FirePass SSLVPN Client Software Deployment Guide For Windows Mobile 5 and 6 Devices MAN

Transcription

1 FirePass SSLVPN Client Software Deployment Guide For Windows Mobile 5 and 6 Devices MAN

2 Product Version This manual applies to the F5 SSLV client software provided as part of the FirePass 6.0.2, 6.0.3, and releases created by F5 Networks, Inc. Publication Date This manual was last updated on June 22, Legal Notices Copyright Copyright 2007, 2010, F5 Networks, Inc. All rights reserved. F5 Networks, Inc. (F5) believes the information it furnishes to be accurate and reliable. However, F5 assumes no responsibility for the use of this information, nor any infringement of patents or other rights of third parties which may result from its use. No license is granted by implication or otherwise under any patent, copyright, or other intellectual property right of F5 except as specifically described by applicable user licenses. F5 reserves the right to change specifications at any time without notice. Trademarks F5, F5 Networks, the F5 logo, BIG-IP, 3-DNS, icontrol, Internet Control Architecture, IP Application Switch, irules, OneConnect, Packet Velocity, SYN Check, Control Your World, ZoneRunner, uroam, FirePass, TrafficShield, Swan, WANJet, WebAccelerator, and TMOS are registered trademarks or trademarks, and Ask F5 is a service mark, of F5 Networks, Inc. in the U.S. and certain other countries. All other trademarks mentioned in this document are the property of their respective owners. F5 Networks' trademarks may not be used in connection with any product or service except as permitted in writing by F5. Export Regulation Notice This product may include cryptographic software. Under the Export Administration Act, the United States government may consider it a criminal offense to export this product from the United States. 2

3 Introduction This document describes the installation, removal and diagnosis of the FirePass SSL VPN client software on devices or mobile devices using Windows Mobile 5 or Windows Mobile 6. In this document device or mobile device will be used to refer to either a devices or Smartphone devices. Pre installation Requirements The mobile device must have the appropriate Security Policy Settings for Windows Mobile- Based Devices, allowing installation of software packages signed by a non Mobile-to-Market certificate. See the known limitations section for more details. If the FirePass SSL VPN client software was previously installed on the device, a new installation may be done to upgrade the existing software. In this case, the FirePass SSL VPN client software agent must first be stopped. If installation is attempted when the Agent is still running, the user will see the following: An attempt to install the software when the Agent is running 3

4 Stopping the Agent: 1. Press the Start button. 2. Locate the F5 Icon. 3. On the lower right, select the Menu tab and then select Exit. Pressing the Start button and selecting the F5 Icon. Selecting Exit through the menu tab 4

5 Installation Installation involves three basic steps: Software installation Configuration Confirming the installation Software installation Installation requires a device that is not locked. See the Known Issues section for information on unlocking the device. Installation is done with a standalone application. This application package is distributed as a.cab file, and can be downloaded from the FirePass, using an internet browser on the mobile device. Software installation steps These steps may be used to 1. First, from the device, open a browser and navigate to the login page of the FirePass, and login. 2. Navigate to a Network Access webifyer, where the use should see a Download F5 SSL VPN Agent link. 3. Next, click on link and select Open in the appearing dialog box. This will start the installation process. If the SSL VPN client software was installed before, an un-install messages will appear. Alternative Software download In a large deployment, it may be more efficient to centrally deploy the SSLVPN client software to the devices. An administrator may download the SSLVPN client software from the FirePass and deploy it to each device. The SSLVPN client software can be obtained from the Admin GUI on the FirePass by navigating to: DeviceManagement :: ClientDownloads :: Windows CE (Pocket PC). NOTE: The link Click here to download VPN Client for Windows Mobile 5.0 device is also applicable to Windows Mobile 6. 5

6 If the SSLVPN client software was installed before, an un-install message will appear. If the SSLVPN Client software was previously installed, Un-installation will be performed and when complete, a popup is displayed. The user should then press Ok. Additionally, if un-installation is performed, a soft reset will be required. The user then should press Yes to perform a soft reset. 6

7 From this point, installation begins and the user will see the FirePass setup screen. Specify the URL for the FirePass, and type in a user name and password. The user should choose the option to save password for future logins.. URL, Username and Password settings A soft reset should be done after settings are applied. At this point, installation of the SSLVPN Client software is complete. 7

8 Configuration At this point in the installation is complete, and a configuration process of the Work connection is necessary setup to use the SSLVPN tunnel. Only connections made to DNS names that have no dots (.) in the name will be targeted to the Work connection, and sent over the SSL_VPN adapter. Therefore, some additional configuration must be done to insure that the connections to servers behind the FirePass are tunneled to the FirePass. This is done with the Exceptions settings for the Work connection. Additional configuration is required to insure that access to servers behind the FirePass succeed for access requests using IP addresses and DNS names with dots, for example, , and server.company.com. The user of the mobile device should now setup URL exceptions in the Connection Manager Configuration. When properly configured, all requests targeted to the Work connection will be directed to the FirePass server. In this example, everything inside f5net.com domain, or all IP addresses starting with 10.4 are directed to the FirePass controller. 1. Select Settings 2. Navigate to Connections 3. Select the SSLVPN connection 4. Click on the Advanced Tab 5. Click on the Exceptions Button 6. Add URL patterns for devices behind the FirePass In the example that follows all IP addresses starting with 10.4 are directed to the FirePass controller. 8

9 Navigating to Settings Navigating to Connections Tab 9

10 (step 1) (step 2) On the Smartphone, select Advanced, followed by Work URL Exceptions On the Pocket PC and select Exceptions 10

11 Press second Soft Key again and select Add on the. Click on Add new URL on the. You can specify pattern which will direct to your VPN locations. For details, consult the Windows Mobile documentation, under the Connect to intranet URL section. Press the first soft key to complete. Installation and Setup are now complete, and you are ready to connect to servers behind the FirePass server. 11

12 In this example, all IP addresses starting with 10.4 are directed to the FirePass controller. 12

13 Confirming the Installation After installation and configuration is complete, verify that installation was successful by testing an application that uses the connection. On demand, the connection manager should set up the connection to the FirePass controller. To establish connection, you should first test a location on the Internet. Here s an example using Pocket IE. Pay attention to the upper right corner. The Icon is no SSL VPN connection. means that the agent is running, but there 13

14 In the address bar, enter a server located behind the FirePass server, in our example. When you see the FirePass Login screen, enter user name and password and press first soft key. 14

15 If you have no valid SSL Certificate installed on your FirePass server, you will see a Security Warning. Select Yes to continue. The requested page should display. In this case, the requested page displays the date. In addition to the page being displayed, the Tray icon will change to Connected. connection has been established., since 15

16 Debugging the Installation If the connection thru the FirePass controller fails, there are a number of things that should be checked. The Standalone client has been started automatically after a soft reset. Dial-up entry connecting to the Work network with the name SSL_VPN_Connection adapter exists Under the Work Connection, only the SSL VPN_Connection is defined. Verifying that SSL VPN client is running If SSL VPN client is running, you should see a Tray icon at the top of screen. Note: On a, this icon is not visible on the Home screen, but it is visible when other application is active, Pocket IE, for example, Verifying the SSL VPN Connection Navigate to Settings/Connections and select Dial-up on, and Manage Existing Connections in My Work Network on a. 16

17 You should see the SSL_VPN_Connection Number should contain URL for the FirePass controller. 17

18 Tap and hold on SSL_VPN_Connection on the, and select Connect. You will see a Login screen PocketPC To check connection on a, follow the steps under the section Establish Connection. If establishing a connection still does not work, be prepared to collect log files that are automatically collected by the SSLVPN client software. The files: comdriverlog.txt f5sslvpnlog.txt are found in the temp directory on the device. 18

19 Known Limitations Active Sync The Agent will NOT work if your device is connected to a PC and network connectivity is provided via ActiveSync. If Active Sync status displays Connected, it is not possible to establish an SSLVPN connection Connection Manager / 3 rd party applications The SSLVPN client software was written to work with the Connection Manager component supplied as part of Windows Mobile 5 and Windows Mobile 6. The Connection Manager performs these basic functions: Abstracts network resources to applications Exposes access to all network resources for applications without applications having to refer to any of the resources explicitly Performs network resource arbitration based on their priority and resources security properties. Bundled applications that ship with Windows 5 and 6 use the connection manager and will establish an SSLVPN connection as expected. However, 3 rd party applications that 19

20 are not explicitly written to use the Connection Manager will not establish an SSLVPN connection. These applications are not currently supported. Applications can be modified to use the services of Connection Manager and operate properly with the SSLVPN client software to establish an SSLVPN connection on demand. More information on connection manager can be found here: Locked Devices / Authentication Levels The FirePass SSLVPN client software requires privileged level to install and operate. Locked devices disallow the SSLVPN client software from running in privileged mode, and therefore a device in locked mode is not supported. Devices that are supplied by a provider may supply using one of two authentications levels. These are either One-tier or Two Tier. One Tier A one tier authentication level allows the device to run applications either as privileged mode or it completely blocks execution. The SSLVPN client software should run with in privileged mode (after the user select yes to a popup asking for authorization). Two Tier In the two tier authentication level, applications can run as privileged or allowed. When the device is supplied with a Two Tier authentication level, a certificate from the provider is placed in the privileged store on the device. Unless you are the provider with access to the private key of the certificate, the device is said to be locked. In locked mode, the device will only allow execution of privileged applications that are signed by the provider. Since the SSLVPN client software should be run as a privileged application, it will not normally run on a locked device. The device either has to be unlocked or the client software has to be signed by that provider. Mobile2market 20

21 Mobile2market is Microsoft s certification and distribution program for Windows Mobile Applications. Devices may be supplied a provider that use two-tier authentication and have installed a set of mobile2market certificates. Applications signed with mobile2market certificates then can be installed and operate in privileged mode. In this particular case, the device is essentially locked. The F5 SSLVPN client software is not signed by a mobile2market certificate at this time. NOTE: Privileged mode is specifically required for installation and the repair operation of the SSLVPN connection URLs that have dashes in the name The FirePass SSLVPN client software configuration fails when configured with a URL that contains a - (dash) in the URL. This issue is being tracked with CR The FirePass Client Software may not start automatically The FirePass client cab and the executables contained within it have not currently been signed. Depending upon the security settings on the device, the execution of the SSLVPN client software Agent may cause a popup to be displayed. This popup will prevent the Agent from running automatically. This issue is being tracked by CR The Remote Desktop Client in Windows Mobile 6 is not honoring the connection exception declaration The exception declaration is being ignored. When a connection attempt is made, the client attempts to use another connection besides the SSLVPN connection. This is being tracked by CR

22 Removing SSLVPN components from the device Follow these steps to remove the SSLVPN client software from the device: 1. Stop the Agent on the device. 2. Remove the software in the standard way by navigating to the Start/ Settings/ Remove Programs menu. From there, select and remove the F5 SSLVPN Agent. All F5 Software has not been removed from the device. Removing the SSLVPN client software Press the Home button and select the Icon 22

23 Select Menu and choose Exit. At this point, the software can be removed by navigating to Start/ Settings/ Remove Programs. External Reference Links Windows Mobile 5.0 Application Security: Managing Connections on Windows Mobile 5.0 Pocket PC: Privileged and Normal APIs: Restricted mode security: Mobile2Market: Code Signing for Windows Mobile Applications: ps/default.aspx Connection Manager Documentation: 23

24 24