Requirements Collax Security Gateway Collax Business Server or Collax Platform Server including Collax SSL VPN module

Transcription

1 Collax SSL VPN Howto This howto describes the easy configuration of a Collax server as SSL VPN gateway in order to enable external access to selected applications in the company network. Except for a common browser, this does not require any client (client-less use). Requirements Collax Security Gateway Collax Business Server or Collax Platform Server including Collax SSL VPN module Browser with SSL and Java (available on most computers and many mobile devices) Background External access to various Web applications is often impossible. These are either not encrypted in the company network, or no provisions have been made for access from the Internet. These applications can now be made available for external access with encryption and without any customization. The integration of SSL VPN facilitates the support of such applications, such as Outlook Web Access, on external workstations. Based on SSL, it is also possible to use all applications whose protocols use only one port. For example, this enables full, decentralized access to mail programs. With its SSL VPN solution, Collax also provides agents for the use of terminal services. In this way, the Microsoft Remote Desktop Protocol (RDP) as well as Citrix ICA client connections or the open Virtual Network Computing (VNC) can be supported. These agents are automatically started as Java applets. Thus, no VPN client and no terminal client need to be installed. Users and Groups Create a separate permission group and a user for the access to SSL applications. These dialogs are located under "System Usage Policy Policies Groups" and "Policies Users". Specify the "Internet" and additionally the "LocalNet" (for tests) in order to enable client access from this network. The "Internet" must be specified in order to enable access by clients from the Internet. Networks of the newly created group "sslusergroup" and the user "ssluser": User Page Later on, the access to the resources will take place over the user page via HTTPS. To enable the access, designate a server certificate for the Web server and assign the permissions for the "Access to user page (HTTPS)". This dialog is located under "Services File Export Services Web Server" Collax GmbH Status: Final Version: 5.8 Date: October 28, 2014

2 The previously created group can be edited directly and the permission can be set in the "Permissions" section under "System Usage Policy Policies Group". SSL VPN Resources Four different variants are available as SSL VPN resources: Applets with special user interface Reverse proxy for Web forwards Tunneled Web forwards SSL tunnel for connections with the native application Applications For remote access to internal hosts, the respective applications can be set up in this dialog and be made available to the desired groups by way of the user page. The supported protocols include Remote Desktop, VNC, and Citrix ICA. This dialog is located under "Services Infrastructure SSL VPN Applications". Collax SSL VPN Howto 2/5

3 Application You can select the desired application from this list. Remote Desktop connections, VNC connections, and Citrix ICA Client connections are available for selection. Destination host The selected application connects to a destination host. Specify the IP address or host name of the destination host. Destination port If the service of the destination host is tied to a specific port, this destination port must be specified here. If the service of the destination host runs on the default port of the application, this field can be left blank. Enable SSO The setting takes over the user of the Web interface for authenticating the application. Domain If a domain login (Active Directory or NT domain) is to take place, the domain can be specified here. If the option "Enable SSO" is not set, the login and password for the connection can be specified manually. Alternatively, you can leave the login and password blank; in this case, the authentication query will take place after the establishment of the connection. For an optimum window display, various resolutions can be selected for the particular application. If the application is started in full-screen mode, this mode can be terminated by pressing Alt+Enter. Additional options can be configured in the "Native Options" tab. Finally, select the group whose users are to be granted authorized access to the application. Web Forwards and Reverse Proxy Web forwards enable encrypted access to Web-based applications. By way of the reverse proxy, the data addressed to the destination URL are rewritten by the Collax server. No Java applet is required here. These dialogs are located under "Services Infrastructure SSL VPN Web Forwards" and "Services Infrastructure SSL VPN Reverse Proxy". Collax SSL VPN Howto 3/5

4 By means of the permissions, they are made available to the desired groups by way of the user page. SSL Tunnel By defining an SSL tunnel, the Collax server can tunnel any service port from the local host to a destination host and destination port. Once the SSL tunnel has been established, the destination application can be addressed from the local host with "localhost:destination-port". This dialog is located under "Services Infrastructure SSL VPN SSL Tunnel". Local port Specify the desired local network port here. Specify a destination port in the range from 1 to To avoid possible conflicts with local services, we recommend selecting a port in the range from 1024 to Collax SSL VPN Howto 4/5

5 Destination host In this field, specify the IP address or host name of the desired destination host. Destination port In this field, specify the service port to be reached on the destination host. Specify a destination port in the range from 1 to The reachability of this service port and the authentication with this service depend on the settings on the destination host. By means of the permissions, it is made available to the desired groups by way of the user page. In this way, the access is tunneled to an internal SSH server on the local port Thus, a connection to the destination server is possible via an SSH client by specifying the server (localhost) and port Use via the Web Interface After entering in the browser window, a login dialog will open up for the user page. Following the successful login, the user can access his SSL VPN resources. Collax SSL VPN Howto 5/5