Junos Pulse Instructions for Windows and Mac OS X

Transcription

1 Juns Pulse Instructins fr Windws and Mac OS X When yu pen the Juns client fr the first time yu get the fllwing screen. This screen shws yu have n cnnectins. Create a new cnnectin by clicking n the + icn.

2 After yu click n the + yu get the Add Cnnectin bx. Fill in the infrmatin. The Server URL is Then click n the Add buttn.

3 Nw cnnect t the FAU VPN cnnectin that yu just created by clicking n the Cnnect buttn:

4 Enter yur FAU User Name and Passwrd when prmpted. Then click the Cnnect buttn:

5 If yur system is in cmpliance fr access yu will be cnnected t the FAU VPN. Yu shuld see the fllwing screen:

6 Intrducing Juns Pulse Juns Pulse is an extensible multi service netwrk client that supprts integrated cnnectivity, lcatin-aware netwrk access, applicatin acceleratin, security, and selected third-party services. Juns Pulse simplifies the user experience by letting the netwrk administratr cnfigure, deply, and cntrl the Pulse client sftware and the Pulse cnnectin cnfiguratins that reside n the endpint. Juns Pulse cmprises client and server sftware. The client enables secure authenticated netwrk cnnectins t prtected resurces and services ver lcal and wide area netwrks. The Juns Pulse client sftware can cnnect with the Juns Pulse Secure Access Service t prvide remte access t enterprise and service prvider netwrks. Pulse can prvide applicatin acceleratin features when implemented with Juns Pulse Applicatin Acceleratin Service. Pulse als delivers secure, identity-enabled NAC fr LAN-based netwrk and applicatin access when deplyed with Juns Pulse Access Cntrl Service. Pulse integrates third-party endpint security applicatins such as anti spyware, anti malware, and patch management applicatins. Pulse als integrates with Juns Pulse Cllabratin Suite fr nline meeting services. Users f mbile devices (smartphnes) can install the Pulse mbile device app frm the respective app stres fr secure cnnectivity t Juns Pulse Secure Access Service. Mbile device users can als enable an ptinal security cmpnent, the Juns Pulse Mbile Security Suite. THE JUNOS PULSE CLIENT FOR WINDOWS The Juns Pulse client interface (see Figure 1) displays the deplyed Pulse services in the left pane and details abut the selected item in the right pane. The Cnnectins item lists the Pulse cnnectins. Each cnnectin is a set f prperties that enables netwrk access thrugh a specific Pulse server. The Security item is visible nly when ptinal security ptins are deplyed, such as the Juniper Netwrks Enhanced Endpint Security (EES) applicatin. If a Pulse server is licensed t prvide EES, yu can enable EES and deply it as part f the Hst Checker cnfiguratin. The Acceleratin item is active when the Pulse client has an adjacency with Pulse Applicatin Acceleratin Service. The Pulse client interface als supprts select third-party applicatins. Figure 1 shws ne such applicatin, ipass Netwrks, integrated int the Pulse client interface. Figure 1: Juns Pulse Client Interface

7 THE PULSE CLIENT FOR MAC OS X Pulse 3.0 and higher supprts Apple cmputers running Mac OS X. Yu deply Pulse t Mac endpints the same way yu deply the Windws client. Figure 2 shws the Pulse fr Mac client interface. Figure 2: Juns Pulse fr Mac Client Interface

8 Pulse fr Mac endpints supprts the fllwing: Cnnectins t Juns Pulse Access Cntrl Service Cnnectins t Juns Pulse Secure Access Service Pulse clients cnnect t the Pulse Secure Access Service in SSL fallback mde. Hst Checker Hst Checker fr Mac OS X supprts the fllwing rules and remediatin actins: Prt Prcess File Custm IMC Enable Custm Instructins Kill Prcesses Delete Files Send reasn strings

9 Nte: Pulse fr the Mac des nt supprt sft tken authenticatin. USER EXPERIENCE Frm the user perspective, Juns Pulse presents a clean, uncmplicated interface. The user can enter credentials, select a realm, save settings, and accept r reject the server certificate. When yu cnfigure the client, yu can specify whether r nt t permit end users d t mdify settings, such as t add cnnectins. The client displays the cnnectin status until the cnnectin is made. If a cnnectin fails as a result f the endpint failing a Hst Checker plicy, Hst Checker reasn strings and remediatin ptins appear. LOCATION AWARENESS The lcatin awareness feature enables yu t define cnnectins that are activated autmatically based n the lcatin f the endpint. Pulse determines the lcatin f the endpint by evaluating rules that yu define. Fr example, yu can define rules t enable Juns Pulse t autmatically establish a secure tunnel t the crprate netwrk thrugh Juns Pulse Secure Access Service when the user is at hme, and t establish a Juns Pulse Access Cntrl Service cnnectin when the user is in the ffice and cnnected t the crprate netwrk ver the LAN. Lcatin awareness rules are based n the client s IP address and netwrk interface infrmatin. SESSION MIGRATION If yu cnfigure yur access envirnment t supprt the Juns Pulse sessin migratin feature, users can lg in nce thrugh a Pulse server n the netwrk, and then securely access additinal Pulse servers withut needing reauthenticatin. Fr example, a user can cnnect frm hme thrugh Juns Pulse Secure Access Service, and then arrive at wrk and cnnect thrugh Juns Pulse Access Cntrl Service withut having t lg in again. Sessin migratin als enables users t access different resurces within the netwrk withut repeatedly prviding credentials. IF-MAP Federatin is required t enable sessin migratin fr users. CENTRALIZED CONTROL Centralized cnfiguratin management is a key feature f Juns Pulse. T achieve centralized management, yu can use Juns Pulse Access Cntrl Service r Juns Pulse Secure Access Service t cnfigure all f the cnnectins that clients need, and then push thse cnfiguratins t the ther servers using the Push Cnfiguratin feature. In a netwrk that includes mre than ne Juns Pulse server, yu can bind clients t a particular server. The client can autmatically pick up new cnnectins frm ther Pulse servers but nly the binding server can update the client s basic cnfiguratin settings. Yu can define Juns Pulse cnnectins n the server and pass them t the client r users can add cnnectins directly n the client. (Yu can disable the users ability t add cnnectins.) A cnnectin includes all f the infrmatin that a Pulse client needs t cnnect t a specific Pulse server. Cnnectins can be installed n the endpint when Juns Pulse is installed and they can be added r updated later. Optins within each Juns Pulse cnnectin allw an administratr t define the level f cntrl ver the clients. A cnnectin has the fllwing ptins: By default, a netwrk cnnectin thrugh Juns Pulse allws users t save their lgn credentials. The Juns Pulse admin interface lets yu disable this feature s that users must always prvide credentials. Yu can allw r deny users the ability t manually cnfigure new netwrk cnnectins t their existing Juns Pulse cnnectin set. Yu can allw dynamic cnnectins t prvide easy distributin f cnnectin settings. A dynamic cnnectin is autmatically dwnladed t an existing Pulse client when the user successfully lgs int the Pulse server s Web prtal and launches Pulse frm there. It is als installed as part f a Web install f Juns Pulse. Dynamic cnnectins are created as manual rather than autmatic cnnectins, which means that they are run nly when the user initiates the cnnectin r the user brwses t a Pulse Server and launches Pulse frm server s Web interface. Yu can allw r deny a client s ability t trust unknwn certificates.

10 Yu can chse t cntrl the client s wireless cnnectin envirnment. Juns Pulse relies n the endpint s native wireless supplicant, but yu can have Pulse discnnect all wireless cnnectins when the client is cnnected t a wired netwrk thrugh a Pulse cnnectin. Yu can als specify the permitted wireless netwrks (scan list) that are available when the Pulse client is cnnected thrugh a wireless interface. SECURITY CERTIFICATES Users cannt add CA servers r manage the server list. Pulse handles certificates similar t the way a brwser handles certificates. If the Pulse dynamic certificate trust ptin is enabled fr a cnnectin, the user can accept r reject the certificate that is presented if it is ne that is nt frm a CA that is defined in the endpint s certificate stre. An 802.1x cnnectin enables an added layer f certificate verificatin. When yu define an 802.1x cnnectin n the Pulse server, yu can specify server certificate distinguished names fr each CA. COMPLIANCE AND REMEDIATION Pulse supprts the Hst Checker applicatin t assess endpint health and update critical sftware. Hst Checker is a client side agent that is based n Trusted Netwrk Cnnect standards. Yu cnfigure rules in Hst Checker plicies fr Juns Pulse Secure Access Service and Juns Pulse Access Cntrl Service t specify the minimum criteria fr the security cmpliance f endpints that are allwed t enter the netwrk. Endpints that fail can be cnnected thrugh a rle that prvides limited access, a remediatin rle. Hst Checker can be deplyed frm a Pulse server t Pulse clients n Windws and Mac OS X endpints and it will be dwnladed and run when a brwser is used n a Windws r Mac OS X endpint t cnnect t the Pulse server Web prtal. Hst checker fr mbile clients (ios, Andrid, and Windws Mbile) is included as part f the app and it runs if Hst Checker plicies are cnfigured and enabled n the server. Hst Checker is nt supprted in the use case where the user emplys a brwser n the mbile device t cnnect t the Pulse server Web prtal. Fr Mac and OS X clients, yu can use Hst Checker t perfrm the fllwing: Malware prtectin thrugh Enhanced Endpint Security (EES) EES ensures that malware, spyware, viruses, r wrms are nt present n endpints, and yu can restrict r quarantine these endpints depending n yur Hst Checker plicy cnfiguratin. EES is an ptinal licensed feature f Pulse Secure Access Service and Juns Pulse Access Cntrl Service. Virus signature mnitring Yu can cnfigure Hst Checker t mnitr and verify that the virus signatures, perating systems, sftware versins, and patches installed n client cmputers are up t date. Yu can cnfigure autmatic remediatin fr thse endpints that d nt meet the specified criteria. Patch Management Inf Mnitring and Patch Deplyment Yu can cnfigure Hst Checker plicies that check fr Windws endpints perating system service pack, sftware versin, r desktp applicatin patch versin cmpliance. server and Juns Pulse Access Cntrl Service can send remediatin instructins (such as a message describing what patches r sftware are nn-cmpliant, and a link t where the endpint can btain the patch). Patch Remediatin Optins Pulse and Hst Checker supprt endpint remediatin thrugh Micrsft System Management Server r Micrsft System Center Cnfiguratin Manager (SMS/SCCM) r the Shavlik patch deplyment engine. With SMS/SCCM, Pulse triggers a pre-installed SMS/SCCM client t get patches frm a pre-cnfigured SMS/SCCM server. Shavlik

11 uses a patch deplyment engine that Pulse dwnlads t any endpint which needs remediatin. Shavlik prvides patches directly frm Micrsft and ther vendrs Web sites. (Internet cnnectivity is needed fr Shavlik remediatin.) Shavlik patch management is an ptinal feature. A separate license is required fr Shavlik patch mnitring and deplyment. Endpint cnfiguratin Yu can cnfigure custm rules t allw Hst Checker t check fr third party applicatins, files, prcess, prts, registry keys, and custm DLLs. Pulse mbile clients supprt a set f Hst Checker functins that vary frm ne OS t the next. Fr cmplete infrmatin n Hst Checker fr mbile clients, see Implementing Hst Checker Plicies fr Juns Pulse fr ios Devices, Implementing Hst Checker Plicies fr Juns Pulse fr Andrid Clients, and Juns Pulse Mbile Security Overview. TWO-FACTOR AUTHENTICATION Pulse supprts RSA SecurID authenticatin thrugh sft tken, hard tken, and smart card authenticatrs. The SecurID sftware (RSA client 4.1 and later) must already be installed n the client machine. JUNOS PULSE COLLABORATION SUITE INTEGRATION Juns Pulse Cllabratin Suite is accessible thrugh the Pulse interface n Windws, Mac OS X, Andrid, and ios. (Andrid clients must be R4.0 r later. ios clients must be R3.2 r later.) Juns Pulse Cllabratin Suite enables users t schedule and attend secure nline meetings. In meetings, users can share their desktps and applicatins with ne anther ver a secure cnnectin. Meeting attendees can cllabrate by enabling remte-cntrl f their desktps and thrugh text chatting. BOUND AND UNBOUND CLIENTS Anther feature f Pulse cnfiguratin management is the ability t bind Pulse clients t a single Pulse server. The binding server is the ne that prvides the initial Pulse cnfiguratin. Binding Juns Pulse clients t a particular server ensures that the client des nt receive different cnfiguratins when accessing ther Pulse servers. Adding a Pulse Cnfiguratin t a New Pulse Installatinexplains in mre detail hw the binding prcess wrks. The fllwing describes the behavirs f bund and unbund Juns Pulse clients. Bund client A bund client is managed by a particular Pulse server. The Pulse administratr defines the Juns Pulse cnnectins and sftware cmpnents that are installed n the endpint. When the Pulse client cnnects t the Pulse server that is managing it, the server autmatically prvisins cnfiguratin and sftware cmpnent updates. The administratr can permit the user t add and remve cnnectins and t mdify cnnectins. The administratr can als allw dynamic cnnectins, (cnnectins added by Pulse servers when the user lgs int the server using a brwser). A dynamic cnnectin enables a bund client t add cnnectins frm Pulse servers ther than the ne the client is bund t. Dynamic cnnectins are created as manual rather than autmatic cnnectins, which means that they are run nly when the user initiates the cnnectin r the user brwses t a Pulse Server and launches Pulse frm server s Web interface. A bund endpint receives cnnectin set ptins and cnnectins frm its binding server, but it can have its Pulse client sftware upgraded frm any Pulse server that has the autmatic upgrade ptin enabled. Unbund client An unbund client is managed by its user. The Juns Pulse client sftware is installed withut any cnnectins. The user must add cnnectins manually. Dynamic cnnectins can be added by visiting the Web prtals f Pulse servers. An unbund client des nt accept cnfiguratin updates frm a Pulse server even if client cnfiguratins are defined n that server. SIGN-IN NOTIFICATIONS

12 The ntificatins feature n Pulse Secure Access Service and Pulse Access Cntrl Service allws the netwrk administratr t display ntificatins t Pulse client users prir t the user lgging in and after the user has already lgged in. Fr example, yu culd display a legal statement r a message stating wh is allwed t cnnect t the server prir t shwing the Pulse credentials dialg. After the user has cnnected, yu culd display a message that ntifies the user f scheduled netwrk r server maintenance r an upcming cmpany meeting. AUTOMATIC SOFTWARE UPDATES After yu deply Juns Pulse client sftware t endpints, sftware updates ccur autmatically. If yu upgrade the Juns Pulse cnfiguratin n the server, updated sftware cmpnents are pushed t a client the next time it cnnects. (Yu can disable this autmatic upgrade feature.)