Novell ACCESS MANAGER 3.1 SP2 - SSL VPN USER GUIDE... Manuale utente

Novell

www.novell.com

novdocx (en) 16 April 2010

AUTHORIZED DOCUMENTATION

Novell Access Manager 3.1 SP2 SSL VPN User Guide

Access Manager

3.1 SP2

June 11, 2010

SSL VPN User Guide

novdocx (en) 16 April 2010

Legal Notices

Novell, Inc., makes no representations or warranties with respect to the contents or use of this documentation, and

specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose.

Further, Novell, Inc., reserves the right to revise this publication and to make changes to its content, at any time,

without obligation to notify any person or entity of such revisions or changes.

Further, Novell, Inc., makes no representations or warranties with respect to any software, and specifically disclaims

any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc.,

reserves the right to make changes to any and all parts of Novell software, at any time, without any obligation to

notify any person or entity of such changes.

Any products or technical information provided under this Agreement may be subject to U.S. export controls and the

trade laws of other countries. You agree to comply with all export control regulations and to obtain any required

licenses or classification to export, re-export or import deliverables. You agree not to export or re-export to entities on

the current U.S. export exclusion lists or to any embargoed or terrorist countries as specified in the U.S. export laws.

You agree to not use deliverables for prohibited nuclear, missile, or chemical biological weaponry end uses. See the

Novell International Trade Services Web page (http://www.novell.com/info/exports/) for more information on

exporting Novell software. Novell assumes no responsibility for your failure to obtain any necessary export

approvals.

stored on a retrieval system, or transmitted without the express written consent of the publisher.

Novell, Inc.

404 Wyman Street, Suite 500

Waltham, MA 02451

U.S.A.

www.novell.com

Online Documentation: To access the latest online documentation for this and other Novell products, see

the Novell Documentation Web page (http://www.novell.com/documentation).

novdocx (en) 16 April 2010

Novell Trademarks

For Novell trademarks, see the Novell Trademark and Service Mark list (http://www.novell.com/company/legal/

trademarks/tmlist.html).

Third-Party Materials

All third-party trademarks are the property of their respective owners.

4Novell Access Manager 3.1 SP2 SSL VPN User Guide

novdocx (en) 16 April 2010

Contents 5

Contents

novdocx (en) 16 April 2010

About This Guide 7

1 Overview of SSL VPN 9

1.1 Access Modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

1.1.1 Kiosk Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

1.1.2 Enterprise Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

1.2 Client Machine Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

1.2.1 Linux Requirements. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

1.2.2 Macintosh Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

1.2.3 Windows Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

2 Accessing SSL VPN in Kiosk Mode 13

2.1 Accessing the SSL VPN User Portal . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

2.2 Switching from Kiosk Mode to Enterprise Mode. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

3 Accessing SSL VPN in Enterprise Mode 17

3.1 Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

3.2 Accessing SSL VPN When You Are an Admin or root User . . . . . . . . . . . . . . . . . . . . . . . . . . 17

3.3 Accessing SSL VPN as a Non-Admin User . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

3.4 Switching from Enterprise Mode to Kiosk Mode. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

3.5 Enabling the Sudo Command for Standard Users in the Mac OS . . . . . . . . . . . . . . . . . . . . . . 21

4 Accessing Published Citrix Applications through SSL VPN 23

4.1 Accessing Published Citrix Applications in Kiosk Mode. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23

4.2 Accessing Published Citrix Applications in Enterprise Mode . . . . . . . . . . . . . . . . . . . . . . . . . . 23

5 Using SSL VPN 25

5.1 Using the SSL VPN Home Page . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

5.2 Using the Policies Page . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

5.3 Configuring the Cleanup Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

5.4 Viewing SSL VPN Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28

5.5 Enabling Applications for SSL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

5.5.1 Enabling Linux Applications for SSL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

5.5.2 Enabling Macintosh Applications for SSL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30

5.5.3 Enabling Terminals for SSL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30

5.6 Logging Out of the Active SSL VPN Session. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30

5.7 Using the Sandbox Feature . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30

5.8 Error . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

5.9 Connecting after the Session Timeout Period . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

5.10 Downloading the Applet on Internet Explorer. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

6Novell Access Manager 3.1 SP2 SSL VPN User Guide

novdocx (en) 16 April 2010

A Error Messages 33

B Troubleshooting SSL VPN 51

B.1 SSL VPN Fails to Load If Firefox 3.0 Is Used on Vista 64-bit . . . . . . . . . . . . . . . . . . . . . . . . . 52

B.2 Error: Failed to Fetch CIC Policy from the Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52

B.3 Stability Issues when You Use a Firefox Browser on a Vista 64-Bit Machine . . . . . . . . . . . . . 52

B.4 Unable to Connect to SSL VPN Because of the OpenVPN Error . . . . . . . . . . . . . . . . . . . . . . 52

B.5 The SSL VPN Applet Fails to Download on a SLED 11 64-bit Machine . . . . . . . . . . . . . . . . . 53

B.6 Unable to Connect to SSL VPN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53

B.7 Unable to Connect to SSL VPN from the Same Internet Explorer Browser Session . . . . . . . . 53

B.8 The SSL VPN Connection Fails with an OpenVPN Connection Error . . . . . . . . . . . . . . . . . . . 54

B.9 The Browser Cache Is Not Cleared When Multiple Tabs Are Used in Vista . . . . . . . . . . . . . . 54

B.10 Failed to Connect to SSL VPN. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54

B.11 Mozilla Firefox Browser Displays an “X” Mark . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55

B.12 Applications Are Not Enabled from the Terminal after Running the su Command . . . . . . . . . 55

B.13 SSL VPN Session Disconnects after Approximately 10 Hours . . . . . . . . . . . . . . . . . . . . . . . . 55

B.14 Error: Failed to Download the SSLVPN Files from Gateway . . . . . . . . . . . . . . . . . . . . . . . . . . 55

B.15 Unable to Connect After the Previous Connection Ended Abruptly . . . . . . . . . . . . . . . . . . . . . 55

B.16 SSL VPN Client Displays the Nonsecure Items Dialog Box. . . . . . . . . . . . . . . . . . . . . . . . . . . 56

B.17 Clear Cache Option Retains Some Image Files in the Temporary Internet Folder . . . . . . . . . 56

B.18 SSL VPN Fails to Retrieve Help Pages When There Is an Error. . . . . . . . . . . . . . . . . . . . . . . 56

B.19 The Browser Becomes Non-Responsive If Clear Browser Private Data Is Repeatedly Clicked .

B.20 SSL VPN Issues with the Latest Versions of JRE 1.6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57

B.21 Unable to Access Protected HTTP Applications through a Safari Browser . . . . . . . . . . . . . . . 57

B.22 Linux Browser Issues in Kiosk Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57

B.23 Issues with the Intlclock Toolbar Application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58

B.24 Socks Client Logs Are Displayed under Service Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58

B.25 Connection Fails in SSL VPN If the Root User Password Is Not Set in Macintosh . . . . . . . . . 58

About This Guide 7

novdocx (en) 16 April 2010

About This Guide

This document is intended to help you understand and use the SSL VPN user portal. It contains the

following information:

Chapter 1, “Overview of SSL VPN,” on page 9

Chapter 2, “Accessing SSL VPN in Kiosk Mode,” on page 13

Chapter 3, “Accessing SSL VPN in Enterprise Mode,” on page 17

Chapter 4, “Accessing Published Citrix Applications through SSL VPN,” on page 23

Chapter 5, “Using SSL VPN,” on page 25

Appendix B, “Troubleshooting SSL VPN,” on page 51

Appendix A, “Error Messages,” on page 33

Audience

This guide is intended for Novell Access Manager SSL VPN end users.

Feedback

We want to hear your comments and suggestions about this manual and the other documentation

included with this product. Please use the User Comments feature at the bottom of each page of the

online documentation, or go to www.novell.com/documentation/feedback.html and enter your

comments there.

Documentation Updates

For the most recent version of the SSL VPN User Guide, visit the Novell Access Manager

Documentation Web site (http://www.novell.com/documentation/novellaccessmanager31).

Additional Documentation

Novell Access Manager 3.1 SP2 SSL VPN Server Guide

Novell Access Manager 3.1 SP2 Installation Guide

Novell Access Manager 3.1 SP2 Setup Guide

Novell Access Manager 3.1 SP2 Administration Console Guide

Novell Access Manager 3.1 SP2 Identity Server Guide

Novell Access Manager 3.1 SP2 Access Gateway Guide

Documentation Conventions

In Novell documentation, a greater-than symbol (>) is used to separate actions within a step and

items in a cross-reference path.

8Novell Access Manager 3.1 SP2 SSL VPN User Guide

novdocx (en) 16 April 2010

Overview of SSL VPN

novdocx (en) 16 April 2010

Overview of SSL VPN

The Novell Access Manager SSL VPN allows you to use a Web browser to access corporate

resources securely from a remote site. It uses a Secure Socket Layer (SSL) with a virtual private

connection (VPN). It is a clientless solution, and it eliminates the need to install or configure a VPN

client on your desktop or laptop. This gives you the flexibility to access the corporate resources from

a laptop, a home computer, or a Web browsing kiosk.

When you access the SSL VPN server through a Web browser, a Java applet or an ActiveX control is

installed on your machine after the successful connection. This encrypts the traffic passing through

the tunnel and sends it to the SSL VPN server.

This section describes the following features of SSL VPN:

Section 1.1, “Access Modes,” on page 9

Section 1.2, “Client Machine Requirements,” on page 10

1.1 Access Modes

The Novell SSL VPN uses both clientless and thin-client access methods. The clientless method is

called the Kiosk mode SSL VPN and the thin-client method is called the Enterprise mode SSL VPN.

Section 1.1.1, “Kiosk Mode,” on page 9

Section 1.1.2, “Enterprise Mode,” on page 10

1.1.1 Kiosk Mode

Kiosk mode is the usual choice for computers not controlled by the organization, such as home

computers and computers in Web-browsing kiosks. When you connect to SSL VPN in Kiosk mode,

only a limited set of applications are enabled for SSL.

Applications that were opened before the SSL VPN connection was established are not enabled for

SSL. You must manually enable the applications that were opened before the SSL VPN connection.

For more information, see Section 5.5, “Enabling Applications for SSL,” on page 29.

You are connected to SSL VPN in Kiosk mode if:

You do not have administrator rights or

root

privileges to the workstation, and you do not

know the credentials of the administrator or

root

user of the machine.

You have administrator rights or

root

privileges to the workstation, but you are required by the

system administrator to connect in Kiosk mode only.

For more information on using the Kiosk mode, see Chapter 2, “Accessing SSL VPN in Kiosk

Mode,” on page 13.

10 Novell Access Manager 3.1 SP2 SSL VPN User Guide

novdocx (en) 16 April 2010

1.1.2 Enterprise Mode

The Enterprise mode is the usual choice for computers that are controlled by the organization, such

as notebooks provided by the organization for employees.When you connect to SSL VPN in

Enterprise mode, all applications are enabled for SSL, regardless of whether they were opened

before or after connecting to the SSL VPN. This includes your desktop applications and toolbar

applications.

You are connected to SSL VPN in Enterprise mode if:

You are the administrator or

root

user of a workstation, if the system administrator has not

required you to connect in Kiosk mode only.

You are not the administrator or

root

user of a workstation, but you know the credentials of

the administrator or

root

user.

If someone with administrator access has preinstalled the SSL VPN thin-client components on

your machine, you can connect to SSL VPN in Enterprise mode. For more information on

preinstalling the thin-client components, see “Preinstalling the SSL VPN Client Components”

in the Novell Access Manager 3.1 SP2 SSL VPN Server GuideNovell Access Manager 3.1 SP2

SSL VPN Server Guide.

For more information on using Enterprise mode, see Chapter 3, “Accessing SSL VPN in Enterprise

Mode,” on page 17.

1.2 Client Machine Requirements

This section explains the operating software and browser requirements for the client machine, in

order to access the SSL VPN user portal.

Section 1.2.1, “Linux Requirements,” on page 10

Section 1.2.2, “Macintosh Requirements,” on page 11

Section 1.2.3, “Windows Requirements,” on page 11

1.2.1 Linux Requirements

When you access the SSL VPN user portal in the Linux a Java applet is downloaded to the client

machine. The following table lists the supported versions of operating software and browsers for the

Linux environment:

Table 1-1 Supported Linux Configurations

Component Requirement

Operating Systems SUSE Linux Enterprise Desktop (SLED) 10.0 and SLED 11 are supported for

32-bit and 64-bit platforms.

OpenSSL 0.9.7 or higher. If your OpenSSL version is higher than 0.9.7, you must install

an OpenSSL 0.9.7 compatible library.

Shells bash

xterm

Altri manuali per ACCESS MANAGER 3.1 SP2 - SSL VPN USER GUIDE...

Questo manuale è adatto per i seguenti modelli

Indice

Altri manuali Novell Software

Novell

Novell OPEN ENTERPRISE SERVER 2.0 SP2 - DOMAIN SERVICE FOR... Manuale di istruzioni

Novell

Novell LINUX ENTERPRISE DESKTOP 10 SP2 Manuale utente

Novell

Novell INTELLISYNC MOBILE SUITE 7.0 - SECURE GATEWAY ADMINISTRATOR GUIDE... Manuale di servizio

Novell

Novell GROUPWISE 8 - MONITOR Manuale utente

Novell

Novell ZENWORKS 10 CONFIGURATION MANAGEMENT SP3 - PREBOOT SERVICES AND IMAGING REFERENCE 10.3... Manuale di istruzioni

Novell

Novell ADMINSTUDIO 9.5 Manuale utente

Novell

Novell IDENTITY MANAGER 3.6.1 - STAGING BEST PRACTICES GUIDE... Manuale utente

Novell

Novell CLIENT FOR LINUX 2.0 Manuale utente

Novell

Novell LINUX ENTERPRISE DESKTOP 11 - ADMINISTRATION GUIDE... Guida di riferimento rapido

Novell

Novell iFOLDER 3.6 - READ ME 05-2008 Manuale utente

Novell

Novell ACCESS MANAGER 3.1 SP1 - ADMINISTRATION Manuale utente

Novell

Novell ZENWORKS 10 CONFIGURATION MANAGEMENT SP3 - COMMAND LINE UTILITIES REFERENCE 10.3... Manuale utente

Novell

Novell ZENWORKS 10 CONFIGURATION MANAGEMENT SP3 - ZENWORKS REPORTING SERVER 10.3... Manuale utente

Novell

Novell ZENWORKS ENDPOINT SECURITY MANAGEMENT 3.5 Manuale utente

Novell

Novell SERVICE DESK - INSTALLATION V6.1 Manuale utente

Novell

Novell LINUX ENTERPRISE SERVER 10 SP2 - ARCHITECTURE-SPECIFIC INFORMATION... Manuale utente

Novell

Novell GROUPWISE 7 ASYNC GATEWAY - INSTALLATION AND... Manuale di istruzioni

Novell

Novell LINUX ENTERPRISE DESKTOP 11 Manuale utente

Novell

Novell GROUPWISE 8 - DISTRIBUTION LISTS Manuale utente

Novell

Novell ZENWORKS HANDELD MANAGEMENT 7 SP1 IR4 Manuale utente

Novell

Novell LINUX ENTERPRISE 10 SP1 - LINUX AUDIT Manuale utente

Novell

Novell APPARMOR 1.2 Manuale di istruzioni

Novell

Novell DATA SYNCHRONIZER - 07-2010 Manuale di istruzioni

Novell

Novell LINUX ENTERPRISE SERVER 11 - STORAGE ADMINISTRATION GUIDE... Manuale di istruzioni

Manuali Software popolari di altre marche

COMPRO

COMPRO COMPROFM Manuale utente

Muratec

Muratec OFFICEBRIDGE ONLINE Manuale utente

Oracle

Oracle Contact Center Anywhere 8.1 Manuale utente

Adobe

Adobe 65007312 - Photoshop Lightroom Manuale

Avaya

Avaya NULL One-X for RIM Blackberry Manuale utente

HP ProLiant BL420c Manuale utente

PS Audio

PS Audio PowerPlay Manuale del proprietario

Brady

Brady LOCKOUT PRO 3.0 Manuale di servizio

Avaya

Avaya Interaction Center Manuale utente

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Manuale

Oracle

Oracle Application 9i Manuale utente

Acer

Acer RDM Manuale utente

Canon

Canon Vixia HF21 Manuale utente

Canon

Canon ZR950 Manuale utente

Samsung

Samsung Auto Backup Manuale utente

Polycom

Polycom Vortex EF2201 Istruzioni per l'installazione e il funzionamento

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c Manuale utente

Lexmark

Lexmark Apps Manuale di servizio