVER_NAME), and other SSI variables are specifically defined for ISDN, Frame Relay, and asynchronous serial platforms. The format and a description of all the available SSI variables are provided in the table below. (See the section Customizing HTML Pages Using SSIs later in this chapter for a description of how to use these SSI variables with the SSI ECHO command).

The SSI EXEC command is supported on all platforms. The SSI ECHO command, used with SSI variables, is supported on all platforms listed in the table below.

HTML Format of SSI Variable	Description of Variable Displayed on Browser Page	Cisco IOS Platforms This SSI Is Supported On
SERVER_NAME	Host name of the HTTP server.	All Cisco IOS platforms
EZSETUP_PASSWORD	Enable password (currently left blank).	Cisco 1000 series
EZSETUP_PASSWORD_VERIFY	Repeat of the enable password to verify accuracy (currently left blank).	Cisco 1000 series
EZSETUP_ETHERNET0_ADDRESS	IP address of the Ethernet interface 0.	Cisco 1000 series
EZSETUP_ETHERNET0_MASK	IP mask of the Ethernet interface 0.	Cisco 1000 series
EZSETUP_DNS_ADDRESS	Domain Name System (DNS) address used by the router.	Cisco 1000 series
EZSETUP_STANDARD_DEBUG_Y	Standard debug variable. Returns CHECKED if set to TRUE; otherwise, it is blank.	Cisco 1000 series
EZSETUP_STANDARD_DEBUG_N	Standard debug variable. Returns CHECKED if set to FALSE; otherwise, it is blank.	Cisco 1000 series
EZSETUP_ISDN_SWITCHTYPE	ISDN switch type.	Cisco 1003 and Cisco 1004
EZSETUP_ISDN_REMOTE_NAME	Name of remote ISDN system.	Cisco 1003 and Cisco 1004
EZSETUP_ISDN_REMOTE_NUMBER	Phone number of remote ISDN system.	Cisco 1003 and Cisco 1004
EZSETUP_ISDN_CHAP_PASSWORD	CHAP password of remote ISDN system.	Cisco 1003 and Cisco 1004
EZSETUP_ISDN_SPID1	ISDN SPID 1.	Cisco 1003 and Cisco 1004
EZSETUP_ISDN_SPID2	ISDN SPID 2.	Cisco 1003 and Cisco 1004
EZSETUP_ISDN_SPEED_56	Speed of ISDN interface. Returns CHECKED if set to 56K; otherwise, it is blank.	Cisco 1003 and Cisco 1004
EZSETUP_ISDN_SPEED_64	Speed of ISDN interface. Returns CHECKED if set to 64K; otherwise, it is blank.	Cisco 1003 and Cisco 1004
EZSETUP_FR_ADDRESS	Frame Relay IP address.	Cisco 1005
EZSETUP_FR_MASK	Frame Relay IP mask.	Cisco 1005
EZSETUP_FR_DLCI	Frame Relay DLCI.	Cisco 1005
EZSETUP_ASYNC_REMOTE_NAME	Name of remote system.	Cisco 1005
EZSETUP_ASYNC_REMOTE_NUMBER	Phone number of remote system.	Cisco 1005
EZSETUP_ASYNC_CHAP_PASSWORD	CHAP password for remote system.	Cisco 1005
EZSETUP_ASYNC_LINE_PASSWORD	Async line password.	Cisco 1005
EZSETUP_ASYNC_MODEM_SPEED	Speed of async modem (either 14.4K or 28.8K).	Cisco 1005
EZSETUP_ASYNC_MODEM_SPEED_144K	Returns CHECKED if async modem speed is 14.4K; otherwise it is blank.	Cisco 1005
EZSETUP_ASYNC_MODEM_SPEED_288K	Returns CHECKED if async modem speed is 28.8K; otherwise it is blank.	Cisco 1005

When you have designed a set of HTML pages that include SSIs, you can copy these pages to a Cisco IOS platform’s Flash memory. When you retrieve these pages from Flash memory and display them using a Web browser, any SSI command that was designed into these pages will display either Cisco IOS command output or a current variable or identifier defined in the table below. For example, the SSI ECHO command with the variable SERVER_NAME will display the current host name of the HTTP server you are using, and the SSI ECHO command with the variable EZSETUP_ISDN_SWITCHTYPE will display the current ISDN switch type you are using.

Using SSIs, you can customize set of HTML pages to appear in languages other than English and copy these pages to Flash memory on multiple Cisco IOS platforms. When you retrieve these pages from the Flash memory of a Cisco IOS platform, current variables and identifiers associated with the platform you are currently using are displayed. SSIs save you from needing to duplicate these international pages (considered relatively large images that contain 8-bit or multibyte characters) and store them in the source code for each platform you are using.

Drop your comment