PULSE. Pulse for Windows Phone Quick Start Guide. Release Published Date

Transcription

1 PULSE Pulse for Windows Phone Quick Start Guide Release Published Date 1.0 July 2015

2 Contents PART 1 Pulse for Windows Phone 4 CHAPTER 1 5 Introducing Pulse for Windows Phone 5 Pulse for Windows Phone Overview 5 Pulse for Windows Phone Supported Platforms 5 Pulse for Windows Phone Supported Features 5 Pulse for Windows Phone Limitations 6 Configuring Pulse Secure Access Service for Pulse for Windows Phone VPN Connections 7 Configuring a Pulse Connection for Windows Phone Manual Configuration 9 PART 2 Index 12 2

3 Pulse Secure, LLC 2700 Zanker Road, Suite 200 San Jose, CA Pulse Secure, Pulse, Steel-Belted Radius, NetScreen, and ScreenOS are registered trademarks of Pulse Secure, LLC. in the United States and other countries. The Pulse Secure Logo, and the Pulse logo are trademarks of Pulse Secure, LLC. All other trademarks, service marks, registered trademarks, or registered service marks are the property of their respective owners. Pulse Secure assumes no responsibility for any inaccuracies in this document. Pulse Secure reserves the right to change, modify, transfer, or otherwise revise this publication without notice. Pulse for Windows Phone Quick Start Revision History Release Release 1.0R1 The information in this document is current as of the date on the title page. YEAR 2000 NOTICE Pulse Secure hardware and software products are Year 2000 compliant. OS has no known time-related limitations through the year However, the NTP application is known to have some difficulty in the year END USER LICENSE AGREEMENT The Pulse Secure product that is the subject of this technical documentation consists of (or is intended for use with) Pulse Secure software. Use of such software is subject to the terms and conditions of the End User License Agreement ( EULA ) posted at By downloading, installing or using such software, you agree to the terms and conditions of that EULA. 3

4 PART 1 Pulse for Windows Phone Introducing Pulse for Windows Phone on page 5 4

5 CHAPTER 1 Introducing Pulse for Windows Phone Pulse for Windows Phone on page 4 Configuring Pulse Secure Access Service for Pulse for Windows Phone VPN Connections on page 7 Configuring a Pulse Connection for Windows Phone Manual Configuration on page 9 Pulse for Windows Phone Overview Pulse for Windows Phone provides secure connectivity between a Windows Phone and Pulse Secure Access Service. Pulse for Windows Phone is available from the Windows Phone Store. (The Pulse app is visible only when searching from a Windows Phone that is running Windows Phone 8.1.) After installing the Pulse VPN app on a Windows Phone (Windows Phone 8.1 or later), the user can configure a connection and establish Layer 3 VPN (SSL) communications. Configuration on the Pulse server to support Pulse for Windows Phone is the same as for the Pulse for Windows client. You use sign-in policies, authentication realms, roles, and VPN tunnel policies to define authentication and access permissions. A typical Pulse server configuration for Windows Phone access is to create a realm, a role, and a remediation role that are designed for Windows Phone users. Pulse for Windows Phone Supported Platforms Pulse for Windows Phone Overview on page 5 Configuring a Pulse Connection for Windows Phone Manual Configuration on page 9 Configuring Pulse Secure Access Service for Pulse for Windows Phone VPN Connections on page 7 Pulse for Windows Phone Supported Features The following list describes the supported features for the Pulse for Windows Phone client. 5

6 Pulse for Windows Phone supports VPN (SSL) connections to Pulse Secure Access Service R8.0 and later. Only one connection at a time can be active. The user can manually connect and disconnect. Username and password. Username and RSA token code. (User PIN and system PIN are supported.) Configuring a Pulse Connection for Windows Phone Manual Configuration Authentication server prompts for retry, change password, create PIN, change PIN, and specify next token code. Realm and role selection and preferred realm and role. (The user cannot choose to save a connection preference.) Sign-in notification messages. Secondary authentication. HTTPS proxy. IPv4 and IPv6. Pulse for Windows Phone supports the following tunneling functions: Split tunneling enabled or disabled. Note: Pulse for Windows Phone connections always have local subnetaccess enabled. SSL-VPN connections. Split tunneling policies: IPv4 inclusion and exclusion routes, and IPv6 inclusion routes. In split-tunneled mode, the DNS search order options do not apply. Pulse forwards only those DNS requests contained by the configured DNS suffixes to the specified DNS servers. You can specify the VPN option Search device DNS only to forward all DNS requests to configured DNS servers. Pulse for Windows Phone Limitations Pulse for Windows Phone supports connections to Pulse Secure Access Service only. The following Pulse features are not available with Pulse for Windows Phone: Host Checker 6

7 Note: If a Pulse for Windows Phone user attempts to connect to a realm or role that has any Host Checker OS check rule enabled, the Windows Phone will fail the host check. Save realm or role preference Machine authentication Location awareness rules Logon and logoff scripts WINS server tunnel parameter UDP-ESP tunnel (SSL mode only) Certificate trust override prompt RSA soft-token integration Session extension Suspend/resume tunnel Related Documentation Configuring a Pulse Connection for Windows Phone Manual Configuration on page 9 Configuring Pulse Secure Access Service for Pulse for Windows Phone VPN Connections on page 7 Configuring Pulse Secure Access Service for Pulse for Windows Phone VPN Connections Pulse enables you to secure your company resources using authentication realms, user roles, and resource policies. For complete information on the Pulse access management framework, see the Pulse server documentation. A Pulse server checks the authentication policy defined for the authentication realm. The user must meet the security requirements you define for a realm s authentication policy, or else the Pulse server does not forward the user s credentials to the authentication server. At the realm level, you can specify security requirements based on various elements such as the user s source IP address or the possession of a client-side certificate. If the user meets the requirements specified by the realm s authentication policy, the Pulse server forwards the user s credentials to the appropriate authentication server. If this server successfully authenticates the user, then the Pulse server evaluates the role mapping rules defined for the realm to determine which roles to assign to the user. 7

8 Note: If a Pulse for Windows Phone user attempts to connect to a realm or role that has any Host Checker OS check rule enabled, the Windows Phone will fail the host check. The following is a generalized example of configuring a Pulse server for the Pulse for Windows Phone app. 1. Click Users > User Roles, and then create a new role. You can use an existing role. However, because Host Checker supports different options for each type of device operating system, a typical approach is to create different roles for different devices. 2. Specify a name and optional description for the role, for example, WinPhoneRole, Windows Phone VPN role. 3. To use certificate authentication at the role level, click Restrictions > Certificate on the role s General tab, and add the required certificate information. 4. Enable certificate authentication by clicking Only allow users with a client-side certificate signed by Certification Authority to sign in. One typical method of installing the client certificate on the Windows Phone is to send the certificate as an attachment to the Windows Phone user. The certificate must be installed on the Windows Phone before the user can connect. The user is prompted to select the certificate during the initial Pulse VPN connection process. 5. Define the client certificate, click Add, and then click Save Changes. For complete information on certificate authentication, see Understanding Digital Certificate Security. 6. Set the options on the role s Web and Files tabs as needed. 7. Click Users > User Realms, and then create a new realm or select an existing realm. Configure and save your options on the General and the Authentication Policy tabs. 8. On the Role Mapping tab, click New Rule to create a new role mapping rule. One option for a role mapping rule is to create a custom expression that uses the user agent string to identify a Windows Phone. The Pulse for Windows Phone user agent string is-pulse/ (Windows Phone; ARM) PulseVpn/ You can use all or part of the string in a custom expression that uses the useragent variable. For example, useragent = *Windows Phone*. 9. Select the role that you created earlier for the Windows Phone users, add it to the Selected Roles list, and then click Save Changes Related Documentation Pulse for Windows Phone Overview on page 5 Configuring a Pulse Connection for Windows Phone Manual Configuration on page 9 8

9 Configuring a Pulse Connection for Windows Phone Manual Configuration Pulse for Windows Phone is available from the Windows Phone Store. (The Pulse app is visible only when searching from a Windows Phone that is running Windows Phone 8.1.) After the user installs the app, the user can create Pulse VPN connections. Figure 1 on page 7 shows Pulse VPN after it has been installed on a Windows Phone. Figure 1: Windows Phone Apps List Note: To configure a VPN connection, or to initiate a manual VPN connection, use Settings on the phone. Tapping Pulse in the apps list simply opens an information screen. You create, manage, and delete Pulse connections by using Windows Phone Settings. Pulse connections appear as VPN connections in the Networks list. Note: If you use client certificate authentication, the client certificate must be installed on the Windows Phone before Pulse can connect. One typical way of installing a certificate is to it to the user. The user simply taps the certificate in the and Windows Phone installs it. 9

10 To create a Pulse VPN connection on a Windows Phone: Tap Settings, and then tap VPN. 2. If the status slider is set to On, the phone displays a list of existing VPN connections. Figure 2 on page 10 shows the Windows dialog where you configure the connection. Figure 2: Manually Adding a Pulse Connection 2. To create a new connection, tap the plus icon at the bottom of the screen. The Add Profile screen appears. 3. In the Server name or IP address box, specify the target for this connection. You can identify the server using the server IP address, the hostname, or a URL that optionally specifies the port the connection uses and the specific sign-in page. To specify a URL, use the following format: page] The brackets indicate options. Also, if you specify a specific sign-in page, be sure that the name you specify matches what is defined on the Pulse server. (Authentication > Signing in > Sign-in pages.) 4. Tap the Type box to expand it, and then tap Pulse VPN to select it. 5. Specify a username and password. If you specify a username and password, the prompt for this information does not appear when you activate the connection. For token code authentication, specify a username and leave the password field blank. 6. Enable or disable Connect automatically as needed. 10

11 7. The IP ranges option is available if you have enabled the Connect automatically slider. The IP ranges option lets you identify specific IP addresses that can trigger this Pulse VPN connection. When you attempt a connection to an IP address in the specified range, and that address is not reachable, the Pulse VPN connection is activated. 8. The Profile name defaults to the value you entered for Server name or IP address box. The Profile name appears in the VPN list; you can change it to something more meaningful. 9. Tap Advanced to set the following: Proxy If you enable the Proxy setting, the app opens a screen where you can specify the settings for connecting to the Pulse server through a proxy server. Don t use VPN on company WiFi When you are in the company office, network traffic uses the company WiFi network without first establishing a VPN connection. DNS suffix If you have automatic connections enabled, a request to access information within the specified domain name suffix causes Windows to initiate a VPN connection before connecting to the target. Don t use VPN for home WiFi traffic Network traffic uses the home WiFi network without first establishing a VPN connection. After the user saves the new connection, it appears in the VPN list. The user can tap the connection to initiate a VPN connection. When a VPN connection is active, a small lock icon appears next to the WiFi status icon. Related Documentation Pulse for Windows Phone Overview on page 5 Host Checker for Pulse for Windows Phone Configuring Pulse Secure Access Service for Pulse for Windows Phone VPN Connections on page 7 11

12 PART 2 Index Index on page 13 12

13 Index C certificate auth 8 Client certificate, smart card, and virtual smart card. 6 create Pulse connection 6 creating on Windows Phone 10 D DNS Windows Phone 6 L location awareness 7 M Machine authentication 7 R RSA soft-token integration 7 RSA token code 6 S Sign-in notification messages 6 Sign-in notification messages. 6 soft-token 7 Supported Features 5 Supported Platforms 5 T token code 10 U upgrade Windows in-box Pulse client 5 user agent string 8 V virtual smart card 6 W Windows Phone 6 Windows Phone Store 5 Windows Update 5 13