Cyberoam SSL VPN Administration Guide
Cyberoam SSL VPN is an application-based solution that provides secure remote access to applications and private network resources through a secure SSL connection. It allows users to access applications securely over the Internet without re-engineering, offering a highly secure, clientless and client based SSL VPN solution.
Advertisement
Advertisement
Administration Guide
Document version – 1.0-3505-08/02/2010
Cyberoam SSL VPN User Guide
IMPORTANT NOTICE
Elitecore Technologies Limited (hereinafter referred to as “Elitecore”) has supplied this Information believing it to be accurate and reliable at the time of printing, but is presented without warranty of any kind, expressed or implied. Users shall be solely responsible for the application of any products. Elitecore assumes no responsibility of any sorts for any errors that may appear in this document. Elitecore reserves the right, without notice to make changes in product design or specifications. Information is subject to change without notice.
USER’S LICENSE
The Appliance and/or software described in this document is furnished subject to the terms of Elitecore’s End User license agreement.
Please read these terms and conditions carefully before using the Appliance/software. By using this Appliance, you agree to be bound by the terms and conditions of this license. If you do not agree with the terms of this license, you are required and under obligation to promptly return the unused Appliance and /or software and manual (with proof of payment) to the place of purchase for a full refund.
LIMITED WARRANTY
Elitecore hereby declares that it has acquired a non-exclusive, unlimited, fully paid up worldwide right and license to sell and market the SSLVPN software including Endpoint Security software from third Party. Accordingly, all the warranties in respect of the Software, including but not limited to the performance, IPRs and others, are subject to the warranties given by the said third party owner to Elitecore. Elitecore shall not be responsible for any breach / failure of any such warranties. Subject to this, the
Elitecore hereby warrants that.
Software: Elitecore warrants, for a limited period of ninety (90) days from the date of shipment by Elitecore (1) the media on which the Software is furnished will be free of defects in materials and workmanship under normal use; and (2) the Software substantially conforms to its published specifications except for the foregoing, the software is provided AS IS basis. This limited warranty extends only to the customer as the original licensee. Customers exclusive remedy shall be and the entire liability of
Elitecore and its suppliers under this warranty shall be, at Elitecore or its service center’s absolute discretion, only for repair, replacement, or refund of the software, if reported (or, upon, request, returned) to the party supplying the software to the customer. In no event does Elitecore warrant that the Software is error free, or that the customer will be able to operate the software without problems or interruptions.
Hardware: Elitecore warrants that the Hardware portion of the Elitecore Products excluding power supplies, fans and electrical components will be free from material defects in workmanship and materials for a period of One (1) year from the date of shipment by Elitecore. Further , Elitecore's sole obligation shall be to repair or replace the defective Hardware as may be decided by Elitecore in its absolution discretion, at no charge to the original owner. The replacement Hardware need not be new or of an identical make, model or part; Elitecore may, in its absolute discretion, replace the defective Hardware (or any part thereof) with any new or reconditioned product that Elitecore reasonably determines is substantially equivalent (or superior) in all material respects to the defective Hardware.
DISCLAIMER OF WARRANTY
Except as specified in this warranty, all expressed or implied conditions, representations, and warranties including, without limitation, any implied warranty of merchantability, fitness for a particular purpose, non-infringement or arising from a course of dealing, usage, or trade practice, and hereby excluded to the extent allowed by applicable law.
In no event will Elitecore or its supplier be liable for any lost revenue, profit, or data, or for any direct, indirect, special, consequential, incidental, or punitive damages howsoever caused and regardless of the theory of liability arising out of the use of or inability to use the product even if Elitecore or its suppliers have been advised of the possibility of such damages. In no event shall Elitecore’s or its supplier’s liability to the customer, whether in contract, tort (including negligence) or otherwise, exceed the price paid by the customer. The foregoing limitations shall apply even if the above stated warranty fails of its essential purpose.
In no event shall Elitecore or its supplier be liable for any direct, indirect, special, consequential, or incidental damages, including, without limitation, lost profits or loss or damage to data arising out of the use or inability to use this manual, even if
Elitecore or its suppliers have been advised of the possibility of such damages.
RESTRICTED RIGHTS
Copyright 1999-2009 Elitecore Technologies Ltd. All rights reserved. Cyberoam, Cyberoam logo are trademarks of Elitecore
Technologies Limited, While all the Intellectual Property Rights (IPR) in respect of SSLVPN and Endpoint Security Software belongs to the third party.
Corporate Headquarters & Registered office
Elitecore Technologies Ltd.
904 Silicon Tower, Off. C.G. Road,
Ahmedabad – 380015, INDIA
Phone: +91-79-66065606
Fax: +91-79-26407640
Web site: www.elitecore.com
, www.cyberoam.com
Contents
Cyberoam SSL VPN User Guide
Cyberoam SSL VPN User Guide
Technical Support
You may direct all questions, comments, or requests concerning the software you purchased, your registration status, or similar issues to Customer care/service department at the following address:
Corporate Office eLitecore Technologies Ltd.
904, Silicon Tower
Off C.G. Road
Ahmedabad 380015
Gujarat, India.
Phone: +91-79-66065606
Fax: +91-79-26407640
Web site: www.elitecore.com
Cyberoam contact:
Technical support (Corporate Office): +91-79-66065777
Email: [email protected]
Web site: www.cyberoam.com
Visit www.cyberoam.com
for the regional and latest contact information.
CHAPTER 1
Cyberoam SSL VPN User Guide
INTRODUCTION
Overview
Cyberoam SSL VPN is an application-based solution providing secure remote access to your applications and private network resources through a secure SSL connection. Cyberoam SSL VPN allows you to access applications securely over the Internet without re-engineering. Cyberoam
SSL VPN is a highly secure, clientless and client based SSL VPN solution providing access to a wide variety of applications. Cyberoam SSL VPN provides secure registration and enrollment for all network resources.
This Administrator Guide provides instructions for configuring, deploying and managing the
Cyberoam SSL VPN solution. This document is intended for network and security administrators who are familiar with Ethernet and IP configuration.
What is SSL?
The Secure Socket Layer protocol was created by Netscape to ensure secure transactions between web servers and browsers. The protocol uses a third party, a Certificate Authority (CA).
SSL uses a cryptographic system that uses two keys to encrypt data − a public key known to everyone and a private or secret key known only to the recipient of the message. SSL technology is embedded in all popular browsers and engages automatically when the user connects to a web server that is SSL-enabled. When your browser connects to an SSL server, it automatically asks the server for a digital Certificate of Authority (CA). This digital certificate positively authenticates the server's identity to ensure you will not be sending sensitive data to a hacker or imposter site.
The browser also makes sure the domain name matches the name on the CA, and that the CA has been generated by a trusted authority and bears a valid digital signature. Once the handshake is completed, your browser will automatically encrypt all information that you send to the site, before it leaves your computer.
Cyberoam SSL VPN
Cyberoam SSL VPN provides a flexible and secure way to extend networking resources to virtually any remote user with access to the Internet and a Web browser. Remote access based on SSL
VPN delivers secure access to network resources by establishing an encrypted tunnel across the
Internet using a broadband or ISP dialup connection. SSL VPN does not require a client for accessing corporate LAN from remotely. The connectivity in between user and corporate network will happen through SSL tunnel. SSL VPN administrator can limit access of a user by using access controls in SSL-VPN. SSL VPN acts as an application gateway in between user and Corporate
LAN. That is when a user accesses an application, request will go to SSL VPN Server and server will route connectivity of user and requested Application.
CHAPTER 2
Cyberoam SSL VPN User Guide
CYBEROAM SSL VPN COMPONENTS
Cyberoam SSL VPN
Cyberoam SSL VPN based on Linux 2.6 kernel hardened platform, which hosts the required services for running SSL VPN. Cyberoam SSL VPN is based on a customized hardened Fedora distribution and is maintained by Cyberoam Support Team.
When installed, Cyberoam SSL VPN has a small menu driven interface to manage host configuration like network settings modifications or reinstallation of firmware.
Cyberoam SSL VPN comes on an integrated installer CD. The integrated installer is a single click
OS installer which also installs the VPN software.
NOTE
Installing the Cyberoam SSL VPN will erase all existing data off your system without asking about details of partition.
Cyberoam SSL VPN Service
Cyberoam SSL VPN service is a highly scalable service that provides secure access to corporate applications for incoming users. It is responsible for:-
1. Encryption/Decryption of all VPN traffic
The Cyberoam SSL VPN service is highly scalable in terms of number of users it can handle. It can go from 10 to thousands of users utilizing minimum amounts of hardware resources.
Cyberoam SSL VPN Management Console
The Cyberoam SSL VPN has a web based management console for easy and centralized user management, session management, policy management and server configuration control. The console also provides a graphical dashboard showing live users, license usage, resource usage and important VPN information. Reports of user activity can be generated and downloaded. The management console has built in granular administrative roles. There are two types of administrators namely Security officers and Administrators. Both security officers and administrators must login using certificates generated from the VPN console.
Management console can be accessed from Cyberoam SSL VPN home page. Currently Internet
Cyberoam SSL VPN User Guide
Explorer 7.0, 8.0 and Firefox 3.x are supported and tested browsers.
Cyberoam SSL VPN Homepage
When the IP address or hostname of the VPN gateway is browsed, it gives the Cyberoam SSL
VPN home page. This provides access to VPN on-demand agent, VPN client installers and administration console.
The home page can be access on URL http://vpngateway_ip_address/
Cyberoam SSL VPN Client
There are two ways to login from your client computer to Cyberoam SSL VPN.
1. Clientless Access (Via ActiveX) called On-demand VPN Agent
For Clientless access, you can use Internet explorer browser and automatically download
Cyberoam SSL VPN ActiveX control to your local machine and provide connectivity without using any installable application.
2. Client Access (Via Cyberoam SSL VPN Client) – You need to install Cyberoam SSL VPN client in local machine.
Cyberoam SSL VPN Client is a small footprint self upgrading VPN client that is required to login into Cyberoam SSL VPN server. The VPN client can be installed from Cyberoam SSL
VPN Home page.
Cyberoam SSL VPN client is currently supported on the following platforms:
Microsoft Windows - Windows 98, 2000, XP SP3, Vista, Windows 7 and Windows 2003 platforms.
Linux OS - Red hat, Fedora 9, 10, 11, SUSE, Ubuntu, Debian
Mac OS - OS X 10.4, OS X 10.5 (Both PPC and Intel architecture are supported)
CHAPTER 3
Cyberoam SSL VPN User Guide
VPN INSTALLATION
Cyberoam SSL VPN is available as a virtual appliance as well as software only.
Cyberoam SSL VPN Virtual Appliance
Cyberoam SSL VPN is available as a VMware Virtual Appliance that can be run on VMware
Player, VMware WorkStation, VMware Server and VMware ESX/ESXi Servers. The Virtual
Appliance is downloadable from Cyberoam Website ( http://download.cyberoam.com
). Simply extract the image file and import directly into your VMware environment and you are ready to go.
All the functionalities of the virtual appliance are the same as the software version.
Cyberoam SSL VPN as Software VPN
Cyberoam SSL VPN is also available as software VPN. It is available as a single click integrated installer CD that installs Cyberoam SSL VPN on any custom hardware. The VPN CD installer ISO can be downloaded from Cyberoam Website ( http://www.cyberoam.com
).
Cyberoam SSL VPN is based on Linux 2.6.xx kernel platform, hence any hardware that supports
Linux is supported by Cyberoam SSL VPN. Currently Cyberoam SSL VPN supports only x86 based hardware platform.
Steps for Installation of Cyberoam SSL VPN
1. Make your system’s first bootable device is CD
2. Insert Cyberoam SSL VPN installer CD
3. The installer screen will appear.
4. Installation procedure starts. Next few steps will ask about OS language and keyboard layout
5. Installation will start automatically and will take up to 10-15 minutes to complete.
6. After completion of Installation, remove CD and restart the machine
Configuration of Cyberoam SSL VPN
After completion of installation and restart, you will get a prompt to login to gain access to the
Cyberoam SSL VPN Console menu. The account name is ‘consoleadmin’. The default password for the account is ‘adminconsole’. The administrator has option to change the password for consoleadmin user. Root access to Cyberoam SSL VPN is blocked completely. Once authenticated you will see the following Cyberoam SSL VPN Console screen:
Cyberoam SSL VPN User Guide
Use UP and Down arrow key to scroll through the menu option.
1. Change IP Address - Change IP Address and subnet mask of your Cyberoam SSL VPN. You will be prompted for consoleadmin password.
This will show available Ethernet cards in the system and default IP address 192.168.1.100.
For changing this, select the menu Item (use UP and DOWN arrow keys) and press Enter.
Enter new static IP, network mask address and gateway of the network.
NOTE
Keeping VPN device with static IP is always a good practice
Cyberoam SSL VPN User Guide
Navigate using arrow keys, select OK and press Enter. This will redirect you to previous menu (Network device). Select quit button and Enter. VPN network service will restart.
2. Change Hostname - Set Cyberoam SSL VPN Server hostname
IMPORTANT
Cyberoam SSL VPN resolves requests only through hostname. VPN hostname should be set before starting VPN configuration. If you are changing hostname after configuration of VPN box, this will affect your whole VPN set up and need to re-configure existing VPN setup.
3. Modify Hosts File - Modify VPN Server local host file for name resolution in case a DNS
Server is not available
4. Modify DNS Configuration - Add your DNS servers for name resolution
• Reset Administrator Account - This feature resets the Security Officer / Administrators certificate on VPN management console and sends a new passphrase to the registered email ID of the account. This feature can be used in case where administrator certificate is lost or a user forgets their password.
5. Re-install Firmware - Allows to reinstall the VPN software on the appliance
6. Restart Appliance - Choose this option to restart your Cyberoam SSL VPN appliance
7. Shutdown Appliance - Choose this option to shutdown the Cyberoam SSL VPN
8. Change Console Administration Password - Choose this option to change the default password for consoleadmin user
9. Go to Shell - Go to OS shell for advanced administration
CHAPTER 4
CONFIGURATION
VPN Service States
The VPN service has three states:-
Cyberoam SSL VPN User Guide
2. Configuration
3. Run
Boot strap State
On successful installation, the VPN service is in System Configuration state, also known as bootstrap state. During this stage, admin configures the system settings, including network, license and certificate settings.
During this stage, the first security officer account is created.
Configuration State
In this state, the VPN service is in configuration mode. VPN service will not accept connections from any user other than Security Officers and Administrators.
Once bootstrap state is complete, the VPN service automatically moves to Configuration state.
Administrators can bring the VPN service from run state to configuration state from administrator console for doing system wide changes.
Run State
In this state, the VPN service is fully functional. No critical system wide changes can be performed on VPN system during run state.
VPN service does not move automatically from configuration state to run state after a fresh configuration. You can change the VPN service from Configuration state to Run state, from VPN
Status Æ VPN Server State page in the management console.
New VPN Installation
Cyberoam SSL VPN User Guide
Bootstrap State
On successful installation, the VPN service is running in bootstrap mode. The first screen you see in this mode is the System Configuration page where you can configure network and license settings. Follow these steps to complete bootstrap stage.
1. Launch the web browser and go to URL http://vpngateway_ip_address/
2. Click on link Administrators link under section VPN Management console
Screen – Cyberoam SSL VPN Home Page
3. The Cyberoam SSL VPN – System Configuration screen appears where you can specify network and license settings.
4. In the Host Configuration section, enter the following information to configure the host settings. the in the Host Name field. the in the Default Gateway field. the in the Primary DNS field. the in the Secondary DNS field.
Cyberoam SSL VPN User Guide
Screen – System Configuration
5. In the Interface Configuration section, enter the following information to configure the interface settings. a. By default, for appliance model CR-SSL-800 and CR-SSL-1200 two network cards i.e. eth0 and eth1 are configured with IP address 192.168.1.100 and 192.168.2.100 while for appliance model CR-SSL-2400 two network cards i.e. eth4 and eth5 are configured with IP address 192.168.1.100 and 192.168.2.100. the in the IP Address field. the in the Subnet Mask field. the in the Gateway field.
NOTE
If the IP address and gateway is set at the time of installation of OS in the system before the VPN installation, these values will be displayed in the Host name, Default Gateway, Primary DNS, Secondary
DNS, IP Address, Subnet Mask and Gateway fields by default. You can edit the values if required.
6. In the Date and Time setting section, enter the following information to configure the date and time settings. a. To set the date, click on the drop-down arrows and select the Date, Month, and Year from the list, corresponding to the Date field. b. To set the time, click on the drop-down arrows and select the Hours and Minutes from the list, corresponding to the Time field. c. Click on the drop-down arrow corresponding to the Time Zone field and select the applicable time zone from the list.
7. Click on Server License in order to configure your licensing options for Cyberoam SSL
VPN.
Cyberoam SSL VPN User Guide
Screen – Server License
your in the Company Name field. b. Use System Default License. This is an evaluation license, which allows 5 users for
30 days. c. Use New License Key. Choose this option to request a
8. Optionally you can choose to Restore the system from a previous backup file to apply a previously saved configuration to this VPN install.
9. Click to save the configuration details or click reset to clear the fields.
10. On clicking the Submit button, the following confirmation screen appears, displaying the entered values.
Screen – Host Configuration
11. Click Commit to save the details or click Cancel to change the System Configuration values.
On completion of System Configuration, the VPN continues through Bootstrap stage, and is ready for a one-time registration process. In Bootstrap State, first Security Officer Registration, SMTP
Server configuration, Database User configuration, and several others tasks are completed, including:
• Register first Security Officer
• Create Root Certificate Authority (CA) Certificate
• Register SSL Certificate for VPN
• Create Signer Certificate
• Create Verifier Certificate
• Create VPN database and database tables
• Initializing the VPN and user interface services
Cyberoam SSL VPN User Guide
• Create Configuration files
• Enter Configuration State (this change occurs automatically after the Bootstrap process is complete)
The tasks such as creating CA certificate, Signer Certificate, Verifier Certificate, and many others take place internally when you register the necessary details with VPN during server Bootstrap.
1. Once all of the internal tasks have been completed, you will be redirected to the Certificate
Authority screen.
Screen - Certificate Authority Mode
2. In the Certificate Authority Mode section, the Default Cyberoam Internal CA field is chosen by default. This enables the VPN internal Certificate Authority and the VPN server becomes the Certificate Authority. Choose External CA if you wish to use a 3 rd
Certificate Authority.
Party the button to save the changes made. On clicking the Submit button, the
Certificate Authority page appears as shown below depending on which option you selected.
Screen – Certificate Authority Information
a. For External CA provide CA Certificate path, CA Private Key path and CA Private Key
Password.
b. For Cyberoam Internal CA fill out the required fields
Cyberoam SSL VPN User Guide
Screen – Bootstrap
4. You also need to create the Security Officer account on the VPN. This account provides administrator access to the VPN management console where further accounts can be created. See table below for description of each field.
Field Value Description
Certificate Authority Information
Company
Name
Country
<Company Name>
<Country Name>
Name of the company to which Certificate will be issued.
Name of the country where Certificate will be issued.
State
City
Validity (days)
<State Name>
<City Name>
<No. of Days>
Name of the state where Certificate will be issued.
Name of the city where Certificate will be issued.
Validity period for the Certificate.
Security Officer Account
Name < First Security
Officer Name>
Full name of First Security Officer.
Email <Username@domain name>
Email ID of First Security Officer.
User ID <User Name>
Password
Biometric data required
<Password>
Basic Authentication Login ID for First
Security Officer.
Temporary password for this account.
Security Officer will specify their own password on enrollment.
Check this field to enable biometric authentication for the First Security Officer.
Cyberoam SSL VPN User Guide
SMTP server
SMTP port
<SMTP Server
Name>
25
SMTP server address to route emails generated by VPN. It should be FQDN.
Port number on which SMTP service is configured to listen.
5. On clicking the Submit button, the following screen confirming the registration will appear after a short while. Cyberoam SSL VPN Server emails Root Certificate (cacert.cer) and a
Passphrase to the first Security Officer’s e-mail address. You can also copy the passphrase from the registration screen shown below.
Screen – First Security Officer
Configuration State
Upon successful completion of Bootstrap State, VPN automatically moves into Configuration State.
The following tasks are completed in Configuration State:
• Enroll First Security Officer
• Move VPN from Configuration State to Run State
NOTE
User Registration and User Enrollment are two different processes. During the User Registration process, the User Name and User E-mail Address are registered with VPN and a Passphrase is generated. During the User Enrollment process, the Passphrase and a Password, supplied by the User, are registered with
VPN, and a user Certificate file (.cer) is generated.
Applications can be added to the server when VPN is in Configuration State. However, users cannot access applications until VPN is in Run State.
Cyberoam SSL VPN server sends an email to the first Security Officer account, as registered on the Enterprise Server page, containing a Root Certificate, Passphrase, and a link to the VPN home page. The Security Officer can save the Root Certificate file (cacert.cer) in a local folder and import it to the list of Trusted Root Certification Authorities in the browser to avoid seeing warnings when authenticating.
Import VPN Certificate (Trusted Root Certification Authorities)
The Root Certificate (cacert.cer) file can be downloaded by either of the two methods:
Cyberoam SSL VPN User Guide
1. Download and open the file included in the e-mail
2. Launch your web browser and type the URL http://vpngateway_ip_address/ to access the
VPN landing page.
Click Server Certificate from the ‘To Download’ section of the VPN page and open the root certificate.
Click “Install Certificate” Button and follow instructions making sure to install the Certificate in
“Trusted root Certificate” store location.
If the Certificate is properly installed, you can see installed Certificate in the Trusted Root
Certification Authorities list in IE. To view go to Tools menu, click Internet Options. Click on the
Content tab, click Certificates, and then click on the Trusted Root Certification Authorities tab.
Enroll First Security Officer
The first Security Officer, whom you registered in the VPN Bootstrap State section earlier, must now be enrolled using the Passphrase available in the e-mail generated automatically and sent to the first Security Officer account. The password required must be supplied by the first Security
Officer. When the Security Officer is successfully enrolled, a user Certificate is imported to the local personal certificate store.
1. Open your web browser and browse to http://vpngateway_ip_address/
2. In order to enroll a user you must install the VPN client or login using the ‘On-Demand VPN
Agent’ (Clientless ActiveX control).
To download and install the VPN client, click on the link “Install Cyberoam SSL VPN client for
desktop”.
You will need to download and run the Windows Client to login using certificate based authentication for Administrator access.
Click “Run” on the following screen and complete the installation of client.
Cyberoam SSL VPN User Guide
Screen - Download VPN Client
3. Double click the desktop icon for Cyberoam SSL VPN Client and start the client. In the
Server box type the name of your VPN server and choose “Certificate User”.
If you are using the ‘On-demand VPN agent’ the server value does not appear.
4. On the Action menu choose Enrollment.
Cyberoam SSL VPN User Guide
Screen – Enrollment Screen
5. In the Pass Phrase field, type the Passphrase you received in the e-mail (if you prefer copy and paste the Passphrase from the e-mail to this field).
In the Password field, type a password for your Security Officer Account.
In the Confirm Password field, retype the password for confirmation.
Click on Submit to submit the enrollment information and click on Abort to exit from this screen without saving the changes.
Cyberoam SSL VPN User Guide
NOTE
You may see a security warning if you are you using the Internal CA and have not imported the Root
Certificate into the Trusted Root Certificate store on this machine. You can proceed and login without doing this.
Login to VPN
Cyberoam SSL VPN supports two types of Authentication Mechanisms to access services over the network:
• Basic Authentication: This is a weaker authentication mechanism. Users log on using User ID and Password. The Low Security Users are authenticated with this mechanism.
• Certificate Authentication: This is a stronger authentication mechanism. Users log on with
Certificate and Password. Security officers and Administrators are also authenticated with this mechanism.
To login as a Security Officer, choose “Certificate User” and use the dropdown list under certificates to choose the certificate imported during the Enrollment phase.
Type the password for the Security Officer Account and click login.
Screen – Login
The details of the applications and the activities available for this certificate user will be displayed in the Applications and Activity tab screens respectively, and the VPN moves to the system tray as an icon.
Cyberoam SSL VPN User Guide
Screen – System tray
Change Password
You are recommended to change your password.
Your password must be between six and 15 characters long and can contain alphanumerical characters
You can change password expiry settings from Administrator portal. (For more details Please refer
“User management” chapter)
Return to the VPN login screen. On the Action menu, click Change Password. The Change
Password screen appears.
Screen – Change Password
Click on OK to save the changes made and click cancel to exit the screen without making any changes in the password. The following screen will appear after you have changed the password.
Click the OK button and the user needs to login again using the new password, to continue using
VPN.
IMPORTANT
If you accidentally lose your password, contact your VPN Administrator.
You can now access the VPN Management Console by browsing to http://vpngateway_ip_address/
Choose the “Administrators” link under VPN Management Console to administer the VPN.
Cyberoam SSL VPN User Guide
Enroll Second Security Officer and Administrators
After the first Security Officer is successfully enrolled, he or she can register a second Security
Officer and any Administrator accounts.
Once registered, the second Security Officer and the Administrators must enroll themselves, following the steps above, substituting the second Security Officer and Administrator data accordingly.
CHAPTER 5
Cyberoam SSL VPN User Guide
VPN MANAGEMENT
Overview
To perform VPN management function, first login to the VPN as an Administrator or Security
Officer then click on Administrators from the VPN Management Console section of the VPN page.
NOTE
A Security Officer or an Administrator logged onto VPN with Basic Authentication will not have access to
VPN Administration commands.
The VPN Management Console will appear as shown below. The console is organized into a navigation tree on the left hand side, which is logically grouped into the following management sections:
• VPN Status - Displays real-time information about the VPN
• Access Management options - Provides User, Group and Authentication configuration
• Endpoint Management - Configure Endpoint Security control and enforcement
• Resources - Miscellaneous settings for use with other admin tasks
• Host Configuration - Server specific settings and configuration
• Host Maintenance - VPN backup, upgrade and licensing options
• Monitoring and Reporting - Reports on User, Admin and Endpoint activities
Screen – Dashboard
Cyberoam SSL VPN User Guide
Throughout the console, administrators can use the in-line help feature to assist them with their configuration.
VPN Management tasks can only be performed by Administrators and Security Officers. Some of the administrative functions include:
• Creating User Groups and organizing Users into User Groups
• Creating Application Groups and organizing registered Applications into Application Groups
• Creating Endpoint Security Host Scan Policies and Device Profiles
• Assigning Endpoint Security Host Scan Policies to Device Profiles
• Organizing registered Applications into Security Profiles
• Specifying time-based access restrictions (Access Filters)
• Assigning Application Groups to User Groups from (Access Control Lists)
User Groups and Application Groups make it easier to administer access controls. It is much more efficient to create User Groups and Application Groups, and then specify privileges for entire groups instead of specifying for individual users or applications.
NOTE
When a user logs on, the Access Control Lists specified for the subscribed User Groups are activated. This enables the user to securely access applications in the assigned Application Groups.
Other administrative functions include updating selected configuration parameters registered during Bootstrap State (such as Network settings, Database password, SMTP, and Proxy server details), specifying authentication settings, setting client logout time, and specifying IP ranges for auto configuration of applications. These and other functions are explained in more detail within this chapter.
VPN status
The VPN status section of the console is provided to deliver real-time, relevant information to the administrator to assist them to monitor the VPN and user activity on the server as well as force user logout and change system configuration state.
Dashboard
The dashboard serves as the default homepage when launching the VPN Management Console.
It displays the following information about Cyberoam SSL VPN server:
Live Users -
No. of users currently logged into VPN.
Maximum Allowed -
Maximum concurrent users allowed as per license.
VPN Version -
VPN Gateway Software Version.
OS Version -
VPN Gateway OS Version.
Cyberoam SSL VPN User Guide
Endpoint Security Last update -
Time when Endpoint Security Product signatures were updated from live update server.
License Information -
License details. Pie chart shows license usage
Resource Usage -
Chart shows hardware resource usage. The chart is updated every 5 seconds.
Latest data is on the right side.
Latest 5 Important Messages -
Last 5 administrative changes occurring on the VPN gateway.
VPN Information -
A summary of VPN configuration including hyperlinks to specific areas of the system.
System Information -
System time and time since last reboot.
Active Users
From the Active Users window, you can see all concurrent users on the VPN. An Administrator has the power to forcefully log out a user from existing session.
Screen – Active Users
VPN Server State
Cyberoam SSL VPN server has two running states: Run state and Configuration state.
When the system is in configuration state, you can do system wide changes like changing database password, upgrading license, etc. When the server is in configuration state, users cannot log into the server and all active users are disconnected.
In Run state, the VPN server is running in normal mode and users can login into the system.
System wide changes cannot be done in Run state.
In the VPN management console, click VPN Status Æ VPN Server State. The Server State screen appears.
Screen – VPN Server State
Cyberoam SSL VPN User Guide
Toggle the server state from Run State to Configuration State by clicking on the desired link.
A success message confirms the Server State change. (It may take a few seconds to change the server state.)
After changing the server state, the user has to logout from VPN and then login again to continue with the VPN activities.
Access Management
The Access Management section is focused on configuring user authentication and application access through the VPN gateway.
Local Users
An Administrator must register the users who need to access applications securely over the network. VPN supports multiple user roles and permission grouping. The security privilege of users depends on the role they perform. The different user roles are:
•
Security Officer (SO):
The most privileged of all VPN users. A Security Officer can create, delete, and modify other SOs, Administrators, High Security, and Low Security Users. An SO can also manage the Access Control Lists (ACL) for User Groups, as well as manage applications. Only a Security Officer can change the Server State, Database Password, and
Basic Authentication Method and Enable/Disable SSH.
•
Administrator (Admin):
Administrator can create, delete, and modify other Administrators,
High Security, and Low Security Users. They can also administer Applications, User Groups, and Application Groups, and manage the Access Control Lists (ACL’s) for User Groups.
Admin users cannot create, modify, or delete a Security Officer
•
High Security Users:
High Security Users are Power Users who are authenticated with the stronger Certificate-based authentication mechanism. Security Officers and Administrators are Power Users by default.
•
Low Security Users:
Low Security Users can be Native, LDAP/ ADS, or RADIUS users who are authenticated with the weaker Basic Authentication mechanism. If you wish to have users login with their Active Directory credentials then you do not have to create them an account on the VPN. See configuring Authentication Servers for more information.
•
Machine Class Users:
Machine Class Users are created only in the context of configuring chained VPN.
NOTE
Security Officers, Administrators, and High Security Users can also log on to VPN with Basic Authentication but they will NOT have the Power User privileges when they log on with Login ID and Password.
You can integrate VPN with LDAP, ADS or RADIUS authentication servers. This allows the users
Cyberoam SSL VPN User Guide registered with these servers to log on to VPN with their LDAP, ADS, or RADIUS user accounts.
There is no need to create user accounts in the VPN server (Native Database) for these users.
However, the LDAP, ADS, or RADIUS users have only Low Security User privileges. For High
Security User privileges, you must create an account for the user in the VPN database.
In the Administration menu on the left side of the VPN console, click to expand Access
Management, and then click Local Users and Add.
Screen – Add Users
Username:
Enter user’s full name.
User E-mail Address:
Enter user’s e-mail address.
Administrator E-mail Address:
Enter Administrator’s E-mail Address.
Class:
From the Class drop-down menu select the user’s class from the list. Select User, if creating a user. Machine Class is relevant only for Chained VPN.
Role:
On the Role drop-down menu select the user’s role from the list. Choose from Security
Officer, Administrator, High Security User, or Low Security User. The default role is Low Security
User.
Hostname:
The Hostname field is editable only if the Class selected is Machine. A default value
127.0.0.1 is displayed for this field otherwise.
Cyberoam SSL VPN User Guide
User must change password In next logon:
Check if users wants to change password at login, otherwise keep it unchecked.
Password never expires:
Set for password to not expire.
Account is disabled:
Administrators can keep an account in disabled state for a time period.
Check or uncheck the box and change the account status as necessary.
Account expires on:
Administrator can set a date when the account will automatically expire.
After the given date the user account is set to “disabled”. This option is applicable only for basic authentication and certificate users. This option is not applicable to security officers and administrators.
User ID:
Enter username (this will be used by the user to login as Basic Authenticated User). This field is available to all types of users except Machine Class User.
Password:
Type the user’s password in the Password field.
Subscribed User Groups:
Subscribe user to a User Group. (Refer Add User to User Group section for more information).
Click Submit to create user or click Reset to clear the data entered in the fields.
A success message confirms that the user has been created.
NOTE
All High Security Users must enroll in order to access VPN. All users must download the root certificate
(cacert.cer) and import it to the browser, in the list of Trusted Root Certification Authorities.
2. Edit / Modify Users
In the VPN management console, click Access Management and choose Local Users.
Type the user name you want to edit in the Search Users field. If entering multiple names, separate names with a comma.
Click Show to display the search results.
Click on the check box for the user you want to edit and click Modify. The Modify User screen appears. Modify values you want to edit and click submit button to save the changes.
On the Local Users screen, check the boxes for the user(s) you want to delete. To select all users in the table, click on the Check all box below the table.
Cyberoam SSL VPN User Guide
Click Delete to delete the selected user(s).
When prompted for deletion confirmation, click OK to delete user(s) or click Cancel to abort.
NOTE
Security Officers and Administrators cannot delete their own accounts.
This option allows the administrator to reissue a certificate passphrase to users. The new passphrase will be sent to user’s registered email ID.
NOTE
Passphrase recovery is available only for Certificate users.
On the Local Users screen, click on the check box for the user who needs passphrase recovery.
Click Reset Passphrase
The following confirmation screen will appear.
Screen – Alert Message
Click OK in the confirmation window to reset the passphrase, or click Cancel to exit.
A success message confirms that a new Passphrase has been emailed to the specified user.
While re-enrolling into VPN the user must use the newly e-mailed Passphrase and enter a new password to generate a new Certificate.
The User can now login into VPN, using the new certificate and password.
Local Groups
User Groups allow you to organize Users on the basis of function, logistics or any criteria that suits your organization.
Cyberoam SSL VPN has three default User Groups:
Cyberoam SSL VPN User Guide
• SYSTEM
• DEFAULT_USER_GROUP
• DEFAULT_BA_USER_GROUP
The Security Officers and Administrators belong to SYSTEM group. The other Certificate-based
(High Security Users) users belong to DEFAULT_USER_GROUP. And the Native Basic
Authentication Users (Low Security Users) belong to DEFAULT_BA_USER_GROUP.
Cyberoam SSL VPN Administrator can create other User Groups of the following types:
• HS User Group
• BA User Group
The Native Basic Authentication Users can be subscribed to BA User Group while the High
Security Users can be subscribed to both HS and BA User Groups.
NOTE
The User Groups for the LDAP/ADS users are obtained from the LDAP/ADS servers. The RADIUS users belong to DEFAULT_RADIUS_USER_GROUP group.
1. Create User Group
In the Administration menu on the left side of the VPN console, click Access Management >
Local Groups
. Choose to Add Local Group.
Screen – Create User Group
Type the group name in the User Group Name field.
Type the group description in the User Group Description field.
To create a HS User Group, click on the check box for High Security. To create a BA User
Group
, leave it empty.
Click Submit to create the User Group or click Reset to clear all data in this screen.
A success message confirms that the User Group has been created.
Cyberoam SSL VPN User Guide
2. Delete User Group
In the Local Groups screen, click on the box for the User Group(s) you want to delete. To select all groups, click on the Check all box below the table.
Click Delete to delete the selected group(s).
When prompted for deletion confirmation, click OK to delete the group(s) or click Cancel to abort.
3. Add User to User Group
Low Security Users belong to DEFAULT_BA_USER_GROUP by default, and High Security Users to DEFAULT_USER_GROUP.
Security Officers and Administrators belong to SYSTEM group by default.
Cyberoam SSL VPN Administrator can create other User Groups of type HS (High Security) User
Group
or BA (Basic Authentication) User Group, and add the registered users to these groups.
A Low Security User can belong to multiple BA User Groups while a High Security User can belong to multiple HS and BA User Groups. Users can access the Applications in the Application
Groups assigned to the Users Groups to which they belong.
4. Add Low Security Users to User Groups
While in the Create User screen or Modify User screen, click on the Subscribe User to User
Group
link. The Add/Delete user group screen appears.
Screen – Add User Group to User
Select the User group(s) in the BA User Groups table to which this user should be subscribed, and click Add. The selected user group(s) move from BA User groups table to the User Groups table on the opposite side of the screen.
Click Submit to subscribe the user to the selected user groups or click Cancel to abort.
The group name(s) will be listed in the Subscribed User Group list on the user’s account screen.
Cyberoam SSL VPN User Guide
Screen – Subscribe User to User Group
5. Add High Security Users to User Groups
While in the Create User screen or Modify User screen, click on the Subscribe User to User
Group
link. The Add/Delete user group screen appears.
Screen – Add User Group to User
Select the High Security User Group(s) in the HS User Groups table to which this user should be subscribed, and click Add. The selected user group(s) move from HS User groups table to the
User Groups
table on the opposite side of the screen.
Select the BA User Group(s) in the BA User Groups table to which this user should be subscribed, and click Add. The selected user group(s) move from BA User Groups table to the
User Groups
table on the opposite side of the screen.
Click Submit to subscribe the user to the selected user groups or click Cancel to abort.
The group name(s) will be listed in the Subscribed User Group list on the user’s account screen.
Screen – Subscribe User to User Group
Cyberoam SSL VPN User Guide
NOTE
Subscription to user groups is not applied until after you have completely saved Create User/Edit User data.
6. Modify Subscription to User Group
In the Modify User screen, click on the Subscribe User to User Group link. The Add/Delete user group screen appears (this screen varies, depending on the user type).
To remove the user from any User Groups, select the subscribed User group(s) from which the user should be removed in the User Groups table and click Delete. The selected group(s) move from the User groups table to the BA User Groups or HS User Groups table on the opposite side of the screen.
Click Submit to update the list of selected user groups or click Cancel to abort.
The group name(s) will be listed in the Subscribed User Group list on this user’s Modify User screen.
Authentication Servers
As well as having a local database of users who can authenticate to the VPN, you can configure authentication servers which will allow integration with LDAP based directories such as Active
Directory or RADIUS based authentication systems. Once configured, these Authentication
Servers become active in the VPN Domains and Access Control pages.
1. Add Authentication Server
In the Administration menu on the left side of the VPN console, click to expand Access
Management
, and then click Authentication Servers. Click Add to specify a new Authentication
Server.
Screen – Create Authentication Server
AD/LDAP
Cyberoam SSL VPN User Guide
Screen – Create AD/LDAP Authentication Server
Type an identifier of the External AD/LDAP Authentication Server in Server Name field.
Type the IP address, host name, or FQDN of the AD/LDAP server, in the Host Name field.
The default LDAP port number is displayed in the Port field. Please note that you can change this port number as needed.
Type the admin bind DN in the Admin Bind DN field e.g.
cn=vpadmi,cn=Users,dc=cyberoam,dc=com
Type your password in the Admin Password field.
Type the base DN in the Base DN field e.g. dc=Cyberoam,dc=com
User search attribute is given in the User Search Attribute field, e.g. Samaccountname.
User Group search attribute for the server is displayed in User Group Search Attribute field, e.g.
MemberOf.
NOTE
The User Group Search Attribute is used to obtain the User Groups from AD/LDAP server.
Click Submit to save the configuration data or Reset to clear all data from this screen.
AD/LDAP Configuration info updated successfully message will be displayed.
RADIUS
Cyberoam SSL VPN User Guide
Screen – Radius Authentication Server
Type an identifier of the External RADIUS Authentication Server in Server Name field.
Type the host name, or FQDN of the RADIUS server, in the Host Name field.
The default RADIUS port number (1812) is displayed in the Port field. Please note that you can change this port number as needed.
Type the administration password of the RADIUS server in the Shared Secret field.
Click Submit to save the configuration data or Reset to clear all data in this screen. Radius configuration info updated successfully message will be displayed.
NOTE
The AD/LDAP and RADIUS users must download the root certificate (cacert.cer) and import it to the list of
Trusted Root Certification Authorities.
VPN Domain
The VPN Domain page in the management console provides allows the administrator to define the authentication and authorization scheme for the VPN, termed as VPN domain. In future versions, it will be possible to add multiple VPN domains each with own AAA scheme.
Authentication Servers
An administrator can add and use more than one external authentication server. A maximum of five Authentication Servers can be configured in cascading manner using the priority. This means, if user can not be found in highest priority server, the user is will searched in the lower priority servers also.
To configure the VPN Authentication priority, open the VPN Management Console and expand
Access Management. Select VPN Domain from the submenu.
Cyberoam SSL VPN User Guide
Screen – VPN Domain
Simply use the drop down list in the Authentication Servers box to specify the priority order for authenticating users to the VPN.
You can delete servers from the priority list by using the Delete Server option.
NOTE
Deleting servers from this list does NOT remove the authentication servers from the system.
Authorization Servers
In case the authentication server cannot provide role/group information for an incoming user, a separate authorization server can be specified which will be used to provide user role information.
Authentication servers like OTP tokens or RSA SecureID servers may not provide role information to VPN gateway. VPN gateway requires user’s role to assign applications to the user. With such servers an additional external authentication server or native groups can be used to decide the role of the user.
The authentication is done with the external authentication server and then the username is searched in the configured external authorization server.
Authorization servers can also be configured in cascading manner using the priority. A maximum of two authorization servers can be configured. Selecting the option 'Same as Authentication
Server' will cause the authorization to happen with the authentication server through which the user is authenticated.
Screen – Authorization Server
Simply add your chosen Authentication server which is to be used for Authorization search on login.
Cyberoam SSL VPN User Guide
Local Groups
The Administrator can specify a list of native/local groups that are not allowed to login into the VPN gateway. This feature can be used when the external authentication server cannot provide any role information and VPN local groups need to be used to put users into particular roles. In that case specific local groups can be blocked to login into VPN.
Applications
Cyberoam SSL VPN supports services for a wide range of multi-port TCP/UDP applications. For a list of some supported services, please see Appendix E: Supported Applications. You can register the services manually or with Auto Configuration of Standard Applications. Cyberoam SSL VPN can automatically detect standard services running on machines within a given subnet range and list them for service configuration.
While creating new applications, it is common to set a hostname for Application server or the URL which is not resolvable from VPN gateway. This can happen either the hostname typed is not correct or the DNS server is not configured correctly or there is no DNS server at all. In v3.5 when creating applications, the VPN will check if the hostname specified as Application Server hostname and the hostname/domain name in the Web URL is resolvable from VPN gateway or not. An error is displayed if the name cannot be resolved. The Administrator can fix the hostname or they can create host file entry for the hostname.
In the VPN management console, click Access Management > Applications and then click Add.
The Create Application screen appears.
Select Auto Configuration of Standard Applications to automatically scan the LAN and configure available applications. This option requires LAN range configuration under
RESOURCES > LAN IP RANGE.
Application Name:
Application Identifier.
Application Description:
Application description.
Application Type:
Type of application. This is used to categorize the application under different section when displaying the application list to users. It is advised to set the correct application type for the coming up VPN Portal feature.
Application Address:
Hostname of IP address of the application server. Make sure VPN gateway can resolve the hostname of the application server. Specify a comma separated list if multiple application servers exists for same application, along with clustered application option as described below.
Application Port:
TCP/IP port on which application server is listening for connections.
Cyberoam SSL VPN User Guide
Screen – Create Application
Web URL:
Full URL of the target web server in case the application is a web application. If the
URL is specified, the application will be listed on application portal opened on user's machine.
IMPORTANT
The hostname in the URL must be same as application server address specified above or it should match the application name without spaces.
Clustered Server:
Select this option if there are multiple application servers present in LAN to serve remote users and VPN should do round robin based load balancing among the application servers for this application. Multiple application servers can be specified as a comma separated list in "Application Server Address" field.
Enable Session Caching:
Select this option to enable sticky session feature when the application is running in clustered mode.
Uses Compression:
Enable compression for this application.
Uses Dynamic TCP Port:
If the application client requires connecting to random TCP ports on application server, select this option to allow all reserved and ephemeral ports to be opened for the specified application server. The port range can be restricted by creating a restricted port range list under RESOURCES->RESTRICTED PORT RANGE.
Cyberoam SSL VPN User Guide
Uses Dynamic UDP Port:
If the application client requires connecting to random UDP ports on application server, select this option to allow all reserved and ephemeral ports to be opened for the specified application server. The port range can be restricted by creating a restricted port range list under RESOURCES->RESTRICTED PORT RANGE.
Protocol:
Select application protocol TCP or UDP from the list.
Chained Application
: Select if the application exists behind a remote VPN gateway and is available over a site-to-site connection.
Remote Chained Server Name:
In case of chained application, enter hostname/IP address of remote VPN gateway.
You can add this application to an Application Group by clicking on the Add Application to
Application Group
link. Please see the Add Application to Application Group section that follows for more information.
Click Submit to create the application or click Reset to clear all data from this screen.
A success message confirms that the application is created.
NOTE
If the applications are created by putting the host name (FQDN) or the IP address of the server in
Application Address and if one of the applications requires a dynamic port, then access of the applications may give erroneous results. Thus while registering the applications, either use the host name (FQDN) or the
IP address in Application Address consistently. (It is recommended to register the applications, using the host name).
Application Types
Application type
FILESHARE
FTP
Description
File Share services - Provides secure access to shared remote folder to the users.
File Transfer Protocol services – Allows users to exchange files and perform various file management operations
SSH
TELNET
Secure Socket Shell services – Allows users to execute commands/programs in a remote machine. SSH provides strong authentication and secure channel for remote access.
Terminal Emulation services – Allows users to log on to a remote computer and execute programs/commands.
Network access the remote desktop. At any given point of time, there can be only one active VNC session.
WEB Web services – Provides secure access to Intranet and
Outlook Web Access
Cyberoam SSL VPN User Guide
WTS
OTHERS
Windows Terminal Server – Provides Windows desktop interface on the terminals that don’t have these capabilities.
The users can access Windows-based applications through this interface. Unlike VNC, any number of WTS clients can be active at a given point of time.
Any supported service not of the types described above
Auto Configuration of Standard Applications
On the Create Application screen, click on Auto Configuration of Standard Applications link. The defined IP ranges appear on the screen in the Select IP Range list. Please see the RESOURCES -
LAN IP RANGE section later in this manual for additional information on defining IP ranges.
Click on a range in the list. The available IP addresses in the selected range appear in the Select
IP Address list on the opposite side of the screen.
Screen – Auto Configuration of Standard Applications
Click on an IP Address in the list. The standard applications running on the machine appear on the screen.
Click on the radio button for the application you want to configure and click Select or click Cancel to abort. The applications that have been already configured are not available for selection.
Cyberoam SSL VPN User Guide
The Create Application screen appears.
Type the application name in the Application Name field.
Update the other details as required. Please see the Create Application section above for additional information.
Click Submit to create the application or click Reset to clear all data from this screen.
A success message confirms that the application is created.
NOTE
It may take few seconds to locate and list the IP addresses and applications.
In the VPN management console, click Access Management > Applications.
Click on the check box for the application you want to edit and click Modify. The Modify
Application screen appears.
Modify application details as needed. Refer to Create Application section while making the entries.
Modify Application Groups by clicking on the Add/Delete Application Group to Application
(please see the Add Application to Application Group section that follows).
Click Submit to save changes or click Reset to cancel the changes made.
In the Applications screen described above, click on the box for the Application(s) you want to delete. To select all applications, click on the Check all check boxes below the table.
Click Delete to delete the selected application(s).
When prompted for deletion confirmation, click OK to delete the application(s) or click Cancel to abort.
4. Add Application to Application Group
An administrator can organize applications into Application Groups. Please see the next section for more information on defining Application Groups. The Application Groups must be created before you can add Applications to Application Groups.
In either the Create Application screen or the Modify Application screen, click on the Add/Delete
Application Group to Application link. The Add/Delete Application Group to Application screen
appears
Cyberoam SSL VPN User Guide
Screen – Add Application Group to Application
To add the Application to HS Application Groups, select the HS Application Group(s) in the HS
Application Groups
table to which this application should belong, and click Add. The selected
Application Group(s) move from HS Application Groups table to the Application Groups table on the opposite side of the screen.
To add the Application to BA Application Groups, select the BA Application Group(s) in the BA
Application Groups
table to which this application should belong, and click Add. The selected
Application Group(s) move from BA Application Groups table to the Application Groups table on the opposite side of the screen.
Click Submit to update the list of selected Application Groups or click Cancel to abort.
The Application Group name(s) will be listed in the Selected Application Groups list on this application’s Create Application and Modify Application screens.
NOTE
Subscription to Application Groups is not applied until after you have clicked the Submit button on the
Create Application or the Modify Application screen.
Application Groups
Application Groups allow you to organize applications on the basis of function, logistics or any criteria that suits your organization. VPN Administrator can create two types of Application Groups:
• HS Application Group
• BA Application Group
The registered applications can be added to multiple Application Groups of any type. The User
Groups and Application Groups make it easier to administer access controls. When creating
Access Control Lists, the BA User Groups can be assigned only BA Application Groups whereas the HS User Groups can be assigned both BA and HS Application Groups.
Cyberoam SSL VPN User Guide
1. Create Application Group
In the VPN management console, click Access Management > Application Groups. The Create
Application Group screen appears. Click Add.
Screen – Create Application Group
Type the group name in the Application Group Name field.
To create a HS Application Group, click on the check box for HS. To create a BA Application
Group
, leave it empty.
Click on the Select Applications link to add applications to this group (see the next section Add
Applications to Group for more information).
Click Submit to create the Application group or click Reset to clear all data from this screen.
A success message confirms that the Application Group has been created.
2. Add Applications to Group
When creating an Application Group, you can add applications to it using these steps:
On the Create Application Group screen, click on the Select Applications link. The Add/Delete
Applications to/from Application Group screen appears.
Screen – Add Application to Application Group
Cyberoam SSL VPN User Guide
Select the applications in the Applications table that you want to apply to this group and click Add.
The selected applications move from the Applications table to the Selected Applications table on the opposite side of the screen.
Click Submit to select the applications for this group, or click Cancel to abort.
The popup window will close and the name of the applications will appear in the Selected
Applications
box on the Create Application Group page.
Click Submit to save changes or click Reset to remove all data from the screen.
NOTE
Changes to Application Groups are not applied until after you have clicked the Submit button on the Create
Application Group or the Modify Application Group screen.
3. Modify Application Group
In the VPN management console, expand Access Management > Application Groups. The
Modify Application Group screen appears.
Screen – Application Group
Type the Application Group name in the Search Applications field. If entering multiple names, separate names with a comma. Type [*] to view all Application Group names.
Click Show to view the search results.
Click on the check box for the Application Group you want to edit and click Modify. The Modify
Application Group screen appears.
Cyberoam SSL VPN User Guide
Screen – Modify Application Group
To add application(s) to the group, select names from the Applications table and click Add.
Added applications will be listed in the Selected Applications table.
To delete applications from the Application Group, select applications from the Selected
Applications
table and click Delete. The applications will return to the Applications table on the opposite side of the screen.
Click Submit to update the list of applications for this group or click Cancel to abort.
4. Delete Application Group
When in the Application Group screen, click on the checkbox for the Application Group(s) you want to delete. To select all Application Groups, click on the Check all checkbox below the table.
Click Delete to delete the selected Application Group(s).
When prompted for deletion confirmation, click OK to delete the group(s) or click Cancel to abort.
Access Control
Access Controls manage the availability of services to users in accordance with corporate policies.
Access Controls are specified for User Groups. A User Group is assigned one or more Application
Groups as needed. This gives the Users in the User Groups access to Applications in the assigned
Application Groups. When creating Access Control Lists, Access Filters can be applied for imposing time-restrictions on access to applications.
Access Controls can be created for Native, LDAP/ADS, and RADIUS User Groups. The Native
User Groups include the default User Groups, and all other HS and BA User Groups created by
VPN Administrator. Please see the User Group section for more information on User Groups.
The Access Control Lists for BA User Groups, LDAP/ADS User Groups, and
DEFAULT_RADIUS_USER_GROUP can include only BA Application Groups. The Access Control
Lists of HS User Group can include both BA and HS Application Groups.
When a user logs on, the Access Control Lists specified for the User Groups to which he belongs are activated so that the user can have access to permitted applications.
Local
VPN User
Local
Group
Application
Groups
Cyberoam SSL VPN User Guide
Active Directory
VPN User
AD Group
NOTE
When a High Security User logs on with Certificate and Password, the Access Control Lists specified for the subscribed HS Users Groups are activated. And when he/she logs on with Login ID and Password, the
Access Control Lists specified for the subscribed BA User Groups are activated.
1. Create Access Control
In the VPN management console, click Access Management and then choose Access Controls.
Click on the Add button.
The following default groups can be used for authorization when using local database (Native):
DEFAULT_USER_GROUP: All users and groups
SYSTEM: All Security Officers and administrators.
DEFAULT_BA_USER_GROUP: All users authenticating with basic username/password/token.
The following default group can be used for authorization when using AD/LDAP server:
All Groups: All groups exiting on Ad/LDAP server. In this case the application group would be available to any user authorized by AD/LDAP server.
The following default group is used for authorization when using RADIUS server:
DEFAULT_RADIUS_USER_GROUP: All users authenticated and authorized by RADIUS server.
Select the authorization server to fetch the group list. Select "Native" to use the VPN local database groups or dropdown the list to select a previously configured authentication server.
Click on the Select User Group drop-down arrow and select the User Group from the list.
Cyberoam SSL VPN User Guide
Screen – Create Access Control
Click in the check box for the Application Group (Application Group column) to which you want to apply access control (you may select multiple groups at one time). The Application Groups already assigned to a User Group are not shown in the list. Only BA Application Groups are shown in the list for BA, AD/LDAP, and RADIUS User Groups.
Click on the Access Filter drop-down arrow and select the access filter you wish to assign for the
Application Group in the same row. The users belonging to the selected User Group can now access the applications in the Application Group during the time slot provided by the access filter.
Click Submit to create access control or click Reset to clear all data from the screen.
A success message confirms that the access control is created.
2. Edit Access Control
In the VPN management console, click Access Management > Access Controls.
Type the access control name in the Search Access Control field. If entering multiple names, separate names with a comma. Type [*] to view all access control names.
Click Show to view the search results.
Click on the check box for the access control you want to edit.
Click on the Access Filter drop-down arrow for the access control(s), and edit the filter data.
Click Modify to update the access control(s). You can modify multiple access controls at the same time.
3. Delete Access Control
When in the Edit Access Control screen, click on the check box for the access control(s) you want to delete.
Click Delete to delete the selected access control(s).
When prompted for deletion confirmation, click OK to delete the access control(s) or click Cancel to abort.
Cyberoam SSL VPN User Guide
Endpoint Policy Management
Cyberoam SSL VPN has increased productivity for today’s enterprise by enabling more users to gain wider access by virtually connecting to private networks. But while broader access clearly enhances productivity, it also inherently widens network exposure to uncontrolled environments.
For Example: If a remote client machine is infected with virus/worms/Trojans/spy-wares, this unwanted traffic is also sent to private network over secured connection. To effectively control these risks, it is no longer enough to manage access by user identity alone. The safety of the user’s end point environment must also be ensured, and enforce access policy based upon solid end point protection.
Host Scan policies enable scanning the endpoints for specified 3rd party products or information.
With Cyberoam SSL VPN you can create following type of policies:
• MAC Address based
• IP Address based
These policies can be then linked with the security profiles described in later section (Device
Profile Management).
NOTE
Endpoint Security is a licensable option on top of Cyberoam SSL VPN. You have to purchase a valid
Endpoint License in order to enable this feature within Cyberoam SSL VPN.
Endpoint Security is disabled for Security officers and Administrators.
Screen – Endpoint Security
Create Host scan Policy
On the VPN management console, expand Endpoint Management and then choose Host Scan
Policies
. Click on the Add button.
Cyberoam SSL VPN User Guide
Screen – Create Policy
Policy Name:
Policy identifier.
Policy Type:
Select Policy Type.
Policy Description:
Enter Policy description.
Sub Policies:
To add sub policy click on the link under Sub-policies. Please see the Add Product
Policy
section that follows for more information.
Sub Policy Copy:
Click on the Copy under Sub-policies to copy Sub-policy and provide name for the policy on the screen that follows; click Submit to add a copy of the sub-policy.
Screen – Copy Policy with name
Sub Policy Edit:
Select a sub-policy and click Edit to edit sub-policy. Please see the Edit
Product Policy
section that follows for more information.
Sub Policy Delete:
Select a sub-policy and click Delete to delete sub-policy.
Remediation:
Check this box If this policy fails to show remediation information/message to user and type in the appropriate message.
Click Submit to create the policy or click Cancel to clear all data from this screen.
A success message confirms that the policy is created.
Cyberoam SSL VPN User Guide
On the VPN management console, expand Endpoint Management > Host Scan Policies.
Type the policy name in the Search Policies field. If entering multiple names, separate names with a comma. Type [*] to view all policy names.
Click Show to view the search results.
Click on the check box for the policy you want to edit and click Modify. The Modify Policy screen appears.
Modify policy details as needed. Refer to Create Policy section while making the entries.
Click Submit to save changes or click Cancel to cancel the changes made.
In the Edit Policy screen described above, click on the box for the Policies you want to delete. To select all policies, click on the Check all check boxes below the table.
Click Delete to delete the selected policies.
When prompted for deletion confirmation, click OK to delete the policies or click Cancel to abort.
3. Add Product Policy
Cyberoam SSL VPN Administrator can create following type of product Policies: Antivirus,
Antispyware,
Firewall, MAC Address and IP Address.
The link under Sub-policy on Create Policy screen automatically changes on the basis of Policy
Type selection. Considering Antivirus policy type is selected. In the Create Policy screen or the
Modify Policy screen, click on the Add Antivirus Product Policy link. The Add Antivirus Product
Policy screen appears.
Cyberoam SSL VPN User Guide
Screen – Add Antivirus Product Policy
Antivirus Policy Name:
Antivirus Policy identifier.
Antivirus Vendor:
Select Antivirus Vendor Name from the list.
Product Name:
Select Product Name from the list. This list populates on the basis of Antivirus
Vendor Name selection.
Select Version:
Select version and operator from the list. This version list populates on the basis of Product Name selection.
Product up to date:
Check this to check if product is up to date or not. Enter appropriate message in the text box that follows that you want to display to user in case user machine does not comply with this attribute.
Virus definition update check:
Check this to check if product virus definition is up to date or not.
Enter number of days/weeks that indicates that your virus definitions should not be older then configured number of days/weeks. Enter appropriate message in the text box that follows that you want to display to user in case user machine does not comply with this attribute.
Last scan date check:
Check this to check if last system scan has happened in configured number of days/weeks. Enter number of days/weeks that indicates that your last system scan should not be more then configured number of days/weeks. Enter appropriate message in the text
Cyberoam SSL VPN User Guide box that follows that you want to display to user in case user machine does not comply with this attribute.
Real Time Protection Enabled:
Check this to check if Real Time Protection for the product is enabled or not. Enter appropriate message in the text box that follows that you want to display to user in case user machine does not comply with this attribute.
Click Submit to save changes or click Cancel to cancel the changes made.
A success message confirms that the policy is created.
NOTE
Policy for the Antispyware and Firewall products can be created in the same manner as Antivirus product policy.
Now considering MAC Address policy type is selected. In the Create Policy screen or the Modify
Policy screen, click on the Add MAC Address Policy link. The Add MAC Address Policy screen appears.
Screen – Add MAC Address Policy
MAC Address Policy Name:
Enter name of Policy.
Allow/Block:
Select one if you want to allow/block any of the specified MAC Address.
MAC Addresses:
Click on Add button to add MAC Addresses. Following screen appears.
Cyberoam SSL VPN User Guide
Screen – Add MAC Address
Click on Submit, the MAC address will appear on previous page under MAC Addresses.
Click Submit on previous page to save changes or click Reset to reset the changes made.
MAC policy will appear on Create Policy page.
NOTE
Policy for the IP Address can be created in the same manner as MAC Address policy.
4. Edit Product Policy
In the Modify Policy screen, select a Sub-policy and click on the Edit. The Edit Product Policy screen appears.
Modify policy details as needed. Refer to Add Product Policy section while making the entries.
Click Submit to save changes or click Reset to cancel the changes made.
NOTE
Policies for the Antispyware, Firewall, MAC Address and IP Address type can be modified in the same manner as Antivirus product policy.
Device Profiles
Device Profile is a notion to discover security trust level of a connecting device and then authorize application access to the device. Device profile is a set of Host Scan policies and an access control list.
Device Profiles overrides (or say restricts) the applications access over the applications in the
Application Groups. VPN Administrator can create three types of Security Profiles:
Cyberoam SSL VPN User Guide
VPN Administrator can create only one Quarantine Profile and Mandatory Profile and multiple
Normal Profiles.
Mandatory Profile
This is a system profile, which contains a subset of policies that must be satisfied by all connecting endpoints before the user can login into VPN. Using mandatory profile, administrators can enforce that the connecting endpoint must comply with certain requirements. An example of Mandatory
Profile would be enforcing login using company laptops/desktops only from certain branch office only. Only one mandatory profile is allowed. If the endpoint machine fails any of the policies of
Mandatory Profile, the user is denied login into VPN. Appropriate remediation information is sent to the user.
A normal device profile policy must exist before a mandatory profile can be created. Mandatory profile does not contain any access list as it will only enforce the selected host scan policies on all devices.
Quarantine Profile
This profile, when present, will be used for endpoints which fail to fall under any other profiles. This is an optional system profile which does not contain any policies but just list of application which the user can access if the endpoint falls in this profile. If no quarantine profile exists and the user does not satisfy any other profile, then user is denied login into VPN.
A normal device profile policy must exist before a quarantine profile can be created. A Quarantine profile does not contain any Host Scan policy list as it is a fallback, no-scan profile.
On the VPN management console, expand Endpoint Management > Device Profiles. Click Add to create a new profile.
Profile Name:
Profile identifier.
Security Level:
Security Trust Level Identifier. Lower value means higher security trust level. An endpoint is always scanned again descending order of security trust level.
Mandatory Profile:
To create Mandatory Profile, click on the check box for Mandatory Profile.
If Mandatory Profile is already created then this field will be disabled. You can create only one
Mandatory Profile.
Quarantine Profile:
To create Quarantine Profile, click on the check box for Quarantine
Profile
. If Quarantine Profile is already created then this field will be disabled. Only one
Quarantine Profile can be created. The Endpoint machine which fails EPS scanning will fall into this profile.
Profile Description:
Enter Profile description.
Cyberoam SSL VPN User Guide
Click on the Add Policies to Profile link to add policies to this profile (see the next section Add
Policies to Profile for more information). The Policies that are added here must be satisfied by the
End Point Devices to fall in this Device Profile.
Click on the Block Applications to Profile link to block applications to this profile (see the next section Block Applications to Profile for more information). By default, all the applications are allowed to users. The applications added here will be blocked if the user falls into this Device
Profile.
Screen – Create Profile
Browser Cache Settings:
When enabled VPN will cleanup cache created by browser or other components after logout from VPN.
• Clear Browser Cache - Delete temporary internet files created by browser
• Clear Cookies - Delete stored browser cookies
• Clear Browsing History - Delete history of visited links
Cyberoam SSL VPN User Guide
• Clear Typed URLs - Delete history of URLs typed by user
• Clear Desktop Run History - Delete the command executed by user from Run menu item of start menu in Windows.
• Clear Recent File History - Delete the history created by Windows for recently opened files
• Clear Recycle Bin Contents - Delete all data in recycle bin
Data Protection Settings:
If enabled, on a device falling under this profile, access to clipboard will be disabled to the user and applications running on the endpoint.
Click Submit to create the Security Profile or click Reset to clear all data from this screen.
A success message confirms that the Security Profile has been created.
2. Add Policies to Profile
When creating a Device Profile, you can add policies to it using these steps:
On the Create Profile screen, click on the Add Policies to Profile link. The Add Policy to Profile screen appears.
Screen – Add Policies to Profile
Select the policies in the left table that you want to apply to this profile and click Add. The selected policies move from the left table to the right side table on the screen.
Click Submit to select the policies for this profile, or click Cancel to abort.
The popup window will close and the name of the policies will appear in the Policies box on the
Create Profile
page.
Click Submit to save changes or click Reset to remove all data from the screen.
NOTE
Changes to Profile are not applied until after you have clicked the Submit button on the Create Profile or the
Modify Profile screen.
Cyberoam SSL VPN User Guide
3. Block Applications to Profile
When creating a Device Profile, you can add applications to be blocked using these steps:
On the Create Profile screen, click on the Block Applications to Profile link. The Add/Block
Applications to/from Profile screen appears.
Screen – Add Applications to/from Profile
Select the applications in the Applications table that you want to block and click Add. The selected applications move from the Applications table on the left side to the Selected Applications table on the right side of the screen.
Click Submit to select the applications for this profile, or click Cancel to abort.
The popup window will close and the name of the applications will appear in the Applications box on the Create Profile page.
Click Submit to save changes or click Cancel to remove all data from the screen.
NOTE
Changes to Profile are not applied until after you have clicked the Submit button on the Create Profile or the
Modify Profile screen.
On the VPN management console, expand Endpoint Management > Device Profiles.
Cyberoam SSL VPN User Guide
Screen – Device Profiles
Type the profile name in the Search Profiles field. If entering multiple names, separate names with a comma. Type [*] to view all profile names.
Click Show to view the search results.
Click on the check box for the profile you want to edit and click Modify. The Modify Profile screen appears.
Modify profile details as needed. Refer to Create Profile section while making the entries.
Click Modify to save changes or click Cancel to cancel the changes made.
In the Edit Profile screen described above, click on the box for the Profiles you want to delete. To select all profiles, click on the Check all check box below the table.
Click Delete to delete the selected profiles.
When prompted for deletion confirmation, click OK to delete the profiles or click Cancel to abort.
Resources
Lan IP Range
LAN IP Range works in conjunction with Auto Configuration of Standard Applications (see the
Application Management section earlier in this chapter) and makes it possible to configure standard services running on the corporate network. Cyberoam SSL VPN can automatically detect and list the services running on machines within a given subnet range. You can select a service from the list and register it with Cyberoam SSL VPN.
1. Create IP Range
In the VPN management console, click Resources > LAN IP Range. The Create IP Range screen appears.
Cyberoam SSL VPN User Guide
Screen – LAN IP Range
Type the first IP address in the range in the Start IP Address field.
Type the last IP address in the range in the End IP Address field.
NOTE
To specify single address, enter the same IP in the Start IP Address and End IP Address fields. The IP range cannot exceed 100 hosts.
Type the subnet mask in the Subnet Mask field.
Type the range description in the Description field.
Click Submit to include the new range in Auto Configuration of Standard Applications or click
Cancel
to clear all data from this screen.
The new range is added.
IMPORTANT
The defined IP ranges are displayed in the Select IP Range list when you opt for Auto Configuration of
Standard Application on Create Application screen.
2. Edit IP Range
In the LAN IP Range screen, click on the check box for the IP Range you want to edit and click
Modify
. The Modify IP Range screen appears.
Modify the details as needed.
Click Submit to save changes or click Cancel to abort.
Cyberoam SSL VPN User Guide
3. Delete IP Range
Click on the check box for the IP range(s) you want to delete. To select all, click on the Check all box below the table.
Click Delete to delete the selected range(s).
When prompted for deletion confirmation, click OK to delete the range(s) or click Cancel to abort.
Remote Chain Certificate
If you have installed more than one VPN server in different locations, you can access all servers through one master VPN server. This feature is called Chained VPN. For a Chained VPN set up you need to create a machine user. After creating a Machine user, you will get a machine user certificate. After uploading your root certificate and Machine user certificate (.PFX) to your master
VPN server, you will get all features configured in slave server through master VPN server.
To upload Remote Certificate follow the steps given below:
In the VPN management console, click Resources Æ Remote Chain Certificate. The Upload
Remote Server Parameter screen appears.
Screen – Remote Server Parameters
Type the password for the Machine user account created on the other VPN gateway in the
Password
field. It should be same as the Machine user PFX certificate's password.
Type the hostname of the other VPN gateway in Remote VPN Host Address field.
Provide CA certificate of the other VPN gateway.
Provide SSL certificate of the Machine user from other VPN Gateway. Certificate should be in PFX format.
Click Submit to upload server parameters.
Access Filters
Access Filters are time-based restrictions that are associated with VPN access control policies.
Cyberoam SSL VPN User Guide
Access Filters are applied to Access Control Lists to restrict user access to applications to specific times.
1. Create Access Filter
In the VPN management console, click Resources > Access Filters. Click Add to specify a new access filter.
Screen – Create Access Filter
Type the name for the filter in the Access Filter Name field.
Click on the Time Zone drop-down arrow and select your time zone from the list.
Set Start Time Hrs: and Min: by clicking on the drop-down arrows.
Set End Time Hrs: and Min: by clicking on the drop-down arrows.
Click Submit to create access filter or click on Reset to clear all data in the screen.
A success message confirms that the access filter is created.
2. Edit Access Filter
In the VPN management console, click Resources > Access Filters.
Type the access filter name in the Search Access Filter field. If entering multiple names, separate names with a comma. Type [*] to view all access filter names.
Click Show to view the search results.
Click on the check box for the access filter you want to edit and click Modify. The Modify Access
Filter screen appears.
Modify the access filter data as needed.
Click Submit to save changes or click Reset to clear all data from the screen. Click Cancel to abort.
Cyberoam SSL VPN User Guide
3. Delete Access Filter
When in the Edit Access Filter screen described above, click on the check box for the access filter(s) you want to delete. To select all access filters, click on the Check all box below the table.
Click Delete to delete the selected access filter(s). If multiple access filters are selected, then all will be deleted.
When prompted for deletion confirmation, click OK to delete the filter(s) or click Cancel to abort.
Restricted Ports
A dynamic port application by definition allows access to random ports on the server. Hence, if a dynamic port application is configured on a host, then it is a good security practice to specify ports that should not be allowed access on that machine.
In the VPN management console, click Resources Æ Restricted Ports. The Edit Restricted Ports screen appears.
Screen – Edit Restricted Ports
Click on the Server Name drop-down arrow and select the server name (on which the dynamic port application is located) from the list.
Click on the Protocol drop-down arrow and select protocol TCP or UDP.
Type the port number(s) in the Ports field which you want to block for this application server.
Use a comma to separate multiple port numbers.
Click Submit to save changes or click Reset to clear all data from this screen.
Host Configuration
The Host Configuration section provides a number of VPN Server configuration tasks.
Network Configuration
Network Configuration can be performed from within the management console as well as during bootstrap stage. IP address, DNS and host file modifications can be done from management console under Host Configuration Æ Network Configuration. It is also possible to create host
file entries on VPN gateway to resolve the names.
Cyberoam SSL VPN User Guide
Screen – Network Configuration
Route Configuration
The VPN Server’s routing table can be configured from with the VPN management console under
Host Configuration Æ Route Configuration. Static routes can be added and deleted from the server.
To add a route click the Add button in the console.
Screen – Create Route
Route for a Network -
Add route entry for a network segment.
Route for a Host -
Add route entry for a host.
Persistent Route -
If selected, the route entry will be persistent across reboots.
Destination -
Target network/host.
Gateway -
Gateway to reach target.
Cyberoam SSL VPN User Guide
Netmask -
Subnet mask. For host routes, it should be 255.255.255.255.
Metric -
Cost of the route. The field can be left blank.
Select Interface -
Routing Network Interface
Click Submit to complete the route configuration.
SMTP Server
Enter your SMTP server details for email integration. This allows the VPN server to send enrollment emails to the end-users.
In the VPN management console, expand Host Configuration and select SMTP Server. The
SMTP Server Details screen appears.
Screen – SMTP Server Details
Type the new SMTP server name in the New SMTP Server Name field.
NOTE
SMTP server should allow anonymous email forwarding.
Type the SMTP server port number in the SMTP Server Port field.
Click Submit to save or click Reset to clear all data from the screen.
Client Logout Time
If the client machine has been inactive for a long time, it is good security practice to automatically log out the user. The inactivity period for automatic logout can be configured on the server.
In the VPN management console, click Host Configuration > Client Logout Time. The Client
Logout Time screen appears.
Cyberoam SSL VPN User Guide
Screen – Client Logout Time
Type the desired logout time (in minutes) in the New Logout Time field. Time must be between 1 and 60 minutes (default logout time is 5 minutes).
Click Submit to save.
Password Expiry Time
Administrators can set Password Expiry time of native users.
In the VPN management console, select Host ConfigurationÆPassword Expiry Time.
Screen – Password Expiry Time
Enter the New Password Expiry Time (in Days).
Click Submit.
Database Password
IMPORTANT
VPN must be in Configuration State before you change the Database Password. Database Password compliance is governed by the database software and not by VPN.
In the VPN management console, select Host Configuration Æ Database Password. The
Database Password screen appears.
Cyberoam SSL VPN User Guide
Screen – Database Password
Click on the Database drop-down arrow and select the database you want to modify.
The database user name is automatically displayed in the Database User field.
Type the old password in the Old Password field.
Type the new password in the New Password field.
Retype the new password in the Re Enter Password field.
Click Submit to save or click Reset to clear all data in the screen.
A success message confirms that database password has changed.
Enable / Disable SSH
SSH is used to securely access VPN. By default, a SSH daemon is configured to run on the VPN application. The daemon can be in one of two states:
• Running (enable SSH)
• Stopped (disable SSH)
To change the State of SSH in Cyberoam SSL VPN:
In the VPN management console, click Host Configuration Æ SSH Configuration. The Change
SSH Server State screen appears.
Screen – Enable/Diasble SSH
To stop the SSH daemon on the server, click on the Stop SSH hyperlink. SSH will be disabled.
Cyberoam SSL VPN User Guide
To start the SSH daemon on the server, click on the Run SSH hyperlink. SSH will be enabled.
NOTE
SSH default state is enabled.
Host Maintenance
Backup and Restore
Administrators can back up the VPN configuration and restore the same in case of a disaster.
The backup file is stored on administrator’s desktop which can be uploaded back to gateway for restoration.
There are two backup options available: Backup User Settings only and Backup Whole System.
Screen – Backup and Restore
1. Backup User Settings Only
This backup will export the settings configured by administrator to the desktop.
This backup enables administrators to regularly back the settings and use them in case the administrator needs to revert back to old state or the old system has to be replicated to a new one.
This backup includes the configurations done under "Access Management" and "Device Profiling" sections.
This backup does not include any certificate and system information hence is portable across various VPN gateways located at difference locations.
NOTE
This backup does not include any network, system, installed license, security officers, administrators and certificate user information.
Cyberoam SSL VPN User Guide
2. Backup Whole System
This backup exports everything including the certificates related configuration. This backup is useful to rebuild a whole system by reinstalling the firmware and then restoring it to the last backed-up state again.
This back includes:
• Configuration under "Access Management"
• Configuration under "Device Profiling"
• SSL, CA and all system certificates
• Administrator/User Certificates
NOTE
This backup does not include information related to network and installed license.
It is important to make sure the hostname of the system should be set to same as what it was when the backup was taken from the system. If the hostname is different, an error will be prompted to the administrator. It will also give the name of the expected hostname.
A freshly installed system can be restored using this backup at the time of preboot configuration.
3. Restore User Settings
Select the user settings backup file from desktop to restore the configuration of the VPN.
View upgrade logs from VPN.
Upgrade License
This page provides a summary of the current license information on the VPN gateway.
Screen – Backup and Restore
Cyberoam SSL VPN User Guide
There are currently three types of licenses for Cyberoam SSL VPN:
• System Default: Evaluation license available at the time of installation.
• Evaluation: Time restricted evaluation license.
• Production: Full non-expiring license.
EPS Status:
Endpoint security feature availability.
Concurrent Users
: Maximum concurrent users allowed.
Current Usage:
Current no. of users logged into VPN.
Expiry Date:
Date on which the license will expire.
You can update your license using the Upgrade License option on the Host Maintenance Æ
Upgrade License
page.
Screen – Upgrade License
IMPORTANT
The server must be in Configuration State before you update the License Key.
If you have purchased a license for Cyberoam SSL VPN, you need to email the product key shown on the Upgrade License page from your VPN Server to [email protected]
. This key is a unique key generated from the hardware that the VPN is installed on. Cyberoam Licensing department will send your valid VPN license key back to the designated contact email address.
Upgrade Firmware
Cyberoam release both bug fixes and feature updates through patches available from the
Cyberoam Website http://www.cyberoam.com
.
To install a patch and upgrade the VPN software version use the Upgrade Firmware option under
Host Maintenance
. Upgrade will start after complete uploading of the file. During upgrade process the VPN service will be restarted. All active users will be disconnected. Login again and check upgrade logs by clicking on "View Log" button.
Provide the path of the patch file in Upload Patch File field.
Cyberoam SSL VPN User Guide
Screen – Upgrade Firmware
Click Submit to upgrade Appliance.
Click View Log to see upgrade history.
IMPORTANT
The server must be in Configuration State before you update the Firmware.
Shutdown / Restart
Shutdown or Restart the VPN gateway from the management console.
Monitoring & Reporting
Activity Logs
The activity logs detail the remote user’s activity on the VPN gateway.
The Activity Log displays:
• Application accessed
• Mac ID of the Client Machine
• WAN IP address
• Application Port
• Login Date and Time
Cyberoam SSL VPN User Guide
Screen – Activity Logs
VPN server automatically archives the log files when the size of a file increases beyond 2 MB.
VPN Gateway can have 5 archived files and 1 running file.
Clear Logs:
Deletes the log entries permanently from VPN Gateway.
Download Logs:
Download the active log file on desktop in CSV format. A maximum of 30,000 latest log entries can be downloaded.
User Logs
The User Log provides information in brief about users who logged in.
The User Log table displays:
Screen – User Logs
• User name
• Client IP
• User login date/time
• Logout date / time
Cyberoam SSL VPN User Guide
Clear Logs:
Deletes the log entries permanently from VPN Gateway.
Download Logs:
Download the active log file on desktop in CSV format. A maximum of 30,000 latest log entries can be downloaded.
Admin Logs
All the administration changes are logged and viewable through the management console. The logs are achieved on the gateway with capacity to store more than 200,000 log entries.
End Point Security Log
The End Point Security Log provides information in brief about user device profile activity.
Screen – End Point Security Logs
The End Point Security Log table displays:
• User name
• User login date/time
To see more details of end point machine scan click on Details link. The End Point Security
Detailed Log screen appears.
Screen – End Point Security Detailed Logs
Click Close Window to close detailed log screen.
Cyberoam SSL VPN User Guide
Chapter 6
Cyberoam SSL VPN User Guide
APPENDICES
Appendix A - Login Scripts
A Login Script is a batch file that contains a set of instructions. Login Scripts are executed when users log on to Cyberoam. Cyberoam SSL VPN supports two types of login scripts:
• Administrator Script - Cyberoam SSL VPN Administrator creates the Administrator Script.
Administrator Script is the same for all users and is executed when any user logs on.
• User Script - A User Login Script is specific to a user. All Certificate Authentication users can create a User Script and upload it to VPN. The User Script is executed after the Administrator script.
NOTE
Native Basic Authentication users, LDAP/ADS and RADIUS users cannot upload login scripts to Cyberoam
SSL VPN.
Upload Login Script
Right-click on the VPN icon on the systray and click Show. The Login screen appears.
In the Action menu, click Upload Script. The Upload script screen appears.
Screen – Upload Login Script
In the Open field, click Browse to search for the batch file or linux script file (or type file path and name).
Click on the Administrator Script check box if you want to upload an administrator script.
NOTE
Only a Security Officer or Administrator can upload Admin Scripts. For other users the Administrator Script field will be disabled.
Click Upload to upload the script.
A success message confirms that the script is uploaded.
Click Cancel to cancel the changes made and close the window.
Cyberoam SSL VPN User Guide
NOTE
The Upload Script option will be enabled only if the current server state (click Server State from Server
Configuration) is Run State.
Delete Login Script
Right-click on the VPN icon on the systray and click Show. The Login screen appears.
In the Action menu, click Delete Script. The Delete script screen appears.
Screen – Delete Login Script
Click on the Administrator Script check box if you want to delete an administrator script.
NOTE
Only a Security Officer or Administrator can Delete Admin Scripts. For other users the Administrator Script field will be disabled.
Click Yes to confirm the deletion. Otherwise click Cancel.
NOTE
The Delete Script option will be enabled only if the current server state (click Server State from Server
Configuration) is Run State.
Cyberoam SSL VPN User Guide
Appendix B - Terminology and Acronyms
Terminology
Access Control:
Allows access to the application in accordance to corporate policies. Access control can be applied to user and application groups.
Access Filter:
A time filter that can be applied to user(s) and/or application group(s) to provide access during a designated time.
Administrator:
A privileged user for managing users and services.
Application Group:
Applications can be grouped in accordance to policies or functional groups.
Further to that access filter can be applied to these groups.
Endpoint Policy:
Endpoint Policy is to define the security rules to be scanned for on End user machine in conjunction with Endpoint Profile.
Device Profile:
Device Profiles are used to organize applications on the basis of end user machine profile. Device Profiles overrides (or say restricts) the applications access over the applications in the Application Groups.
Basic Authentication:
A mechanism to authenticate user credentials using standard authentication protocols, such as LDAP, RADIUS, AD, etc.
Bootstrap:
A process for first time configuration of Cyberoam SSL VPN. In this process the first security officer (designated certification authority) is enrolled.
Certificate Authentication:
A mechanism to authenticate the user based on client Certificate. The
Certificate is issued to a power user during enrollment.
Security Officer (SO):
The most privileged user of the system. Only first security officer is responsible for bootstrapping the server and enrolling other security officer and administrators.
User Group:
Users can be grouped in accordance to policies or functional groups. Further to that access filter can be applied to these groups.
UAC:
The Universal Application Connector is an Active-X control that makes the applications you run using Cyberoam SSL VPN secure.
NOTE
The UAC works only with Internet Explorer version 6.0 and higher; it does not support other browsers.
Acronyms
ACL
ADS
CA
DNS
EPS
FQDN
FTP
HTTP
Access Control List
Active Directory Services
Certificate Authority
Domain Name Service
Endpoint Security
Fully Qualified Domain Name
File Transfer Protocol
Hypertext Transfer Protocol
UDP
URL
VPN
HTTPS
IP
IPSEC
LDAP
Secured Hypertext Transfer Protocol
Internet Protocol Security
Lightweight Directory Access Protocol
SMTP
SO
Simple Mail Transfer Protocol
Security Officer
SSH
SSL
Secure Shell
Secure Socket Layer
TCP
Transmission Control Protocol
UAC
Uniform Connector
User Datagram Protocol
Uniform Resource Locator
Virtual Private Network
Cyberoam SSL VPN User Guide
Appendix C - Supported Applications
Application Protocol Static/ Dynamic Port
Cyberoam SSL VPN User Guide
Remarks
Dynamic Kiosk
WINDOWS TERMINAL
SERVICE
TCP Static Kiosk.
Supports local printing and local resource sharing
PRINT SHARE
SAMBA SHARE
SMB SHARE/ NETBIOS
OVER TCP/IP
CITRIX ICA CLIENT
CITRIX ICA CLIENT
SQL SERVER
SQL MONITOR TOOL
MYSQL SERVER
ORACLE
TCP Static
TCP Static
TCP Static
TCP
UDP
TCP
TCP
TCP
TCP
Dynamic
Dynamic
Static
Static
Static
Static
LOTUS NOTES
TFTP
RADIUS SERVER
DNS SERVER
PC ANYWHERE
PC ANYWHERE DATA
TACACS
ORACLE SQL * NET
BOOT PS
TCP
TCP
TCP
TCP
TCP
Static
UDP Static
TCP Static
TCP Static
UDP Static
Static
Static
UDP Static
Static
Static
445
139
Kiosk
Kiosk
1494
1604
1433
1434
> 1023
>1023
3306
1521
1352
69
1812
53
53
5632
5631
49
66
67
BOOT PS
KERBEROS
UDP Static
UDP Static
Cyberoam SSL VPN User Guide
67
88
Exchange Server
DEC Endpoint
Resolution, also known as RPC Endpoint Mapper
TCP Static
Network Time Protocol-
NTP
TCP Static
Kerberos authentication TCP Static
LDAP to global catalog servers
REQUIRED FOR
WINDOWS LOGIN
TCP Static
TCP Dynamic
135
123
88
3268
1026
TCP Static 1863 Messenger service through Exchange
Download
Public link updated
The public link to your chat has been updated. You may view and manage your chat links after registration here.
Document public link
Advertisement
Key features
Secure remote access
Clientless and client-based access
Application-based VPN
Secure registration and enrollment
Centralized management console
Granular administrative roles
Frequently asked questions
Cyberoam SSL VPN is an application-based solution providing secure remote access to your applications and private network resources through a secure SSL connection. It allows you to access applications securely over the Internet without re-engineering.
The key components are the Cyberoam SSL VPN appliance, the Cyberoam SSL VPN Service, the Cyberoam SSL VPN Management Console, the Cyberoam SSL VPN Homepage, and the Cyberoam SSL VPN Client.
The VPN service has three states: Bootstrap, Configuration, and Run. The Bootstrap state is for initial system configuration, the Configuration state is for configuring VPN settings, and the Run state is for full functionality.
