Cisco ASA 5512-X Cli Configuration Guide

1-11
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring Clientless SSL VPN
Configuring Application Profile Customization Framework
Configuring SSL/TLS Encryption Protocols
Prerequisites
Port Forwarding requires Oracle Java Runtime Environment (JRE). Port forwarding does not work when
a user of clientless SSL VPN connects with some SSL versions. Refer to the compatibility matrix for
supported JRE versions.
Authenticating with Digital Certificates
SSL uses digital certificates for authentication. The ASA creates a self-signed SSL server certificate
when it boots; or you can install in the ASA an SSL certificate that has been issued in a PKI context. For
HTTPS, this certificate must then be installed on the client.
Restrictions
E-mail clients such as MS Outlook, MS Outlook Express, and Eudora lack the ability to access the
certificate store.
For more information on authentication and authorization using digital certificates, see the “Using
Certificates and User Login Credentials” section on page 1-9.
Configuring Application Profile Customization Framework
Clientless SSL VPN includes an Application Profile Customization Framework option that lets the ASA
handle non-standard applications and web resources so they display correctly over a clientless SSL VPN
connection. An APCF profile contains a script that specifies when (pre, post), where (header, body,
request, response), and what (data) to transform for a particular application. The script is in XML and
uses sed (stream editor) syntax to transform strings/text.
Multiple APCF profiles can run in parallel on an ASA. Within an APCF profile script, multiple APCF
rules can apply. In this case, the ASA processes the oldest rule first (based on configuration history),
then the next oldest rule, and so forth.
You can configure multiple APCF profiles on an ASA. Within an APCF profile script, multiple APCF
rules can apply. The ASA processes the oldest rule first, based on configuration history, the next oldest
rule next, and so forth.
You can store APCF profiles on the ASA flash memory, or on an HTTP, HTTPS, or TFTP server.
Restrictions
We recommend that you configure an APCF profile only with the assistance of Cisco personnel.

Cisco ASA 5512-X Specifications

General

Brand	Cisco
Model	ASA 5512-X
Category	Firewall
Language	English