Accessing Internal Intranet From External Location

Question

Hi all, 
 We are running two Sophos SG450 UTM Hardware Appliances 9.505-4) running in active-passive configuration. 
 I have been tasked with permitting access to our internal Intranet from locations external to our organisation. I have mostly got it working, but I've hit a hurdle that I'm hoping someone will give me a hand to get over. 
 The Intranet site, let's call it assist.domain.com can be accessed fine, as long as the URL begins with assit.domain.com. However, there are other resources, let's call them cdn.domain.com and profiles.domain.com which are referenced from the Intranet site. These are also on our internal network but I cannot access these links. These resources are located on separate servers from the one hosting our Intranet site. 
 Could someone please point me in the right direction as to how I may resolve this issue? Is it a case creating separate Real Webservers (and corresponding Virtual Webservers) for each of these resources or can Request Redirection aid in this. 
 I have Reverse Authentication working on the primary Intranet site but do not want to keep inputting usernames and passwords when accessing the additional resources. 
 Any help/suggestions would be much appreciated. 
 Best regards, 
 John P

DouglasFoster · Accepted Answer

I cannot justify why they have not updated HTML5 VPN Web resource to use a current browser. I cannot help wondering if the code was inherited in the Astaro acquisition but nobody understands it well enough anymore to make it current. It would be the solution you want. 
 WAF is for protecting a website from hostile web queries. For that function, you need a WAF virtual webserver for each real website. If you are letting people into your internal network, you are probably not very worried about hostile queries.

DouglasFoster · Answer

You need to switch to a technology that can access your whole network. 
 Options are SSL VPN client, html5 VPN to rdp (Which requires a personal desktop or terminal server), html5 vpn to web page (which runs a very old version of firefox on the user's behalf), or a non-UTM solution like VMware Horizon View. 
 Bob Alfson, who knows nearly all about UTM, warns that HTML5 to RDP is high overhead and not intended for more than a very few users.

Ol Deda · Answer

If your domain dns-server points any request to UTM (you can verify by pinging all the subdomains) 
 This can be done by Web Server protection instead of DNAT rules