Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Administration Manual

Page: 412 / 861

411 Enabling remote access with clientless VPN
Managing clientless VPN users
administrators powerful and easy-to-use tools to control the authorization (access) and authentication
(identity) phases.
Authentication is the process of determining and verifying a user’s identity. The standard way of
performing authentication is to prompt users for their user names, passwords, and possibly other
information, and to verify that information against an authentication server (such as an LDAP or
RADIUS server). The security gateway uses both its internal authentication server, as well as
mechanisms to interface with a broad range of different types of external servers.
Many organizations have both authentication and group data. A group is a collection of users who
share the same attributes. By collecting the users in a group, policies are applied to many users
simultaneously and groups of users can be authenticated in a single step.
To manage all these servers, the security gateway associates authentication servers with group servers
in an authentication scheme. This allows you, for example, to use a server specializing in
authentication for the utmost security (such as the two-factor challenge response supported by some
RADIUS servers) while simultaneously using a sophisticated user database that is optimized for
complicated user data (such as Active Directory or LDAP).
The security gateway operates in environments that have dramatically different systems maintaining
the user databases. To provide a uniform method of controlling access privileges, clientless VPN uses
roles to apply access rules to multiple users and groups. Users and user groups are arranged in a
hierarchical role structure that ensures that any rule applying to a parent role also applies to a child
role below it in the structure.
To customize the user experience, clientless VPN uses portal pages to provide users with links and
shortcuts to network resources. You can configure several different portal pages to provide for the
differing needs of clientless VPN users. By assigning a portal page to a role, you assure that a user who
is a member of that role will be able to access resources through the portal page.
Clientless VPN users connect to the security gateway in one of three ways:
■
Web VPN
On a Web VPN connection, the client’s Web browser provides access to a Web portal page, which
provides access to resources on the internal network.
■
Port forwarder
For TCP/UDP applications, a Java applet is automatically downloaded to the client computer,
providing access to most common TCP/UDP applications.
■
Secure network connection
For access to the entire network, a more sophisticated applet and virtual adapter are automatically
downloaded to the client computer, providing IPsec VPN over an SSL encrypted link.
Managing clientless VPN users
Managing clientless VPN users involves defining remote users on an authentication server, setting up
connections by which they can access the internal network, and setting up roles and rules to permit
access internal resources.
To control user access, the clientless VPN administrator must perform the following tasks, in no
particular order:
Configure an SSL certificate on the System > Configuration > SSL
Server Certificate tab. See “Creating a new certificate” on
page 554.
Define the appropriate authentication server on the Assets >
Authentication Servers > Authentication Servers tab. See “Authenticating with an external
authentication server” on page 253.