MERCY INFORMATION SECURITY TEAM

Transcription

1 MERCY INFORMATION SECURITY TEAM Troubleshooting tips for the Mercy SSL VPN Supported platforms: o Windows Vista with Internet Explorer 7.0 o Windows XP with Internet Explorer 6.0 and 7.0 o Windows XP SP2 (must have KB patch) with Internet Explorer 6.0 and 7.0 o Windows 2000 with Internet Explorer 6.0 and 7.0 Requirements o Client machine must have an up to date antivirus program running. o Users must have Administrative Right on the client and install an ActiveX control, or utilize the Java Installer (The Java Installer will happen by default if ActiveX is not enabled.) o Users with XP SP2 must install KB patch (Available Here) o Personal Firewalls installed on the machine must allow port 443 to pass outbound, and allow the installation of the Network Connect Client. o Internet security packages installed on the machine must trust Mercy networks and hosts. Known Issues: o Problems connecting to websites while on the internal network. o MercyConnect (Citrix Issue) Error: Cannot connect to specified Citrix server. o Problems with Timezone Grabber hanging and causing IE to freeze. o Error: Neoteris has detected that other applications have installed the following layered service providers LSP on your system: **** MERCY INFORMATION SECURITY TEAM

2 Requirements Client machine must have an up to date antivirus program running. (Updated within 7 days) Any of the following vendors are supported: AntiVir/XP (6.x) Antivirussystem AVG 6.0 (6.x) AVG 6.0 Anti-Virus - FREE Edition (6.x) AVG 6.0 Anti-Virus System (6.x) AVG Anti-Virus 7.0 (7.x) AVG Anti-Vírus 7.0 (7.x) AVG Antivirensystem 7.0 (7.x) AVG Free Edition (7.x) BitDefender 8 Free Edition (8.x) BitDefender 8 Professional Plus (8.x) BitDefender 8 Standard (8.x) BitDefender 9 Professional Plus (9.x) BitDefender 9 Standard (9.x) BitDefender Free Edition (7.x) BitDefender Professional Edition (7.x) BitDefender Standard Edition (7.x) CA etrust Antivirus (7.x) ClamWin Antivirus (0.x) ClamWin Free Antivirus (0.x) Command Anti-Virus Enterprise (4.x) Command AntiVirus for Windows (4.x) Command AntiVirus for Windows Enterprise (4.x) Dr.Web (4.32.x) Dr.Web for Windows 95-XP (4.31.x) Dr.Web for Windows 95-XP (4.32.x) etrust EZ Antivirus (6.1.x) etrust EZ Antivirus (6.2.x) etrust EZ Antivirus (6.4.x) etrust EZ Antivirus (7.x) etrust EZ Armor (6.1.x) etrust EZ Armor (7.x) F-Prot for Windows (3.14e) F-Prot for Windows (3.15) F-Secure Anti-Virus (5.x) F-Secure Internet Security 2006 Beta (6.x) Kaspersky Anti-Virus 2006 Beta (6.0.x) Kaspersky Anti-Virus Personal (4.5.x) Kaspersky Anti-Virus Personal (5.0.x) Kaspersky(TM) Anti-Virus Personal 4.5 (4.5.x) Kaspersky(TM) Anti-Virus Personal McAfee VirusScan (4.5.1.x) McAfee VirusScan (8.x) McAfee VirusScan (8xxx) McAfee VirusScan (9.x) McAfee VirusScan (9xxx) McAfee VirusScan Enterprise (7.0.0.x) McAfee VirusScan Enterprise (7.1.0.x) McAfee VirusScan Enterprise (7.5.0.x) McAfee VirusScan Enterprise (8.0.0.x) McAfee VirusScan Professional (8.x) McAfee VirusScan Professional (8xxx) McAfee VirusScan Professional (9.x) McAfee VirusScan Professional Edition (7.x) NOD32 antivirus system (2.50) NOD32 antivirus system (NA) Norton AntiVirus (10.x) Norton AntiVirus 2002 ( x) Norton AntiVirus 2002 (8.x) Norton AntiVirus 2002 Professional (8.x) Norton AntiVirus 2002 Professional Edition (8.x) Norton AntiVirus 2003 (9.x) Norton AntiVirus 2003 Professional (9.x) Norton AntiVirus 2003 Professional Edition (9.x) Norton AntiVirus 2004 (10.x) Norton AntiVirus 2004 (Symantec Corporation) (10.x) Norton AntiVirus 2004 Professional (10.x) Norton AntiVirus 2004 Professional Edition (10.x) Norton AntiVirus 2005 (11.0.x) Norton AntiVirus 2006 (12.0.x) Norton AntiVirus Corporate Edition (7.x) Norton AntiVirus Corporate Edition 7.0 Norton SystemWorks 6.x 8.x Norton SystemWorks 2005 Premier (8.x) Panda Antivirus 6.0 Platinum (6.0)Panda Antivirus Lite (1.x) Panda Antivirus Platinum ( ) Panda Platinum 2005 Internet Security (9.x) Panda Platinum Internet Security ( x) Panda Titanium Antivirus 2004 ( ) Panda Titanium Antivirus 2004 ( x) Panda Titanium Antivirus 2005 (4.x) Panda TruPrevent Personal 2005 (2.x) PC-cillin 2002 (9.x) PC-cillin 2003 (10.x) SBC Yahoo! Anti-Virus (7.x) Sereniti Security Suite (1.x) Sophos Anti-Virus (3.x) Sophos Anti-Virus (5.x) Sophos Anti-Virus version 3.80 (3.80) Symantec AntiVirus (10.x) Symantec AntiVirus (9.x) Symantec AntiVirus Client (8.x) Symantec Client Security (10.x) Symantec Client Security (9.x) Système anti-virus AVG 7.0 (7.x) The River Home Network Security Suite (1.x) Trend Micro Antivirus (11.x) Trend Micro Internet Security (11.x) Trend Micro Internet Security (12.x) Trend Micro OfficeScan Client (5.x - 7.x) Trend Micro PC-cillin 2004 (11.x) Trend Micro PC-cillin Internet Security 2005 (12.x) Trend Micro PC-cillin Internet Security 2006 (14.x) ZoneAlarm Anti-virus (6.x) ZoneAlarm Security Suite (5.x) Pro 4.5 (4.5.x) for Windows NT (7.x) ZoneAlarm Security Suite (6.x) McAfee Internet Security 6.0 (8.x) Norton Internet Security (7.x) ZoneAlarm with Antivirus (5.x) McAfee Managed VirusScan (3.x) Norton Internet Security (8.0.x) McAfee VirusScan (10.x) Norton Internet Security (8.x) MERCY INFORMATION SECURITY TEAM 2

3 Users must have Administrative Rights on the client to install an ActiveX control or utilize the Java Installer In order for the SSL VPN to work correctly the user must install an activex control on the machine, or utilize the Java Installer. In order to install the ActiveX control the user will need to have administrative rights on the machine and the Internet Explorer settings must allow ActiveX controls. ActiveX Controls: Inside Internet Explorer go to Tools/Internet Options/Security from the Internet zone choose custom, and verify that the Run ActiveX controls and plug-ins is enabled as shown below. Administrative Rights: To check administrative rights (XP this may vary by system) you will go to start/control panel/administrative tools/computer management/local users and Groups /Groups /Administrators. The logged in user should show up in this screen. MERCY INFORMATION SECURITY TEAM 3

4 MERCY INFORMATION SECURITY TEAM 4

5 XP SP2 Instructions Only applicable to Windows XP Service Pack 2 users. Users will be able to connect, but no applications will work. Users will not be able to connect to any internal resources. Windows terminal sessions will bring up a white screen, and timeout. Click on the link from the Login Page for the Microsoft XP SP2 Patch Follow the link and download the file. Save the file to your pc MERCY INFORMATION SECURITY TEAM 5

6 Click on the file that you just saved and click on the RUN When the file finishes the install, you may be asked to reboot. After rebooting, you should now be ready to login to Neoteris. (Go back to Step #1 of the instruction document) MERCY INFORMATION SECURITY TEAM 6

7 Personal Firewalls installed on the machine must allow port 443 to pass outbound and allow the installation of the Network Connect Client. The SSL VPN operates over port 443 outbound from the client machine. This is the standard SSL port, and will normally not be a problem. However, if the client firewall is configured to drop all outbound requests unless specifically authorized they may need to open this setting. A good way to test is to lower the security setting on the firewall and try the page, or turn off the firewall and try again. Depending on the type of personal firewall the user may be prompted by their firewall before the installation of Network Connect will begin. The user must accept this installation before they will have full functionality. Users will only be able to connect to web based assets such as webmail and the intranet without Network Connect installed. To test whether Network Connect is functioning properly: Have the user test connectivity. From a command prompt type: ping Pinging with 32 bytes of data: The user should see response times of < 250ms. MERCY INFORMATION SECURITY TEAM 7

8 Internet Security packages installed on the machine must trust Mercy networks and hosts. In order for the SSL VPN components to work properly, security software must be configured to allow unrestricted traffic to flow between this computer and all mercy networks and hosts. The following networks/sites/hosts must be configured as trusted. This can be accomplished automatically in Internet Explorer by running trustmercy.exe from the neoteris installers page. *.mercy.net *.somhs.org 10.*.*.* *.* * *.* MERCY INFORMATION SECURITY TEAM 8

9 Known Issues Problems connecting to websites while on the internal network. Users should not utilize the SSL VPN while on the internal network. If users want the meeting functionality they should select the Secure Meeting Only role while logging in. If the users need to utilize the SSL VPN for bookmarks while on the internal network they must disable network connect. This application will be running in the system tray depicted below. You can disable by right clicking and selecting disconnect. MERCY INFORMATION SECURITY TEAM 9

10 MercyConnect (Citrix Issue) Error: Cannot connect to specified Citrix server. Users who are experiencing this error do not have network connect running. Verify the lock in the system tray (depicted above). If this is running and the user still experiences this error, test connectivity. From a command prompt type: ping Pinging with 32 bytes of data: The user should see response times of < 250ms. MERCY INFORMATION SECURITY TEAM 10

11 Problems with Timezone Grabber hanging and causing IE to freeze. Problems have been reported of Timezone Grabber hanging during the initial setup of the SSL VPN. This problem is normally due to spyware running on the local computer. In order to fix this problem the user should uninstall the spyware. A free tool to accomplish this task is the Microsoft Antispyware tool. Another possibility is if MSN Toolbar or Google Desktop is installed on the client machine. This is a known issue and will be resolved with upgrade to 4.2 (3/29/05). The only resolution until the upgrade is to uninstall MSN Toolbar or Google Desktop. MERCY INFORMATION SECURITY TEAM 11

12 Neoteris has detected that other applications have installed the following layered service providers LSP on your system This message indicates that another VPN has been detected on the computer. In order for the SSL VPN to function correctly it must be the only VPN installed on the system. The problem usually stems from Mercy users who previously installed Checkpoint Secure Remote for IPSec VPN access. However, this problem will also occur if other VPN clients are installed on the system. The only solution is to remove this second application through Add/Remove Programs. MERCY INFORMATION SECURITY TEAM 12