Direct connect webpage by typing URL

[Billy_]

Hi guys...

I have a problem in deploying SSLVPN Web rewriting feature...

Back-End webserver is protected by SA4500.

I'll let VPNUSER access to back-end server's webpage without authentication (Anonymous authentication) and they would access the page typing URL(ex:https://vpn.aaa.com,DanaInfo=/loan.bbb.com,/start/orglink.asp?org=bank&office=branch&user=jhon).

The values in the URL "bank","branch","jhon" are variable which would be used by back-end web applicatoin.

I created bookmark page "http://www.bbb.com" and only "Web Rewritting" must be used.

I've tested this case but failed.

Is it possible?

[ruc_]

How will end user access the page/app?

Will they be:

1. Typing a URL in the browser's address bar.

2. Typing a URL in SA 4500 'browse bar' (the one you see on the initial bookmarks page)

3. They will click on links on some external web page

[Billy_]

Thanks ruc..

End user will access to the Back-end server's page by clicking on links on some external web page.(Number 3)

For example,

Normal access link is http://loan.abc.com/loanstart/loan.asp?org=value1&branch=value2&user=value3

Is it possible?

[ruc_ · Accepted solution]

Yes its possible. The links should be created using below syntax:

https://SA4500_FQDN/dana/home/launch.cgi?url=backend_url_in_URL-encoded_form

In addition under SA 4500 Admin GUI > Role > Session options > Enable browser follow through

Note: If you are using anonymous authentication make sure you set some limit on the Realm so the entire user license is not hogged by anonymous users. And with above example you don't "have to" use anonymous auth, you can use some form of auth and in that case the users will first be prompted for credentials and then be taken to the backend website.

Hope it helps!

[Billy_]

Thanks for your help ruc~~ ^^

I have configured it as you mensioned before, but it doesn't work.

It seems web-rewriting of SA4500 can not deliver User-Defined variables (org, branch, user) to back-end web applicatoin.

I've got same result as I connect to Back-end server without User-Defined variables.

https://[SA4500_FQDN/dana/home/launch.cgi?url=loan.abc.com/loanstart/loan.asp?org=value1&branch=value2&user=value3

https://[SA4500_FQDN/dana/home/launch.cgi?url=loan.abc.com/loanstart/loan.asp

==> Same result.

Following information is what I configured in SA4500.

------------------------------------------------------------------------------------------------------------------------

Inside Server FQDN : loan.abc.com

URL on external link : http://loan.abc.com/loanstart/loan.asp?org=value1&branch=value2&user=value3

Sign-in Policy : vpn.abc.com/ -> Loanrealm

Authentication of Loanrealm : Anonymous Auth Server

Role mapping of Loanrealm : * (all user ) => LoanRole

LoanRole Parameter

- General : Only "web" option is enabled.

- Session Option : Only "Enable browser follow through" Option is enabled.

- Bookmark of "web" : http://loan.abc.com/*

- Web ACL : *.*/* allowed.

- Selective rewritting : http://loan.abc.com/ => Rewrite content (auto-detect content type)

---------------------------------------------------------------------------------------------------------------------------

Are there more options I have to configure?

I'm dying to solve this problem..TT

Thanks...

[ruc_]

Question: When the requests comes to the SA will the URL:

1. Be already well formed

or

2. Do you expect the SA to substitue the variables with specific values?

If your answer is # 1 and it still did not work then the other question I had is "Did you URL encode the link below?"

If your answer is # 2 then I dont think there is any easy solution for this use case as the rewrite engine can't substitute variables with values.

[Billy_]

I'm sorry, it was my mistake.

When I test it, application engineer had modfied some codes on the back-end server.

Now it works fine. ^^

I appreciate your hlep.

Thank you very much~~

[TRK-NKA_]

What firmware are you on ?

I'm trying to do something similar on 6.4R4.

There is no portal page tho, we redirect to a different website, that might be what is teasing in this situation.