Aventail SSL VPN. Installation and Administration Guide. Version 9.0.0

Transcription

1 Aventail SSL VPN Installation and Administration Guide Version SonicWALL, Inc. All rights reserved. SonicWALL is a registered trademark of SonicWALL, Inc. Other product names mentioned herein may be trademarks and/or registered trademarks of their respective companies. Last modified 1/21/08 15:42 Part number _Rev_A

2

3 SonicWALL / Aventail SSL VPN Installation and Administration Guide i Table of Contents Chapter 1 Introduction Features of Your SonicWALL / Aventail Appliance Aventail Appliance Models Administrator Components User Access Components What s New in This Release System Requirements Server Components Client Components About the Documentation Document Conventions Chapter 2 Installation and Initial Setup Network Architecture Preparing for the Installation Gathering Information Verifying Your Firewall Policies Helpful Management Tools Installation and Deployment Process Installation and Configuration Overview Moving the Appliance into Production Installing the Appliance Rack Installation Front Panel Controls and Indicators Connecting the Appliance Powering Up Powering Down and Rebooting the Appliance Performing Initial Network Setup Web-Based Configuration Using Setup Wizard Next Steps Chapter 3 Working with AMC Accessing AMC Logging In to AMC Logging Out AMC Basics A Quick Tour of the AMC Interface Adding, Editing, Copying, and Deleting Objects in AMC Getting Help Administrator Accounts Managing Administrator Accounts and Roles Avoiding Configuration File Conflicts with Multiple Administrators Managing Multiple SonicWALL Devices Working with Configuration Data Saving Configuration Changes to Disk Applying Configuration Changes Discarding Pending Configuration Changes Deleting Referenced Objects Chapter 4 Network and Authentication Configuration Configuring Basic Network Settings Specifying System Identity Configuring Network Interfaces Configuring Fallback Servers for Connect Tunnel

4 ii Table of Contents Configuring Routing Configuring Network Gateways Choosing a Network Gateway Option Configuring Network Gateways in a Dual-Homed Environment Configuring Network Gateways in a Single-Homed Environment Enabling a Route to the Internet Configuring Static Routes Configuring Name Resolution Configuring Domain Name Service Configuring Windows Network Name Resolution Certificates Server Certificates CA Certificates Certificate FAQ Managing User Authentication Configuring Authentication Servers Configuring LDAP and LDAPS Authentication Configuring Microsoft Active Directory Servers Configuring RADIUS Authentication Configuring a PKI Authentication Server Configuring a Single Sign-On Authentication Server CA etrust SiteMinder and RSA ClearTrust Authentication Configuring Local User Storage Testing LDAP and AD Authentication Configurations Configuring Chained Authentication Enabling Group Affinity Checking in a Realm Next Steps Chapter 5 Security Administration Creating and Managing Resources Resource Types Resources and Resource Groups Creating and Managing Resource Groups Web Application Profiles Creating Forms-Based Single Sign-On Profiles Access Control Rules Configuring Access Control Rules Resolving Deny Rule Incompatibilities Resolving Invalid Destination Resources Chapter 6 User Management Overview: Users, Groups, Communities, and Realms Using Realms and Communities Viewing Realms Default, Visible, and Hidden Realms Specifying the Default Realm Enabling and Disabling Realms Best Practices for Defining Realms Configuring Realms and Communities Creating Realms Adding Communities to a Realm Creating and Configuring Communities Network Tunnel Client Configuration Using the Default Community Changing the Order of Communities Listed in a Realm Configuring RADIUS Accounting in a Realm Editing, Copying and Deleting Communities Managing Users and Groups Viewing Users and Groups Managing Users and Groups Mapped to External Repositories

5 SonicWALL / Aventail SSL VPN Installation and Administration Guide iii Managing Local User Accounts Chapter 7 System Administration Optional Network Configuration Enabling SSH Access from Remote Hosts Enabling ICMP Configuring Time Settings System Logging and Monitoring Overview: System Logging and Monitoring Log Files Monitoring the Appliance SNMP Configuration Managing Configuration Data Exporting the Current Configuration to a Local Machine Saving the Current Configuration on the Appliance Importing Configuration Data Restoring or Exporting Configuration Data Stored on the Appliance Replicating Configuration Data Requirements for Replication Getting Started Defining a Collection of Appliances to Receive Configuration Data Beginning Replication Viewing Configuration Data Recipients Upgrading or Rolling Back the System Updating the System Rolling Back to a Previous Version SSL Encryption Configuring SSL Encryption Software Licenses Viewing License Details Managing Licenses Chapter 8 End Point Control Overview: End Point Control How the Appliance Uses Zones and Device Profiles for End Point Control End Point Control Scenarios Managing EPC with Zones and Device Profiles Enabling and Disabling End Point Control Zones and Device Profiles Creating Zones for Special Situations Removing Data Left On the Client Configuring Aventail Cache Control Advanced EPC: Aventail Secure Desktop Symantec On-Demand Protection Pre-Authentication Integrity Checks Chapter 9 The Aventail WorkPlace Portal A Quick Tour of Aventail WorkPlace Home Page Intranet Address Box Bookmarks Network Explorer Page Web Shortcut Access Configuring Aventail WorkPlace General Settings Working with WorkPlace Shortcuts Viewing Shortcuts Adding Web Shortcuts Adding Network Shortcuts Creating Network Shortcuts to Personal Folders

6 iv Table of Contents Editing Shortcuts Deleting Shortcuts Moving Shortcuts WorkPlace Sites Adding WorkPlace Sites WorkPlace and Small Form Factor Devices Customizing Aventail WorkPlace Login, Error, and Notification Pages Overview: Custom WorkPlace Templates How Template Files are Matched Customizing WorkPlace Templates Uploading Your WorkPlace Custom Templates Giving Users Access to Aventail WorkPlace End Point Control and the User Experience How Aventail Secure Desktop Works How Aventail Cache Control Works Chapter 10 User Access Components and Services User Access Agents Client and Agent Provisioning (Windows) Aventail WorkPlace The Aventail Tunnel Clients The Aventail Proxy Clients Aventail Web Access Aventail Client Installation Packages Downloading the Aventail Client Installation Packages Customizing the Configuration for the Aventail Connect Tunnel Client Customizing the Configuration for the Aventail Connect Mobile Client Running Aventail Connect as a Service Distributing Aventail Client Setup Packages The Aventail OnDemand Proxy Agent Overview: OnDemand How OnDemand Redirects Network Traffic Configuring OnDemand to Access Specific Applications Configuring Advanced OnDemand Options Client Configuration The Aventail Connect Proxy Client Managing the Aventail Access Services Overview: Access Services Stopping and Starting the Aventail Access Services Configuring the Network Tunnel Service Configuring IP Address Pools Configuring the Network Proxy Service Configuring the Web Proxy Service Terminal Server Access Providing Access to Terminal Server Resources Citrix Server Resources Defining an Access Control Rule and Resource for Terminal Server Access Managing Graphical Terminal Agents Graphical Terminal Shortcuts Chapter 11 Administering a High-Availability Cluster Overview: High-Availability Cluster Cluster Architecture The Load Balancing Service Stateful Failover Synchronized Cluster Administration Installing and Configuring a Cluster Step 1: Connect the Cluster Network Step 2: Run Setup Tool on All Nodes of the Cluster Step 3: Assign the Master Node

7 SonicWALL / Aventail SSL VPN Installation and Administration Guide v Step 4: Configure the Cluster s External Virtual IP Address Final Steps: Network Configuration and Licensing Managing the Cluster Viewing and Configuring Network Information for Each Node Powering up a Cluster Starting and Stopping Services Monitoring a Cluster Backing up a Cluster Performing Maintenance on a Cluster Upgrading a Cluster Upgrading a Single Appliance to a Cluster Configuration Troubleshooting a Cluster Cluster Scenarios Normal Flow of Traffic Node Failure Appendix A Appliance Command-Line Tools Configuring a New Appliance Using Setup Tool Tips for Working with Setup Tool Using Setup Tool Saving and Restoring Configuration Data Saving Configuration Data Restoring Configuration Data Upgrading or Rolling Back System Software Installing System Upgrades Reverting to a Previous Version Performing a Factory Reset Validating Hosts Appendix B Troubleshooting General Networking Issues Verify a Downloaded Upgrade File Troubleshooting Client Provisioning (Windows) AMC Issues Authentication Issues Clearing the Certificate Cache Using Personal Firewalls with Aventail Agents Aventail Services Issues Aventail Tunnel Issues Aventail OnDemand Proxy Issues General OnDemand Proxy Issues Specific OnDemand Issues Windows Client Troubleshooting Resetting Browser and Java Settings Uninstalling Aventail Components Logging Back In to WorkPlace Macintosh and Linux Tunnel Client Troubleshooting Macintosh System and Application Information Linux System and Application Information Troubleshooting Tools in AMC Ping Command Traceroute Command DNS Lookup Viewing the Current Routing Table Capturing Network Traffic Logging Tools for Network Tunnel Clients Snapshot Tool

8 vi Table of Contents Appendix C Best Practices for Securing the Appliance Network Configuration Appliance Configuration Appliance Sessions Administrator Accounts Access Policy Set Up Zones of Trust SSL Ciphers Client Access Appendix D Log File Output Formats File Locations System Message Log Auditing Access Policy Decisions Viewing Client Certificate Errors in the Log End Point Control Interrogation Network Proxy/Tunnel Audit Log Auditing Connection Status Messages Web Proxy Audit Log Management Console Audit Log WorkPlace Logs WorkPlace Shortcut Examples Appendix E Internationalization Support Support for Native Character Sets RADIUS Policy Server Character Sets Selected RADIUS Character Sets Other Supported RADIUS Character Sets Appendix F Configuring a High-Capacity Cluster Overview of Clustering Cluster Management Performing Initial Appliance Setup Configuring the Appliance Attaching the Appliance to the Switch Configuring the Load Balancer Index

9 SonicWALL / Aventail SSL VPN Installation and Administration Guide 1 Chapter 1 Introduction The SonicWALL / Aventail SSL VPN appliance provides secure access including clientless access to Web applications, access to client/server applications, and file sharing to employees, business partners, and customers. All traffic is encrypted using Secure Sockets Layer (SSL) to protect it from unauthorized users. The appliance makes applications available from a range of access methods including a standard Web browser, a Windows client, or a mobile device on a wide range of platforms including Windows, Macintosh, and Linux. You might use the appliance to: Create a remote access VPN that enables remote employees to securely access private company applications such as over the Internet. Create a business partner VPN that provides designated suppliers with access to an internal supply chain application over the Internet. The appliance s granular access control lets you define policy and control access down to the user and resource level. Managing policy and configuring the appliance is quick and easy with the Webbased management console. For an overview of planning your Aventail SSL VPN appliance configuration and deployment, see the Aventail SSL VPN Getting Started Guide.

10 2 Chapter 1 - Introduction Features of Your SonicWALL / Aventail Appliance This section highlights the key components provided with your appliance. Aventail Appliance Models Aventail offers the following SSL VPN appliance models, all of which are documented in this manual. Most of them can be clustered: a cluster of two appliances with internal load balancing is intended for high availability (it provides system redundancy in case one of the nodes fails), and clusters of up to eight can be used to increase capacity: Aventail EX-2500: Supports up to 2,000 concurrent users, and provides for clustering two identical appliances behind one virtual IP address with internal load balancing, or up to eight appliances using an external load balancer. Aventail EX-1600 and EX-1500: Supports up to 250 concurrent users and provides for clustering two identical appliances behind one virtual IP address with internal load balancing, or up to eight appliances using an external load balancer. Aventail EX-750: Supports up to 50 concurrent users. Administrator Components These are the key components for managing the Aventail appliance and services: Aventail Management Console (AMC) is a Web-based administrative tool used to manage the appliance. It provides centralized access for managing security policies, configuring the system (including networking and certificate configuration), and monitoring. AMC is accessible from a Web browser. The Aventail Web proxy service provides users with secure access to Web-based applications, Web servers, and network file servers from a Web browser. The Web proxy service is a secure HTTP reverse proxy that brokers and encrypts access to Web-based resources. It also manages TCP/IP connections from the OnDemand proxy agent, and for the Connect Mobile client. The Aventail network tunnel service is a network routing technology that provides secure network tunnel access to a wide range of applications, including those that use non-tcp protocols such as Voice Over IP (VoIP) and ICMP, reverse-connection protocols, and bidirectional protocols such as FTP. It works in conjunction with the Aventail Connect tunnel client and the Aventail OnDemand tunnel agent to provide authenticated and encrypted access. The network tunnel service can traverse firewalls, NAT devices, and other proxy servers that can interfere with traditional VPN devices. The Aventail network proxy service provides a secure proxy for accessing standard client/server applications. It works in conjunction with the Aventail Connect proxy to provide authenticated and encrypted access over the Internet. The network proxy service is based on the SOCKS v5 protocol. The network proxy service brokers and encrypts access to internal

11 SonicWALL / Aventail SSL VPN Installation and Administration Guide 3 applications and networks. Its proxy-based architecture and use of SSL enables the network proxy service to traverse firewalls, NAT devices, and other proxy servers that can interfere with traditional VPN devices. User Access Components The appliance includes several components that provide users with access to resources on your network. Aventail WorkPlace The Aventail WorkPlace portal provides users with quick access to resources on your network. It is accessible from any Web browser that supports SSL and has JavaScript enabled. WorkPlace provides a range of access methods for you to choose from: Basic Web (HTTP) resources are accessible using the Web translation engine, a reverse proxy that provides single sign-on and fine-grained access control. File system resources are accessible from the web-based Network Explorer that is integrated in WorkPlace. Client/server traffic (TCP/IP) is accessible using one of the network redirection clients, OnDemand proxy or OnDemand tunnel. These clients are automatically provisioned or activated when the user logs in to WorkPlace.

12 4 Chapter 1 - Introduction The access method you choose will be based on several factors, including the network protocols used by your applications, your security requirements, end-user convenience, and the target platforms. Here s what your company s WorkPlace portal might look like: Aventail OnDemand proxy agent The OnDemand proxy agent is a secure agent that provides access to resources protected by the Aventail Web proxy service. Aventail OnDemand can be downloaded from any Web server on demand to give users clientless VPN access ideal for partners or vendors that do not have standard VPN access to your network or for mobile employees that may need to access network resources from a non-work computer such as a public kiosk. Aventail Connect and Aventail OnDemand clients with Smart Tunneling Clients with Smart Tunneling provide network-level access to all resources, effectively making each user device a virtual node on your network. The Connect tunnel client provides full network and application access from a Web-deployed Windows client for computers running a Windows Vista, Windows XP, Windows 2000, Macintosh, or Linux operating system. The client can be provisioned either transparently using a link from the Aventail WorkPlace portal or through an executable installation package. The Connect tunnel client provides split-tunneling control, granular access controls, and automatic proxy detection and authentication. The OnDemand tunnel agent provides the same features as the Connect tunnel, except that it can t be used as a dial-up adapter for domain logins, and is integrated into Aventail WorkPlace. OnDemand can operate in either split-tunnel mode or redirect all traffic mode. Aventail Connect Mobile client Connect Mobile provides remote TCP/IP access to Windows Mobile-powered devices. The Connect Mobile client is installed by a stand-alone installer package, and is managed by the Aventail Web proxy service.

13 SonicWALL / Aventail SSL VPN Installation and Administration Guide 5 What s New in This Release Aventail Connect proxy client Connect proxy is a Windows application that provides access to resources protected by the Aventail network proxy service. Installed on the user s computer, Aventail Connect can provide additional security by requiring personal firewalls and antivirus applications. In most cases, users interact with Aventail Connect only when it prompts them to type authentication credentials or to select their local and remote networks. End Point Control (EPC) EPC components ensure that your network is not compromised when accessed from PCs in untrusted environments by enabling you to interrogate devices and determine whether they are running the programs that you require. Advanced EPC simplifies granular end point protection by allowing you to set up device profiles (for clients running on Microsoft Windows) using a comprehensive predefined checklist that includes security solutions from leading vendors like Symantec, McAfee, Computer Associates, Sophos, and Kaspersky. Advanced EPC is included with the EX-2500 appliance and licensed separately for the other appliances in the EX-series. All Aventail access methods support EPC except for the Aventail Connect proxy client. It does, however, support application detection. This enables you to define what applications must be running on users' computers before remote network access is granted. Data Protection You can use a data protection agent Aventail Cache Control to automatically remove session data from the computer. Advanced EPC offers additional session-related security with Aventail Secure Desktop. It is included with the EX-2500 appliance and licensed separately for the other appliances in the EX-series. The appliance also supports integration with third-party client integrity controls that automatically check for malware on the client system before allowing access. This version of the Aventail VPN software includes the following new and enhanced features: Backend connectivity testing: Capture network traffic using a utility that is based on tcpdump to see a packet-by-packet list of the data going in and out of the appliance. If you are new to troubleshooting, you can use this utility to generate traffic data that can be sent to Technical Support for troubleshooting. If you are familiar with reading trace files, you can analyze the traffic using a network protocol analyzer, such as Wireshark. See Capturing Network Traffic on page 359. RADIUS IP assignment for tunnel clients: You can now allocate IP addresses to the network tunnel clients using a RADIUS server, which is often used for applications that require a one-toone relationship between an assigned IP address and a user. See Address Pool Allocation Methods on page 299. Fallback options for Connect tunnel: You can set up one or more fallback servers for Connect tunnel users in case a primary appliance becomes unavailable due to a planned outage, for example, or a natural disaster. You configure the list of backup servers in AMC; users don t need to make any configuration changes on the client. See Configuring Fallback Servers for Connect Tunnel on page 51. Local network access for tunnel clients: When configuring the network tunnel clients, you can now give users access to resources on their local network, such as printers and file shares. See Redirection Modes on page 145. Licensing enhancements and integration with MySonicWALL: Beginning with v9.0.0, you must register on MySonicWALL.com for access to essential resources, such as your license file, firmware updates, and technical support information. The license is in a different format beginning with version 9.0.0, so existing customers must log in to mysonicwall.com to retrieve the license (in addition to the upgrade file), upload both of them to the appliance, upgrade the appliance, and then apply the license. See Managing Licenses on page 208. Global Management System integration: GMS is a single management interface for centrally managing and deploying SonicWALL appliances and security policy configurations. You can configure an Aventail EX-series appliance to be managed by SonicWALL GMS and get reports on user authentication-related events and status. See Managing Multiple SonicWALL Devices on page 43.

14 6 Chapter 1 - Introduction System Requirements Server Components This section describes the system requirements for the administrator and client components for the Aventail SSL VPN. Note Only 32-bit operating systems are supported. If you are using a client component with Internet Explorer on a computer running 64-bit, you'll see an error message to this effect; if you are using Firefox you will not see a message. The system requirements for the administrator components and authentication servers are listed in the following table. Platforms and browsers shown in the regular font are fully supported, while those shown in brackets in [italic] typeface are compatible with the appliance. (There are no known issues with compatible configurations, and we continue to offer technical support for them, but they have not been specifically tested in the current release and future product changes will not take them into account.) System Administration Operating system Notes Aventail Management Console (AMC) Windows Vista Windows XP Pro, SP2 Windows XP Home, SP2 Internet Explorer 7.0 Internet Explorer 6.0, SP2 Mozilla Firefox 2.0 [Mozilla Firefox 1.5] Linux Mozilla Firefox 2.0 [Mozilla Firefox 1.5] Authentication Servers Operating system/version Notes Active Directory Windows Server platform: Windows 2003 Server Windows 2000 Server General support, including password change LDAP servers LDAP version 3 compatible servers No LDAP password change support IBM Directory Server, versions 5 and 6 LDAP password change supported on ID5 RADIUS Version 5.2 Version 5.0 Single sign-on CA etrust SiteMinder, version 6.02 RSA ClearTrust, version 4.6

15 SonicWALL / Aventail SSL VPN Installation and Administration Guide 7 Citrix Server Farms Servers Citrix Presentation Server 4 Citrix MetaFrame XP Citrix MetaFrame version 1.8 Notes Citrix XML service must be running on the MetaFrame server MetaFrame 1.8 must have a license for Service Pack 2 and Feature Release 1 (SP2/FR1) EOL has been announced for MetaFrame XP and 1.8 Client Components The system requirements for the client components are listed in the following tables. Platforms and browsers shown in the regular font are fully supported, while those shown in brackets in [italic] typeface are compatible with the appliance. (There are no known issues with compatible configurations, and we continue to offer technical support for them, but they have not been specifically tested in the current release and future product changes will not take them into account.) Web-Based Clients Operating system Browser Notes Aventail WorkPlace Portal, Translated Web access Windows Vista Windows XP Pro, SP2 Windows 2000 Pro, SP4 Windows XP Home, SP2 Macintosh OS X v 10.4 [Macintosh OS X v 10.3] Internet Explorer 7.0 Internet Explorer 6.0, SP2 Mozilla Firefox 2.0 [Mozilla Firefox 1.5] Safari 2.0 [Safari 1.3] ActiveX, or JRE or later Linux Mozilla Firefox 2.0 [Mozilla Firefox 1.5] Web-enabled mobile devices The browser appropriate for your device

16 8 Chapter 1 - Introduction Tunnel Clients Operating system Browser Notes Connect Tunnel Client Windows Vista Windows XP Pro, SP2 Windows 2000 Pro, SP4 Windows XP Home, SP2 Windows Server platform: Windows 2003 Server Windows 2000 Server, SP4 Macintosh OS X v 10.5 Macintosh OS X v 10.4 n/a Windows administrator rights required for installation n/a Administrator rights required for installation No support for End Point Control Macintosh OS X v 10.5 has been tested only on Intel computers Linux kernel or later Mozilla Firefox 2.0 [Mozilla Firefox 1.5] Administrator rights required for installation Browser required only for proxy detection No support for End Point Control Connect Tunnel Service Windows XP Pro, SP2 Windows Server platform: Windows 2003 Server Windows 2000 Server, SP4 n/a No support for End Point Control OnDemand Tunnel Agent Windows Vista Windows XP Pro, SP2 Windows 2000 Pro, SP4 Windows XP Home, SP2 Internet Explorer 7.0 Internet Explorer 6.0, SP2 Mozilla Firefox 2.0 [Mozilla Firefox 1.5] ActiveX, or JRE or later Windows administrator rights required for installation [JRE 1.4.2] Macintosh OS X v 10.4 Safari 2.0 JRE JRE Administrator rights required for installation [JRE 1.4.2] Linux kernel or later Mozilla Firefox 2.0 [Mozilla Firefox 1.5] JRE JRE Administrator rights required for installation [JRE 1.4.2]

17 SonicWALL / Aventail SSL VPN Installation and Administration Guide 9 Proxy Clients Operating system Browser Notes OnDemand Proxy Agent Windows Vista Windows XP Pro, SP2 Windows 2000 Pro, SP4 Windows XP Home, SP2 Macintosh OS X v 10.4 [Macintosh OS X v 10.3] Internet Explorer 7.0 Internet Explorer 6.0, SP2 Mozilla Firefox 2.0 [Mozilla Firefox 1.5] Safari 2.0 [Safari 1.3] ActiveX, or JRE and later Port-mapped mode requires ActiveX or Java; for users who can t run ActiveX, JRE is used. Administrator rights required for dynamic redirection mode [JRE 1.4.2] JRE JRE [JRE 1.4.2] Linux kernel or later Mozilla Firefox 2.0 [Mozilla Firefox 1.5] JRE JRE Web Proxy Agent Windows Vista Windows XP Pro, SP2 Windows 2000 Pro, SP4 Windows XP Home, SP2 Connect Mobile Client Internet Explorer 7.0 Internet Explorer 6.0, SP2 ActiveX, or JRE and later [JRE 1.4.2] Windows Mobile 6 Windows Mobile 5 [Windows Mobile 2003 Second Edition for Pocket PC Phone Edition (Windows CE 4.21)] [Windows Mobile 2003 for Pocket PC Phone Edition (Windows CE 4.20)] n/a Includes Mobile2Market certification Supports Pocket PC devices and smartphones Does not support some legacy devices, such as Audiovox SMT5600, Motorola MPx200 & MPx220, Sierra Wireless Voq, Samsung i600, imate SP2, etc. n/a [Does not include support for smartphones] Connect Proxy Client Windows XP Pro, SP2 Windows 2000 Pro, SP4 Windows XP Home, SP2 n/a Windows administrator rights required for installation No support for Windows Vista

18 10 Chapter 1 - Introduction End Point Control Operating system Browser Notes Interrogator and Installer Windows Vista Windows XP Pro, SP2 Windows 2000 Pro, SP4 Windows Mobile Windows XP Home, SP2 Macintosh OS X v 10.4 [Macintosh OS X v 10.3] Internet Explorer 7.0 Internet Explorer 6.0, SP2 Pocket Internet Explorer 4.0 Mozilla Firefox 2.0 [Mozilla Firefox 1.5] Safari 2.0 [Safari 1.3] ActiveX, or JRE and later [JRE 1.4.2] JRE JRE [JRE 1.4.2] Linux Mozilla Firefox 2.0 [Mozilla Firefox 1.5] JRE JRE Aventail Cache Control Windows Vista Windows XP Pro, SP2 Windows 2000 Pro, SP4 Windows XP Home, SP2 Macintosh OS X v [Macintosh OS X v 10.3] Internet Explorer 7.0 Internet Explorer 6.0, SP2 Mozilla Firefox 2.0 Mozilla Firefox 1.5 Safari 2.0 [Safari 1.3] JRE JRE [JRE 1.4.2] JRE JRE [JRE 1.4.2] Linux Mozilla 1.2 and later JRE JRE Advanced EPC Windows Vista Windows XP Pro, SP2 Windows 2000 Pro, SP4 Windows XP Home, SP2 Internet Explorer 7.0 Internet Explorer 6.0, SP2 Mozilla Firefox 2.0 [Mozilla Firefox 1.5] JRE JRE [JRE 1.4.2] Aventail Secure Desktop (included in Advanced EPC) Windows Vista Windows XP Pro, SP2 Windows 2000 Pro, SP4 Windows XP Home, SP2 Internet Explorer 7.0 Internet Explorer 6.0, SP2 Mozilla Firefox 2.0 Mozilla Firefox 1.5 JRE JRE [JRE 1.4.2] Integration with Third-Party Components The Aventail appliance integrates with several popular security programs. In some cases (such as Symantec On-Demand Protection), the files necessary for integration are already on the appliance, and in other cases (such as Zone Labs Integrity Clientless Security), the files must be copied to the appliance. Description Notes Windows Terminal Services agent Windows (ActiveX control) Version 5.2 Cross-platform (Java applet) Version 8.6 Citrix agent

19 SonicWALL / Aventail SSL VPN Installation and Administration Guide 11 Description Windows 2000 and Windows XP (ActiveX control) Notes Version v8.x and later Windows Vista (ActiveX control) Version v10 and later Cross-platform (Java applet) Version v8.x and later Requires JRE or later Symantec On-Demand Protection See Symantec On-Demand Protection on page 238. For information on what operating systems are supported, refer to the vendor s Web site: Version 3.1 MP2 Requires JRE or Windows Macintosh Confidence Online for Web Applications The Aventail appliance supports version 5.0 of this product; manual installation and additional configuration are required. See WholeSecurity Confidence Online for Web Applications on page 240. For information on what operating systems are supported, refer to the vendor s Web site: Version 4.3 Version 5.0 Windows Macintosh Linux Zone Labs Integrity Clientless Security (Includes the Integrity Desktop, Agent, and Flex clients). See Zone Labs Integrity Clientless Security on page 241 [Version 2.2] Requires JRE and later About the Documentation Document Conventions This document contains detailed information about installing, configuring, and maintaining the appliance. Its contents are also available as context-sensitive Help from AMC; see Getting Help on page 39 for more information. Your Aventail appliance also comes with a printed Getting Started Guide that explains important VPN concepts and components and will aid in planning to deploy your VPN. For access to electronic copies of all of the product documentation, log in to your mysonicwall.com account and register your appliance. See Registering Your SonicWALL Aventail SSL VPN Appliance on page 209 for more information. Throughout this document, external refers to the network interface connected to the Internet. Internal refers to the network interface connected to your internal corporate network. This document uses the following typographical conventions: Typographical convention Bold Monospace font Italic Usage User interface components (such as text boxes or buttons on a Web page). Information you are supposed to type. File names and directories, examples, and selections from drop-down lists.

20 12 Chapter 1 - Introduction Typographical convention commandname -x [-y] Initial Caps Usage In command-line syntax, square brackets indicate optional parameters. Key names such as Enter or Backspace, and key combinations such as Ctrl+Q.