Cisco ASA5505 – How to Configure a Web Server

As per the advice from Ricky Beam I opened a Cisco TAC case for this issue, just to see what the official word is:

Hi Mark,

thanks. At this time, the ASA does not have native IPv6 PPPOE support. I have not seen it on any future roadmap. You may want to contact your local cisco team to see if they can submit a request by putting in a business case for you.

(emphasis mine). So no, there is no way to do IPv6 on an ASA using a PPPoE connection, and it doesn't look like it is coming any time soon. I guess they expect you to put a proper router infront of the ASA instead.

After a long period of experimentation and follow-up with Cisco, I've got the following answers:

1. There is no recycle bin equivalent when deleting CIFS files from a Windows server via the clientless VPN.

2. There is no way to enable any kind of confirmation dialogue for file deletions at this point in time. So people can be trying to click the "favourite" button, be off by a millimetre, and accidentally delete with no confirmation and no trash to recover from. :-( They've put in the ability to turn on confirmations as a feature request, but there's no timeline on when it might be implemented. So guess we won't be using this feature, which is sad.

3. I added our nbns server to the Cisco config, and now clicking the Browse entire network button shows me the domain. However, when I click on the domain, it says "Failed to retrieve servers". A had a support tech look at this, and he said the config all looks fine, and he found a few other instances of this for other users. He said he'd investigate and get back to me.

While waiting, I disabled file browsing. A few days later, when he wanted me to show him the issue, I turned it back on and it was working! (There's still a second domain showing in there that isn't on my nbns server...still no idea what the deal is with that. But the real domain is working.) So I don't know if the browsing just basically needed a kick in the pants after I added the nbns server config? No idea. But it's okay now.

4. Having some links that use the clientless VPN and some that don't is in fact possible through content-rewrite rules (http://www.cisco.com/c/en/us/td/docs/security/asa/asa84/asdm64/configuration_guide/asdm_64_config/vpn_clientless_ssl.html#wp2389515)

"By default, the security appliance rewrites, or transforms, all clientless traffic. You might not want some applications and web resources (for example, public websites) to go through the ASA. The ASA therefore lets you create rewrite rules that let users browse certain sites and applications without going through the ASA. This is similar to split-tunneling in an IPSec VPN connection."

However - and I have confirmation of this from a Cisco support rep to back up my test results - this does not work in combination with SSO. If you're using the rewrite rules you cannot send parameters of any kind.