StoneGate SSL VPN Technical Note Deploying Access Clients

Transcription

1 StoneGate SSL VPN Technical Note 2082 Deploying Access Clients

2 Table of Contents Introduction page 3 Overview page 3 Creating Tunnel Resources page 3 Permissions for IE on Windows XP SP page 4 Accessing the Tunnel Resources page 5 Feedback page 6 Table of Contents 2

3 Introduction This technical note covers the deployment of Access Clients in StoneGate SSL VPN. Additions of information since last revision (SG_SVTN_2082_ ) are marked in the left margin with a change bar as seen here. Prerequisites This technical note assumes a thorough understanding of StoneGate SSL VPN administration. Use the further reading to gain the required knowledge. Further Reading More information on StoneGate SSL VPN administration can be found in the StoneGate SSL VPN Administrator s Guide, the Online Help, and the Technical Note repository provided with the product. Another source of information is the StoneGate Support site, which can be found at Overview The Access Client allows users access to tunnel resources, which are displayed as an icon in the Application Portal. The Access Client is either a Win32 application or a Java application, that are loaded either using an ActiveX Web loader (Internet Explorer only) or a Java Applet Web loader. When a user clicks an icon for a tunnel set in the Application Portal, the Access Client attempts to load an ActiveX Web loader or a Java applet loader. The order is defined in the tunnel settings in the StoneGate SSL VPN Administrator. When the software on the StoneGate SSL VPN appliance is upgraded, a new version of the Access Client is made available and already installed clients are upgraded to this new version. Note The ActiveX loader requires administrator rights on the client the first time it is used and when it is upgraded. In addition, local lookups and DNS forwarding require administrator rights on the client every time they are used. A tunnel set can include one or several tunnel resources. It contains static and/or dynamic tunnels, at least one for each resource included in the set. Static tunnels are configured to tunnel resources on the local interface using a single port, and can be used on all platforms. Dynamic tunnels are configured to tunnel resources using any IP address on one or a range of ports, and can only be used on Windows platforms. A tunnel resource can be included in several tunnel sets. This enables you to associate tunnel sets with different levels of access control, for example for different user groups. Note Access control of a specific tunnel resource is always done using the access rules configured for that tunnel resource. The only use of access rules on a tunnel set is to make the associated icon in the Application Portal subject to access control as well. Creating Tunnel Resources You configure tunnel resource hosts for client-server applications that are not Web enabled. An example of such applications is Remote Desktop. The tunnel allows any TCP/UDP traffic between the client and the server to be channeled over a protected SSL connection. A tunnel is an intermediary program acting as a blind relay between two connections. Once active, a tunnel is not considered a party to the HTTP communication, though the tunnel may have been initiated by an HTTP request. The tunnel ceases to exist when both ends of the relayed connections are closed. Introduction 3

4 In order to make a tunnel resource accessible to the user, you configure a tunnel set to include static and/or dynamic tunnels for the resource. Users access the tunnel resources through the Application Portal. The tunnel resources you collect in a tunnel set are normally protected by access rules. In addition, you can apply access rules to the tunnel set itself, to control how and when users should be able to access the tunnel set. You can set your own security levels with access rules for specific client applications and servers. Registered tunnel resources are listed in the StoneGate SSL VPN Administrator on the Manage Tunnel Resources page in the Manage Resource Access section. You can add, edit, and delete tunnel resources. To make a tunnel resource accessible to the user, you create a static or dynamic tunnel for the resource in a tunnel set and configure it to be displayed in the Application Portal. In addition, a number of settings can be specified globally to apply to all resources, including tunnel resources. This is configured in the Manage Global Resource Settings section of Manage Resource Access. Permissions for IE on Windows XP SP2 The following table outlines the different permissions, or user rights, required in the steps described in the instructions below for Internet Explorer. TABLE 1 Permissions for Internet Explorer on Windows XP SP2 Permission Required Admin Restricted user (write) Regular user (write) When When loading the ActiveX Web loader When replacing driver on disk When extracting portwise_clnt.sys and writing it to the %windir%\system32 directory When modifying DNS settings When copying the Windows DLL is copied to a temp folder When starting Windows Native Access Client help driver When starting DNS Proxy Helper When performing proxy detection When downloading the Windows Native Access Client from the Web Comment When starting a Dynamic Tunnel, the Windows Native Access Client help driver is required. If help driver is not installed, it is extracted from the Windows Native Access Client When starting a static tunnel, DNS settings on the client computer must be modified to redirect DNS requests to our proxy When loading of the Java Applet Web loader fails The first incoming connection tries to connect directly to the SSL VPN appliance (without proxy) If the connections do not connect in 1000 ms, proxy detection is performed. Permissions for IE on Windows XP SP2 4

5 Accessing the Tunnel Resources The tunnel resource is accessed through the Access Client, which is loaded using one of three options: ActiveX Web Loader Java Applet Web Loader Pure Java Access Client Note that the order in which they are listed is hierarchal: if the ActiveX Web Loader fails, an attempt is made with the Java Applet Web Loader, and so on. The order can be customized, but this document follows the default order. Loading ActiveX requires Admin rights and the following settings configured in Internet Explorer. To configure Internet Explorer for the ActiveX Web Loader 1. In the Tools menu, select Internet Options. On the Security tab, select Internet and then click the Custom Level button. 2. Download signed ActiveX controls must be set to Enable or Prompt. 3. Run ActiveX controls and plug-ins must be set to Enable or Prompt. 4. To run the ActiveX access client loader successfully with Windows Vista UAC, you must add the StoneGate SSL VPN appliance s https address to the list of trusted sites in Internet Explorer. If the Java Applet Web Loader fails, the user is not provided an error message. This is due to lacking integration between the Java Virtual Machine and the browser (when using SUN). A small Windows helper DLL contained within the jar must be copied to a temporary folder on the computer and loaded from there. This procedure requires Restricted User write permissions. When a loader has been successfully loaded, the Windows Native Access Client is loaded. Note that if the Windows Native Access Client cannot be downloaded or started, the Pure Java Access Client is used. More information on this is provided below. Windows Native Access Client The checksum of the Windows Native Access Client process is verified against the application on the appliance. If the checksums match, the tunnel set is loaded, using static and/or dynamic tunnels as described below. If the checksum does not match, the user can accept the invalid application or a fresh copy of the application can be downloaded from the appliance. This requires write permission on disk: Regular user. Start Dynamic Tunnels If the required help driver is not installed, the driver on disk must be replaced. The driver (portwise_clnt.sys) is extracted from the Windows Native Access Client written to the %windir%\system32 directory. This procedure requires admin rights. If the installation of the driver succeeds, the driver is registered in the OS and started. Remember to register virtual IP to the driver If the driver already is running, the user is prompted to restart the computer in order to receive the updated driver. If the driver is not running, it must be started. This requires restricted user rights. Data can now be tunneled between the client and the server. Start Static Tunnel If Local Lookups are configured: The DNS proxy must be started in the Access Client, and the DNS settings modified to redirect the DNS requests to our proxy. This procedure requires admin rights. If the DNS settings cannot be modified, no local lookups are used. If mapped drives are defined: Map the defined drive. If credentials are required, the user is prompted by the operating system for such credentials. If the drive letter for the mapped drive already is assigned to another share, a new drive letter will be selected for the drive being mapped Accessing the Tunnel Resources 5

6 If Startup Commands are configured: The startup command is listed as a specified trusted command (the default trusted commands are outlook, explorer, explorer /e, explorer /e,, A: - Z: ) in StoneGate SSL VPN Administrator. If it is a trusted command, the command is executed. The use of a single drive letter (for example, F: ) as a startup command does not work in Windows Vista, because all commands must be executed using runas to elevate to admin mode (since the mapping is done in admin mode) and F: is not a valid executable. Use the startup command explorer /root,f: instead. This command works on both Windows XP and Windows Vista. If the startup command is not a trusted command, the user is prompted to select to accept, deny, or always trust the command. If accept: Command is executed If deny: Command is ignored If always trust: Command is saved as a trusted command in the registry of the current user and executed Data can now be tunneled between the client and the server. Pure Java Access Client Dynamic Tunnels Notify user that dynamic tunnels are not supported and ignore that tunnel Static Tunnels If the local port is already in use, up to 99 ports before the first one are searched for the next available port. If none of the 100 ports are available, an error message is displayed and the next configured tunnel is used. If an available port was found, display a message to the user that another port is being used. (The number of the port is also displayed.) If startup commands are defined, they are executed. Incoming connections The Pure Java Access Client tries to connect directly to the Access Point (without proxy). If the connections do not connect in 1000 ms, proxy detection is performed. Proxy detection requires write-permissions to the disk: Restricted User. If a proxy is detected the connection will connect through that proxy instead. If no proxy is found or if proxy could not be detected, the Pure Java Access Client will try to connect directly to the server until the socket times out from the OS. A handshake is initiated and the Access Point is notified of what resource is requested. If the Access Point answers this handshake with an authentication request, an error message will be displayed since the Pure Java Access Client does not support authentication. Data can now be tunneled between the client and the server. Feedback Stonesoft is always interested in feedback from our users. For comments regarding Stonesoft s products, contact feedback@stonesoft.com. For comments regarding this technical note, contact documentation@stonesoft.com. Feedback 6

7 Trademarks and Patents Stonesoft, the Stonesoft logo and StoneGate are all trademarks or registered trademarks of Stonesoft Corporation. Multi-link technology, multi-link VPN, and the StoneGate clustering technology-as well as other technologies included in StoneGate-are protected by patents or pending patent applications in the U.S. and other countries. All other trademarks or registered trademarks are property of their respective owners. SSL VPN Powered by PortWise Copyright and Disclaimer Copyright Stonesoft Corporation. All rights reserved. These materials, Stonesoft products and related documentation are protected by copyright and other laws, international treaties and conventions. All rights, title and interest in the materials, Stonesoft products and related documentation shall remain with Stonesoft and its licensors. All registered or unregistered trademarks in these materials are the sole property of their respective owners. No part of this document or related Stonesoft products may be reproduced in any form, or by any means without written authorization of Stonesoft Corporation. Stonesoft provides these materials for informational purposes only. They are subject to change without notice and do not represent a commitment on the part of Stonesoft. Stonesoft assumes no liability for any errors or inaccuracies that may appear in these materials or for incompatibility between different hardware components, required BIOS settings, NIC drivers, or any NIC configuration issues. Use these materials at your own risk. Stonesoft does not warrant or endorse any third party products described herein. THESE MATERIALS ARE PROVIDED "AS-IS." STONESOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, AS TO, THE INFORMA- TION CONTAINED HEREIN. IN ADDITION, STONESOFT MAKES NO EXPRESS OR IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE OR USE WITH RESPECT THE INFORMATION CONTAINED IN THESE MATERIALS. IN NO EVENT SHALL STONESOFT BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL OR INCIDENTAL DAMAGES, INCLUD- ING, BUT NOT LIMITED TO, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING FROM THE USE OF THESE MATERIALS, EVEN IF ADVISED IN ADVANCE OF THE POSSIBILITY OF SUCH DAMAGES. SG_SVTN_2082_ Stonesoft Corp. Itälahdenkatu 22a FIN Helsinki Finland tel fax Business ID: Domicile: Helsinki Stonesoft Inc Crown Pointe Parkway Suite 900 Atlanta, GA USA tel fax