KPSN SB Juniper VPN User Administration

Transcription

1 KPSN SB Juniper VPN User Administration

2 TABLE OF CONTENTS 1 PURPOSE OF DOCUMENT INTENDED AUDIENCE BACKGROUND VPN CONFIGURATION DETAILS CLIENTLESS WEBVPN REMOTE ACCESS ADDING USERS NAMING CONVENTION AND PASSWORDS USER ADMINISTRATION PROCESS DELETE USER ACCOUNT END USER EXPERIENCE NETWORK CONNECT CLIENT FILE SHARES Support If you have any questions about any procedure in this guide please contact the Schools Broadband Team Telephone: Faxback: schools.broadband@eis.kent.gov.uk Web: July EiS

3 1 PURPOSE OF DOCUMENT KPSN SB JUNIPER VPN USER ADMINISTRATION This document discusses administration of the Schools Broadband Juniper SSL VPN service. 2 INTENDED AUDIENCE This document is intended as a guide for establishment ICT administrators when configuring VPN access to the school network. 3 BACKGROUND A VPN access solution is available to provide remote access to your schools network via a clientless (SSL) WebVPN. 4 VPN CONFIGURATION DETAILS In order to provide secure remote access the concept of a unique group for each school will be used where authenticated users will be mapped into their school group and assigned details and filtering based on the schools configuration. This configuration will include access to the schools network range and device access through Juniper SSL WebVPN. 4.1 CLIENTLESS WEBVPN REMOTE ACCESS The introduction of clientless VPN means that it is now possible to provide VPN access to both students and staff alike as there is no longer a need to have a dedicated VPN client to access resources remotely. With the Juniper SSL WebVPN access is via a HTTPS web page, each school will present their services via its own webpage, once the user signs in. The Juniper SSL WebVPN service can be used to publish: Intranet websites / Outlook web access Network Access Telnet / SSH Terminal services / Virtual Desktops File servers for uploading / downloading files Application Access By default the Schools Broadband Service Desk will enable full network access to your Schools IP range via the Network Connect client. If you would like to enable additional features please provide the Schools Broadband service desk with details of the services you wish to present (intranet servers, file servers, etc.) July EiS

4 In order for schools users to use a school resource (such as an server) the user will attach to the SSL VPN page by connecting to WebVPN and provide authentication credentials. To login users should enter their username and password, authentication requests are either sent to a central Cisco ACS server which we provide delegated administration for schools to create user accounts. Alternatively the Juniper SSL VPN can be configured to authenticate against a RADIUS server deployed by a school. With RADIUS authentication a user will login with their regular Windows credentials. To deploy RADIUS VPN authentication for your school, use the appropriate RADIUS Installation and configuration guide (Server 2003 or Server 2008) on the EIS website. Enter RADIUS into the websites search box and click GO to locate the documents. 5 ADDING USERS A central Cisco Secure Access Control Sever authenticates users. Each user must be assigned a username that is unique. In order to achieve this, a naming format of School DCSF number followed by first initial and last name will be used (as explained below in section 6.1). School administrators will have access and administrative rights to the authentication server in order to add / delete users to and from their own schools group using the admin accounts provided by the Schools Broadband Service Desk. 5.1 NAMING CONVENTION AND PASSWORDS The following naming convention should be used when adding users to school groups [School DCSF number] [first initial] [surname] An example of this for the user Andrew Smith at a School with DCSF of 1234 would be 1234asmith. If there is a second user with the same name at a school, an additional number may be used at the end of the name (i.e. 1234asmith2) Passwords must be alphanumerical of at least 8 characters. Please ensure that the passwords created are Strong passwords using special and both lower and upper case characters! 5.2 USER ADMINISTRATION PROCESS The authentication server is only reachable from within the Schools Broadband network, the authentication server is reached by web browsing to the following URL: (note the need to add the 2002 port number at the end of the URL) You will be presented with the following screen, login to the authentication server using your admin account. July EiS

5 Once connected choose the User Setup tab from the left hand column (highlighted below) The User Setup tab will take you to the Add User screen, enter the DCSF number first initial and surname of the user and click Add. July EiS

6 The user details screen will be displayedd (shown below) where you should enter a full description of the user, enter their t password and select the users u group. As school admin accounts only allow you to addd users forr your school there should only be one option. Click Submit to add the user. July EiS

7 5.3 DELETE USER ACCOUNT When a user (student for example) leaves a school it is the responsibility of the school administrator to remove that user s account from the authentication server. This is done by selecting the User Setup tab, t selecting the user using thee alphabetical list and then click Delete at the bottom of the t screen. An example of this to do this is shown below. 6 END USER EXPERIENCE To log into the Juniper SSL VPN use the following URL: Enter your login credentials and you will be presented with a screen displaying access options. July EiS

8 The sample screen above shows an entry for Network Connect Client, and a File server. Terminal server 6.1 NETWORK CONNECT CLIENT The Network Connect client enables network access to your school. It supports Internet Explorer for Windows and Safari for OSX. Click Start to the left of Network Connect (shown in the screenshot above) to use the client. Agree to Always execute the client or click Yes ( if prompted) Once the client has been installed you may need to click the here linkk to complete the setup process. (Shown below) ) July EiS

9 A padlock symbol appears in the Windows System Tray confirming that you are connected. You now have network access to your schools network n and can map drives, access shares, RDC onto servers and workstations and access local intranets and hosted applications. Right click the padlock icon and click Sign Out when you want w to endd the Network Connect session. July EiS

10 6.2 FILE SHARES If you select the File server entry you aree then prompted to enter e a username and password for accesss to the server, this will be the users local Windowss logon for that server, an example of the screen is shown below: Once access has been gained to the filee server, the files andd directories are displayed as shown in the example below. Users can navigate to their own or sharedd directory and Upload, Download, Delete or read r files from the directory using the buttons highlighted. July EiS

11 Our passion in EiS is to make a real difference in education and ultimately children's lives by providing innovative solutions and outstanding support services. Tel: Fax: EiS Kent County Council The Shepway Centre Oxford Road Maidstone, Kent ME15 8AW