Cisco 500 Series, Configuration Manual

Page: 685 / 1140

30-69
Cisco Security Appliance Command Line Configuration Guide
OL-12172-03
Chapter 30 Configuring Connection Profiles, Group Policies, and Users
Group Policies
The following example shows how to set the name, Remote Access TCP Applications, for the internal
group policy named
FirstGroup :
hostname(config)# group-policy FirstGroup internal attributes
hostname(config-group-policy)#
webvpn
hostname(config-group-webvpn)# port-forward-name value Remote Access TCP Applications
hostname(config-group-webvpn)#
Configuring the Maximum Object Size to Ignore for Updating the Session Timer
Network devices exchange short keepalive messages to ensure that the virtual circuit between them is
still active. The length of these messages can vary. The
keep-alive-ignore command lets you tell the
security appliance to consider all messages that are less than or equal to the specified size as keepalive
messages and not as traffic when updating the session timer. The range is 0 through 900 KB. The default
is 4 KB.
To specify the upper limit of the HTTP/HTTPS traffic, per transaction, to ignore, use the
keep-alive-ignore command in group-policy attributes webvpn configuration mode:
hostname(config-group-webvpn)# keep-alive-ignore size
hostname(config-group-webvpn)#
The no form of the command removes this specification from the configuration:
hostname(config-group-webvpn)# no keep-alive-ignore
hostname(config-group-webvpn)#
The following example sets the maximum size of objects to ignore as 5 KB:
hostname(config-group-webvpn)# keep-alive-ignore 5
hostname(config-group-webvpn)#
Specifying HTTP Compression
Enable compression of http data over a clientless SSL VPN session for a specific group or user by
entering the
http-comp command in the group policy webvpn mode.
hostname(config-group-webvpn)# http-comp { gzip | none }
hostname(config-group-webvpn)#
To remove the command from the configuration and cause the value to be inherited, use the no form of
the command:
hostname(config-group-webvpn)# no http-comp { gzip | none }
hostname(config-group-webvpn)#
The syntax of this command is as follows:
•
gzip— Specifies compression is enabled for the group or user. This is the default value.
• none— Specifies compression is disabled for the group or user.
For clientless SSL VPN sessions, the compression command configured from global configuration
mode overrides the http-comp command configured in group policy and username webvpn modes.
In the following example, compression is disabled for the group-policy sales:
hostname(config)# group-policy sales attributes
hostname(config-group-policy)# webvpn
hostname(config-group-webvpn)# http-comp none
hostname(config-group-webvpn)#