EiS Kent Schools Broadband (KPSN) Juniper VPN Administration Guide May 2014

Transcription

1 EiS Kent Schools Broadband (KPSN) Juniper VPN Administration Guide May 2014

2 TABLE OF CONTENTS 1 PURPOSE OF DOCUMENT INTENDED AUDIENCE BACKGROUND VPN CONFIGURATION DETAILS CLIENTLESS WEBVPN REMOTE ACCESS ADDING USERS NAMING CONVENTION AND PASSWORDS USER ADMINISTRATION PROCESS DELETE USER ACCOUNT END USER EXPERIENCE NETWORK CONNECT CLIENT FILE SHARES EiS Kent May 2014

3 1 PURPOSE OF DOCUMENT KPSN SB JUNIPER VPN USER ADMINISTRATION This document discusses administration of the Schools Broadband Juniper SSL VPN service. 2 INTENDED AUDIENCE This document is intended as a guide for establishment ICT administrators when configuring VPN access to the school network. 3 BACKGROUND A VPN access solution is available to provide remote access to your schools network via a clientless (SSL) WebVPN. 4 VPN CONFIGURATION DETAILS In order to provide secure remote access the concept of a unique group for each school will be used where authenticated users will be mapped into their school group and assigned details and filtering based on the schools configuration. This configuration will include access to the schools network range and device access through Juniper SSL WebVPN. 4.1 CLIENTLESS WEBVPN REMOTE ACCESS The introduction of clientless VPN means that it is now possible to provide VPN access to both students and staff alike as there is no longer a need to have a dedicated VPN client to access resources remotely. With the Juniper SSL WebVPN access is via a HTTPS web page, each school will present their services via its own webpage, once the user signs in. The Juniper SSL WebVPN service can be used to publish: Intranet websites / Outlook web access Network Access Telnet / SSH Terminal services / Virtual Desktops File servers for uploading / downloading files Application Access By default the Schools Broadband Service Desk will enable full network access to your Schools IP range via the Network Connect client. May EiS Kent

4 If you would like to enable additional features please provide the Schools Broadband service desk with details of the services you wish to present (intranet servers, file servers, etc.) In order for schools users to use a school resource (such as an server) the user will attach to the SSL VPN page by connecting to WebVPN and provide authentication credentials. To login users should enter their username and password, authentication requests are either sent to a central Cisco ACS server which we provide delegated administration for schools to create user accounts. Alternatively the Juniper SSL VPN can be configured to authenticate against a RADIUS server deployed by a school. With RADIUS authentication a user will login with their regular Windows credentials. To deploy RADIUS VPN authentication for your school, use the appropriate RADIUS Installation and configuration guide (Server 2003 or Server 2008) on the EIS KENT website. Enter RADIUS into the websites search box and click GO to locate the documents. 5 ADDING USERS A central Cisco Secure Access Control Sever authenticates users. Each user must be assigned a username that is unique. In order to achieve this, a naming format of School DCSF number followed by first initial and last name will be used (as explained below in section 6.1). School administrators will have access and administrative rights to the authentication server in order to add / delete users to and from their own schools group using the admin accounts provided by the Schools Broadband Service Desk. 5.1 NAMING CONVENTION AND PASSWORDS The following naming convention should be used when adding users to school groups [School DCSF number] [First initial] [Surname] An example of this for the user Andrew Smith at a School with DCSF of 1234 would be 1234asmith. If there is a second user with the same name at a school, an additional number may be used at the end of the name (i.e. 1234asmith2) Passwords must be alphanumerical of at least 8 characters. Please ensure that the passwords created are Strong passwords using special and both lower and upper case characters! EiS Kent May 2014

5 5.2 USER ADMINISTRATION PROCESS The authentication server is only reachable from within the Schools Broadband network, the authentication server is reached by web browsing to the following URL: (note the need to add the 2002 port number at the end of the URL) You will be presented with the following screen, login to the authentication server using your admin account. Once connected choose the User Setup tab from the left hand column (highlighted below) May EiS Kent

6 The User Setup tab will take you to the Add User screen, enter the DCSF number first initial and surname of the user and click Add. The user details screen will be displayed (shown below) where you should enter a full description of the user, enter their password and select the users group. As school admin accounts only allow you to add users for your school there should only be one option. Click Submit to add the user. EiS Kent May 2014

7 5.3 DELETE USER ACCOUNT KPSN SB JUNIPER VPN USER ADMINISTRATION When a user (student for example) leaves a school it is the responsibility of the school administrator to remove that user s account from the authentication server. This is done by selecting the User Setup tab; selecting the user using the alphabetical list and then click Delete at the bottom of the screen. An example of this is shown below. 6 END USER EXPERIENCE To log into the Juniper SSL VPN use the following URL: May EiS Kent

8 Enter your login credentials and you will be presented with a screen displaying access options. The sample screen above shows an entry for Network Connect Client, Terminal server and a File server. 6.1 NETWORK CONNECT CLIENT The Network Connect client enables network access to your school. It supports Internet Explorer for Windows and Safari for OSX. Click Start to the left of Network Connect (shown in the screenshot above) to use the client. Agree to Always execute the client or click Yes (if prompted) EiS Kent May 2014

9 Once the client has been installed you may need to click the here link to complete the setup process. (Shown below) A padlock symbol appears in the Windows System Tray confirming that you are connected. You now have network access to your schools network and can map drives, access shares, RDC onto servers and workstations and access local intranets and hosted applications. Right click the padlock icon and click Sign Out when you want to end the Network Connect session. May EiS Kent

10 6.2 FILE SHARES If you select the File server entry you are then prompted to enter a username and password for access to the server, this will be the users local Windows logon for that server, an example of the screen is shown below: Once access has been gained to the file server, the files and directories are displayed as shown in the example below. Users can navigate to their own or shared directory and Upload, Download, Delete or read files from the directory using the buttons highlighted. EiS Kent May 2014

11 /KPSN/JAG