Cisco SA520-K9 Administration Guide - Page 155

Access Options for SSL VPN, Security Tips for SSL VPN, Configuring VPN, RMON Remote Management

Get Cisco SA520-K9 - SA 500 Series Security Appliances PDF manuals and user guides
UPC - 882658266744
View all Cisco SA520-K9 manuals
Add to My Manuals
Save this manual to your list of manuals

Page 155 highlights

Configuring VPN Configuring SSL VPN for Browser-Based Remote Access 7 • Applications (that is, port forwarding for access to other TCP-based applications) The security appliance supports multiple concurrent sessions to allow remote users to access the LAN over an encrypted link through a customizable user portal interface. You can specify the user privileges and you can control each user's access to network resources. You can streamline the setup process by organizing VPN users into domains and groups that share VPN policies. NOTE Remote Management (RMON) must be enabled, or SSL VPN access will be blocked. For more information, see RMON (Remote Management), page 197. Access Options for SSL VPN The remote user can be given different options for SSL service: • VPN Tunnel: The remote user's SSL enabled browser is used in place of a VPN client on the remote host to establish a secure VPN tunnel. A SSL VPN client (Active-X or Java based) is installed in the remote host to allow the client to join the corporate LAN with pre-configured access/policy privileges. At this point a virtual network interface is created on the user's PC and it is assigned an IP address and DNS server address from the security appliance. To create a VPN tunnel, see Elements of the SSL VPN, page 156. • Port Forwarding: Port Forwarding service supports TCP connections between the remote user and the security appliance. A web-based (ActiveX or Java) client is installed on the client machine. The administrator can define the services and applications that are available to remote port forwarding users. Users do not have access to the full LAN. To configure port forwarding, see Configuring SSL VPN Port Forwarding, page 163. Security Tips for SSL VPN To minimize the risks involved with SSL certificates: • Configure a group policy that consists of all users who need Clientless SSL VPN access and enable it only for that group policy. • Limit Internet access for Clientless SSL VPN users, for example, by limiting which resources a user can access using a clientless SSL VPN connection. To do this, you could restrict the user from accessing general content on the Cisco SA500 Series Security Appliances Administration Guide 155

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
  • 145
  • 146
  • 147
  • 148
  • 149
  • 150
  • 151
  • 152
  • 153
  • 154
  • 155
  • 156
  • 157
  • 158
  • 159
  • 160
  • 161
  • 162
  • 163
  • 164
  • 165
  • 166
  • 167
  • 168
  • 169
  • 170
  • 171
  • 172
  • 173
  • 174
  • 175
  • 176
  • 177
  • 178
  • 179
  • 180
  • 181
  • 182
  • 183
  • 184
  • 185
  • 186
  • 187
  • 188
  • 189
  • 190
  • 191
  • 192
  • 193
  • 194
  • 195
  • 196
  • 197
  • 198
  • 199
  • 200
  • 201
  • 202
  • 203
  • 204
  • 205
  • 206
  • 207
  • 208
  • 209
  • 210
  • 211
  • 212
  • 213
  • 214
  • 215
  • 216
  • 217
  • 218
  • 219
  • 220
  • 221
  • 222
  • 223
  • 224
  • 225
  • 226
  • 227
  • 228
  • 229
  • 230
  • 231
  • 232
  • 233
  • 234
  • 235
  • 236
  • 237
  • 238
  • 239
  • 240
Configuring VPN
Configuring SSL VPN for Browser-Based Remote Access
Cisco SA500 Series Security Appliances Administration Guide
155
7
•
Applications (that is, port forwarding for access to other TCP-based
applications)
The security appliance supports multiple concurrent sessions to allow remote
users to access the LAN over an encrypted link through a customizable user portal
interface. You can specify the user privileges and you can control each user’s
access to network resources. You can streamline the setup process by organizing
VPN users into domains and groups that share VPN policies.
NOTE
Remote Management (RMON) must be enabled, or SSL VPN access will be
blocked. For more information, see
RMON (Remote Management), page 197
.
Access Options for SSL VPN
The remote user can be given different options for SSL service:
•
VPN Tunnel
: The remote user’s SSL enabled browser is used in place of a
VPN client on the remote host to establish a secure VPN tunnel. A SSL VPN
client (Active-X or Java based) is installed in the remote host to allow the
client to join the corporate LAN with pre-configured access/policy
privileges. At this point a virtual network interface is created on the user’s
PC and it is assigned an IP address and DNS server address from the
security appliance.
To create a VPN tunnel, see
Elements of the SSL VPN, page 156
.
•
Port Forwarding
: Port Forwarding service supports TCP connections
between the remote user and the security appliance. A web-based
(ActiveX or Java) client is installed on the client machine. The administrator
can define the services and applications that are available to remote port
forwarding users. Users do not have access to the full LAN.
To configure port forwarding, see
Configuring SSL VPN Port Forwarding,
page 163
.
Security Tips for SSL VPN
To minimize the risks involved with SSL certificates:
•
Configure a group policy that consists of all users who need Clientless SSL
VPN access and enable it only for that group policy.
•
Limit Internet access for Clientless SSL VPN users, for example, by limiting
which resources a user can access using a clientless SSL VPN connection.
To do this, you could restrict the user from accessing general content on the