To gain access to the graphical ASDM Web management tool you need to enable the HTTPs server on the firewall, and allow HTTPs connections.

Enabling HTTPs Access

1. Generate cryptographic keys for HTTPs
2. Enable the web server on the firewall
3. Specify which management PCs are allowed to access the device

Example:
ASA(config)# crypto key generate rsa modulus 1024
ASA(config)# write mem
ASA(config)# http server enable
ASA(config)# http 192.168.1.2 255.255.255.255 inside
ASA(config)# http 192.168.1.5 255.255.255.255 inside

The example above enables HTTPs access and allows access only from two IP addresses (192.168.1.2 and 192.168.1.5) from the inside interface of the firewall.

Now, in order to access the Graphical ASDM web interface from a PC (e.g from PC with address 192.168.1.2), just open a web browser and enter the URL https://<inside firewall IP address>

Web VPN

Web VPN (or SSL VPN, or clientless VPN) is a new type of remote VPN access using a browser with HTTPs protocol. A remote teleworker for example can access internal corporate services and resources by using  his/her secure browser. The teleworker just points the browser to the external public IP address of the corporate ASA firewall which authenticates the user and gives him secure access to the internal network.

However, if you use both ASDM and Web VPN on the same firewall interface, there is going to be a conflict since both of these services use the default HTTPs port (443). To avoid this conflict we can change the default listening port of the Web VPN service to something different than 443. Lets see an example:

Example:

ASA(config)# http server enable
ASA(config)# http 100.100.1.1 255.255.255.255 outside
ASA(config)# webvpn
ASA(config-webvpn)# port 444
ASA(config-webvpn)# enable outside

On the example above, we enabled HTTP access for management (ASDM) on the outside interface, and also we have enabled webvpn access again on the outside using a different port (444). This way we avoid conflict of the two services (ASDM access listens on the default port 443 and webvpn listens on port 444).

In this case, in order for a remote teleworker to access the firewall on the outside he needs to point his browser to https://<external IP of Firewall>:444

• They use dynamic ports.
• They transmit request using TCP and get responses in UDP or TCP.
• They use the same port for source and destination.
• For each multimedia request, the multimedia server might send numerous streams of data in reply.

All the above impose an “unacceptable” traffic behavior for a network firewall, thus multimedia traffic needs some special treatment in order to be permitted through the firewall.

The diagram above shows the behavior of multimedia traffic through a network firewall. The multimedia client sends a TCP or UDP request to the multimedia server, which replies back using a range of ports in the reply packets. In order for the reply packets to pass through the firewall, a range of ports needs to be opened, which creates a security risk.

For example, RealAudio protocol sends the originating request to TCP port 7070, and the RealAudio Server replies with multiple UDP streams anywhere from UDP port 6970 up to 7170 on the client.

Another example is the Cisco IP Phone. It sends the SCCP message to the call manager on TCP port 2000. SCCP uses Real-Time Transport Protocol (RTP) and RTP Control Protocol (RTCP) for media transmissions. The UDP media ports are randomly selected by the IP Phone.

To accommodate multimedia traffic without permanently opening several ports on the firewall, the big firewall vendors (Cisco, Checkpoint, Netscreen etc) have implemented dynamic inspection of known multimedia traffic, so that the security appliance can dynamically open and closes UDP ports for secure multimedia communication. For example, the firewall is able to sense that the traffic passing through is multimedia traffic, thus it dynamically opens the required inbound ports (from the Server to the Client) for the communication to pass. After the multimedia communication is finished, the firewall again dynamically closes all ports that were opened at the beginning.

For example, the Cisco Firewall can inspect and work dynamically on several multimedia applications such as Cisco IP/TV, Cisco IP Phones, Apple QuickTime 4, RealNetworks (RealAudio, RealPlayer, RealServer), SIP, H323 etc.