Watchguard SSL 1000, User Manual

Page: 38 / 198

Using the Firebox SSL VPN Gateway
28 Firebox SSL VPN Gateway
work, no attempt is made by either the client or the server applications to regenerate them, so real-time
(UDP like) performance is achieved over a secure TCP-based tunnel.
For more information about improving latency with UDP connections and Voice over IP, see “Improving
Voice over IP Connections” on page 59.
Using Kiosk Mode
The Firebox SSL VPN Gateway provides secure access to a corporate network from a public computer
using kiosk mode. When users select
A public computer on the Firebox SSL Access Portal page, the
Web browser opens. The user logs on and then can access applications provided in the browser win-
dow.
• For computers running Windows 2000 and above, kiosk mode is available through the Access
Portal. The link can be removed from the Access Portal on a group basis.
• For computers running JVM 1.5 or higher (such as Macintosh,
Windows 95, or Windows 98 computers), kiosk mode is available through a Java applet. For
Macintosh, Safari is the supported browser.
When the user is logged on using kiosk mode, the Firebox SSL VPN Gateway sends images only (no
data) over the connection. As a result, there is no risk of leaving temporary files or cookies on the public
computer. Both temporary files and cookies are maintained on the Firebox SSL VPN Gateway for the ses-
sion.
The browser defaults to a Web address that is configured per group through the Firebox SSL VPN Gate-
way Administration Tool. The Web browser window can also include icons for Remote Desktop, SSH, Tel-
net 3270 emulator, Gaim instant messenging, and VNC clients. The icons are displayed in the bottom-
left corner of the window. The applications are specified for each group. For more information about
configuring applications for kiosk mode, see “Configuring kiosk mode” on page 103.
The Web browser window also provides access to shared network drives. The Firebox SSL VPN Gateway
administrator configures the permissions granted (read-only or read/write) to each shared network
drive. For more information about configuring network shares, see “Configuring file share resources” on
page 102.
Users can copy files from the network share to their computer simply by dragging the file onto the
KioskFTP icon and selecting the destination in the File Download dialog box.
Note
End point policies are not supported or enforced when users are logged on using kiosk mode.
Connecting to a Server Load Balancer
You can connect one or more Firebox SSL VPN Gateways to a server load balancer. Characteristics of this
configuration include the following:
• Incoming Web traffic is intercepted by the server load balancer and load balanced among
multiple Firebox SSL VPN Gateways.
• For optimal load balancing, configure the settings to balance connections based on SSL session
identifiers (IDs). Load balancing based on source IP (Src IP) is also supported.
• For optimal performance, the server load balancer is configured with a fully qualified domain
name (FQDN). The FQDN is used by the Firebox SSL VPN Gateway when reestablishing a
connection to the server load balancer.
• The Firebox SSL VPN Gateway external public address is the external-facing (public) FQDN of the
server load balancer. The Firebox SSL VPN Gateway modifies all requests to include the external