Creating a remote access SSL VPN

You want to configure and deploy a connection to enable remote users to access a local network. The VPN establishes an encrypted tunnel to provide secure access to company resources through TCP on port 443.

Objectives

When you complete this unit, you’ll know how to do the following:
  • Specify an address range for SSL VPN clients.
  • Create a user group for SSL VPN clients and add a user.
  • Define a local subnet and remote SSL VPN range.
  • Add an SSL VPN remote access policy.
  • Add a firewall rule.
  • Set up Windows permissions for users to use the SSL VPN client.
  • Download the SSL VPN client software from the client and connect to the internal network.
  • Check connectivity.

Specify an IP address range for SSL VPN clients

When SSL clients sign in, they are assigned an address from the range specified here. You must use a private address range.

  1. Go to VPN and click Show VPN settings.
  2. Specify a lease range. If required, you can also update the subnet mask.
  3. Click Apply.

Create a user group and add a user

You create a user group for the remote SSL VPN and add a user. The group specifies a surfing quota and access time. Users in the group are allowed unlimited access.

  1. Go to Authentication > Groups and click Add.
  2. Specify the settings.
    OptionDescription
    Name Remote SSL VPN group
    Surfing quota Unlimited internet access
    Access time Allowed all the time
  3. Select Save.
  4. Go to Authentication > Users and click Add.
  5. Specify the settings.
    OptionDescription
    User name john.smith
    Name John Smith
    Group Remote SSL VPN group
  6. Select Save.

Define a local subnet and remote SSL VPN range

You create hosts for the local subnet and the remote SSL VPN range. The local subnet defines the network resources that remote clients will be able to access.

  1. Go to Hosts and services > IP host and click Add.
  2. Type a name and IP address for the local subnet.
  3. Select Save.
  4. Click Add.
  5. Type a name and IP address for the remote subnet.
  6. Select Save.

Add an SSL VPN remote access policy

You create a policy that allows clients in the “Remote SSL VPN group” to connect. These users are allowed to access resources on the local subnet.

  1. Go to VPN > SSL VPN (remote access) and click Add.
  2. Type a name and specify policy members and permitted network resources.
  3. Click Apply.

Check authentication services

You use local authentication for firewall authentication methods and SSL VPN authentication methods.

  1. Go to Authentication > Services.
  2. Check that the authentication server is set to Local.
  3. Scroll to SSL VPN authentication methods.
  4. Check that the authentication server is set to Local.

Check device access settings

To be able to deploy the connection and to ensure that users have access to the connection, device access for SSL VPN and the user portal must be enabled.

  1. Go to Administration > Device access.
  2. Check access to SSL VPN and the user portal.
  3. Click Apply.

Add a firewall rule

  1. Go to Rules and policies > Firewall rules. Select IPv4 or IPv6 and select Add firewall rule.
  2. Specify the settings.
  3. Select Save.

Windows user permissions required for SSL VPN client

Required permissions for Windows users.

A signed in user who tries to establish an SSL VPN connection needs network operation rights. This allows the SSL VPN client to fully set up the network, for example adding the required routes.

In Windows 7 and 8, network operations are an administrator privilege. You can either assign the role of a local administrator to users or use the preferred method and add users to the "Network Configuration Operators" Windows group. Alternatively, users can run the SSL VPN client as an administrator.

To add users to the "Network Configuration Operators" Windows group, do as follows:

  1. In Windows, open Control Panel > Administrative Tools.
  2. Open Computer Management.
  3. Expand System Tools > Local Users and Groups.
  4. Click Groups.
  5. Double-click Network Configuration Operators, and then click Add.
  6. Enter the username of the user you want to elevate, click Check Names to ensure accuracy, and click OK.
  7. Click Apply to save the changes.

Deploy the connection

Remote users install an authentication client and connect to the internal network using the VPN connection.

The following steps take place on the client computer.

  1. Log on to the user portal using the firewall’s public IP address and the user portal HTTPS port.
    Tip You can find the user portal HTTPS port by going to Administration > Admin settings.
    In this example, the user portal is accessible at https://192.0.2.15:4443.
  2. Download the SSL VPN client.
  3. Double-click the client installer file and follow the prompts to finish the installation.
  4. Start the client and log on using the username and password.

Check connectivity

You check the connectivity from the client and on the firewall.

  • From the client, check that you have been assigned an IP address from the SSL VPN range configured earlier in the firewall.
    On Windows, start a command prompt and type ipconfig. You should see an address in the range 10.81.234.5 – 10.81.234.55.
  • On the firewall, click Firewall and view traffic.