NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual NETGEAR, Inc. 350 East Plumeria Drive San Jose, California 95134 USA 202-10208-05 November 2008 v2.
© 2008 by NETGEAR, Inc. All rights reserved. Technical Support Please register to obtain technical support. Please retain your proof of purchase and warranty information. To register your product, get product support or obtain product information and product documentation, go to http://www.NETGEAR.com. If you do not have access to the World Wide Web, you may register your product by filling out the registration card and mailing it to NETGEAR customer service.
EU Regulatory Compliance Statement ProSafe SSL VPN Concentrator 25 is compliant with the following EU Council Directives: 89/336/EEC and LVD 73/23/EEC. Compliance is verified by testing to the following standards: EN55022 Class B, EN55024 and EN60950. Certificate of the Manufacturer/Importer It is hereby certified that the ProSafe SSL VPN Concentrator 25 has been suppressed in accordance with the conditions set out in the BMPT-AmtsblVfg 243/1991 and Vfg 46/1992.
Product and Publication Details Model Number: SSL312 Publication Date: November 2008 Product Family: Concentrator Product Name: ProSafe SSL VPN Concentrator 25 Home or Business Product: Business Language: English Publication Part Number: 202-10208-05 Publication Version Number: 2.1 iv v2.
Contents About This Manual Conventions, Formats and Scope .................................................................................... ix Using This Manual ............................................................................................................. x Printing this Manual ........................................................................................................... x Revision History .......................................................................................
Steps for Further Configuration ....................................................................................2-15 Chapter 3 Authenticating Users Authentication Domains ..................................................................................................3-1 Local User Database Authentication ..............................................................................3-2 RADIUS and NT Domain Authentication ........................................................................
Defining and Editing a User Bookmarks ................................................................4-21 Deleting a User ......................................................................................................4-22 Using Network Resource Objects to Simplify Policies ..................................................4-22 Chapter 5 Configuring the Remote Access Web Portal Creating the Portal ........................................................................................................
Erasing the Configuration and Restoring the Default Settings ...............................7-13 Upgrading the SSL VPN Concentrator Firmware ..................................................7-13 Additional Notes on the Management Interface ...........................................................7-14 Chapter 8 Monitoring and Logging SSL VPN Concentrator Status ........................................................................................8-1 Active Users .........................................
About This Manual The NETGEAR® Prosafe™ SSL VPN Concentrator 25 SSL312 Reference Manual describes how to install and configure the SSL312. The information in this manual is intended for administrators who will configure the SSL312. You should have intermediate computer and Internet skills. Conventions, Formats and Scope The conventions, formats, and scope of this manual are described in the following paragraphs: • • Typographical Conventions.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual Danger: This is a safety warning. Failure to take heed of this notice could result in personal injury or death. • Scope.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual Each page in the HTML version of the manual is dedicated to a major topic. Use the Print button on the browser toolbar to print the page contents. • Printing a Chapter. Use the PDF of This Chapter link at the top left of any page. – Click the PDF of This Chapter link at the top right of any page in the chapter you want to print. The PDF version of the chapter you were viewing opens in a browser window.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual Revision History Version Date Description of Changes -01, v1.1 November 2006 • Restructured the contents so that common setup and configuration tasks are easier to find • Added new topics • Added a link to a Microsoft Word template for creating an end-user guide -02, v1.0 December 2006 • Refined Portal layout behavior • Added Full Tunnel Support for VPN Tunnels -02,v1.
Chapter 1 Introduction This chapter describes some of the key features of the NETGEAR® ProSafe™ SSL VPN Concentrator 25 SSL312. It also includes the minimum prerequisites for installation (“Web Browser Requirements” on page 1-2.), package contents (“What’s in the Box” on page 1-3), and a description of the front and back panels of the SSL312 (“Hardware Description” on page 1-3).
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual • Provides client-less access with customizable user portals and support for a wide variety of user repositories. Access includes support for: – Full network access – HTTP and HTTPS proxy and reverse proxy – Remote desktop and application access including file sharing Web Browser Requirements The following web browsers are supported for the SSL VPN Concentrator web management interface and the SSL VPN portal.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual support JavaScript, Java, cookies, SSL and ActiveX to take advantage of the full suite of applications. Note: For 64-bit support with signed CABs, you must use a 64-bit version of Microsoft Internet Explorer. The default browser in Microsoft Windows Vista 64-bit Edition is 32-bit Internet Explorer.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual Front Panel The SSL VPN Concentrator front panel hardware is shown below: 1 2 3 4 5 Figure 1-1 The SSL VPN Concentrator front panel hardware functions are described below: 1. LED power indicator: • Off – No power • On – Power is on. 2. LED self test indicator. • Self test – on while initializing.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual Back Panel The SSL VPN Concentrator back panel hardware is shown below and consists of the power On/ Off switch and the 110-240V power cord connection. Figure 1-2 Note: Never substitute a power cord. Only use the power cord provided with the SSL VPN Concentrator.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual 1-6 Introduction v2.
Chapter 2 Installing the SSL312 This chapter describes how to install the ProSafe SSL VPN Concentrator 25 SSL312. The installation includes choosing a network topology, configuring the IP addressing scheme, connecting the SSL312, and provisioning the SSL certificate.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual services are decrypted by the SSL VPN Concentrator and relayed to the appropriate corporate network servers. . Corporate Server IP Address 192.168.1.3 Firewall/Router IP Address 192.168.1.254 LAN Subnet 192.168.1.0/24 SSL312 IP Address 192.168.1.1 Figure 2-1 Single arm mode has the advantage of being protected by your firewall. In later steps, you will use the following settings when configuring for single arm operation.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual As shown in the following figure, encrypted SSL traffic from a remote user is sent directly to the SSL VPN Concentrator, which authenticates the user and displays the portal and resources authorized for that user. The user’s subsequent requests for network services are decrypted by the SSL VPN Concentrator and relayed to the appropriate network servers on the corporate network. 10.0.0.10 10.0.0.254 10.0.0.20 66.123.4.80 10.0.0.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual 1. Prepare a PC with an Ethernet adapter. If this PC is already part of your network, record its TCP/IP configuration settings so that you can restore them later. 2. Configure your PC with a static IP address of 192.168.1.10 and 255.255.255.0 as the subnet mask. 3. Connect an Ethernet cable from your computer to Ethernet Port 1 on the front of the SSL VPN Concentrator. 4.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual 2. A certificate security warning may appear. Click Yes or OK to continue. A login screen with User Name and Password dialog boxes displays. Figure 2-3 3. When prompted, enter admin for the User Name and password for the Password, both in lower case letters. Note: Both the user name and password are case-sensitive. 4. From the Domain drop-down menu, select geardomain. 5.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual Figure 2-4 Configuring Basic Network Settings Before deploying the SSL VPN Concentrator into your existing network, you should configure the following basic settings: • Change the administrator password • Configure DNS server IP address • Configure a default route 2-6 Installing the SSL312 v2.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual • Configure Ethernet interface IP addresses To prepare for installation: 1. Change the administrator account password. a. On the left side of the browser window, select the Users and Groups link. b. In the Users table, click on admin. c. Type your new Password and re-type to Confirm Password. d. Click Apply. 2. Configure the DNS server IP address. a. On the left side of the browser window, select the Network link. b.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual e. Click Apply. If you changed the IP address for the Ethernet Port to which you are connected, you will now lose your connection to the SSL VPN Concentrator. Installing the SSL VPN Concentrator You are now ready to physically install your SSL VPN Concentrator using the following steps: 1. Turn off the power to the SSL VPN Concentrator and connect it to your network in your chosen topology.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual You can obtain a certificate from a well-known commercial Certificate Authority (CA) such as Verisign or Thawte, or you can generate and sign your own certificate. Because a commercial CA takes steps to verify the identity of an applicant, a certificate from a commercial CA provides a strong assurance of the server’s identity.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual Figure 2-5 2. In the Digital Certificate Management section, click New CSR/CRT. The Create CSR screen displays. 3. Fill out all of the fields with the appropriate information. This information will appear in your certificate and will be visible to users. 2-10 Installing the SSL312 v2.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual Figure 2-6 4. Click Apply. A file download screen will display. Click Save to save the CSR.ZIP file to a disk location. You will need to provide this file to the Certificate Authority. 5. Contact the CA to purchase your certificate using the CSR file you generated. 6. When you receive your certificate from the CA, store the certificate file on your PC. 7. Upload and enable the certificate according to the instructions later in this chapter.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual 3. Fill out all of the fields with the appropriate information. This information will appear in your certificate and will be visible to users. 4. Check the Generate a Self-signed Certificate checkbox to generate a new CRT. 5. Click Apply. If all information is entered correctly, a file download screen displays. Click Save to save the crt.zip file to a disk location. This file includes a server.crt and a server.key key file. 6.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual Figure 2-7 4. Click the Enable link adjacent to the new certificate. The Enable Certificate screen displays Figure 2-8 Installing the SSL312 2-13 v2.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual 5. Enter the Certificate Password and click Enable. The SSL VPN Concentrator software will restart using the new certificate. Note: The file server.key contains your SSL VPN Concentrator’s private encryption key, which is used to decrypt messages. It is extremely important that you safeguard this file. Viewing and Deleting Certificates The Current Certificates table lists the valid SSL certificates.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual Steps for Further Configuration The next steps in configuring the SSL VPN Concentrator are: • Create authentication domains (Chapter 3, “Authenticating Users”). • Define user and group settings (Chapter 4, “Setting Up User and Group Access Policies”). Installing the SSL312 2-15 v2.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual 2-16 Installing the SSL312 v2.
Chapter 3 Authenticating Users Remote users connecting to the SSL VPN Concentrator must be authenticated before being allowed to access the network. The login window presented to the user requires three items: a User Name, a Password, and a Domain selection. The Domain determines the authentication method to be used and the portal layout that will be presented. This chapter explains how to define authentication domains.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual Figure 3-1 All of the configured domains will be listed in the table in the Domains window. The domains are listed in the order in which they were created. By default, the geardomain authentication domain is already defined, using the SSL VPN Concentrator’s local internal user database for user authentication.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual 1. From the Access Administration menu, select Domains. The Domains window will display. Click Add Domain. Figure 3-2 2. From the Authentication Type pull-down menu, select Local User Database. 3. In the Domain Name field, enter a descriptive name for the authentication domain. This is the domain name users will select in order to log into the SSL VPN portal. 4. In the Portal Layout Name pull-down menu, select the name of the layout.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual For example, if you create a RADIUS domain in the SSL VPN Concentrator called “Miami RADIUS server”, you can add users to groups that are members of the “Miami RADIUS server” domain. These user names must match the names configured in the RADIUS server. Then, when users log in to the portal, policies, bookmarks and other user settings will apply to the users.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual Figure 3-3 3. In the Domain Name field, enter a descriptive name for the authentication domain. This is the domain name users will select in order to log into the SSL VPN portal. 4. In the Radius Server Address field, enter the IP address or domain name of the Radius server. 5. If an authentication secret is required by the Radius server, enter it in the Secret Password field. 6.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual 2. From the Authentication Type menu, select NT Domain. The Add Domain window displays the fields for a domain with NT authentication: Home Directory Base Path required when “Require CIFS Bookmark” is enabled Figure 3-4 3. In the Domain Name field, enter a descriptive name for the authentication domain. This is the domain name selected by users when they authenticate to the SSL VPN portal. It may be the same value as the NT Domain Name. 4.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual 6. From the Portal Layout Name pull-down menu, select the name of the layout. The default layout is SSL-VPN. You can define additional layouts in the Portal Layouts page. 7. Check the Require CIFS bookmark to home directory check box to automatically allow access to users of this domain and add the home directory path in the field provided. 8. Click Apply to update the configuration.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual name=Administrator memberOf=CN=TerminalServerComputers,CN=Users,DC=netgear, DC=net objectClass=user msNPAllowDialin=FALSE LDAP Attribute Rules • If multiple attributes are defined for a group, all attributes must be met by LDAP users. • If no attributes are defined, then any user authorized by the LDAP server can be a member of the group.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual Querying an LDAP Server To query your LDAP or Active Directory server to find out the LDAP attributes of your users, you can use several different methods. From a machine with LDAPsearch tools (for example a Linux machine with OpenLDAP installed), run the following command: ldapsearch -h 10.0.0.5 -x -D cn=demo,cn=users,dc=netgear,dc=net -w demo123 -b dc=netgear,dc=net > /tmp/file where • 10.0.0.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual : Figure 3-5 3. In the Domain Name field, enter a descriptive name for the authentication domain. This is the domain name users will select in order to log into the SSL VPN portal. It can be the same value as the Server Address field. 4. In the Server Address field, enter the IP address or domain name of the server. 5. In the LDAP BaseDN field, enter the search base for LDAP queries.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual Kerberos Authentication (Active Directory) Kerberos authentication is performed by either a Kerberos authentication server or a Windows Server 2000 or later running Active Directory. Users who have been defined in the Kerberos database can log into the SSL-VPN portal by entering their Kerberos user name and password and selecting the new Kerberos authentication domain from the Domain menu on the SSL VPN login page.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual 5. Enter the Kerberos or Active Directory domain name in the Kerberos Domain field. 6. Enter the name of the layout in the Portal Layout Name field. The default layout is SSL-VPN. (Additional layouts may be defined from the SSL VPN Portal > Portal Layouts screen.) Note: If you selected a portal layout other than SSL-VPN, then the domain will not be displayed on the default login page.
Chapter 4 Setting Up User and Group Access Policies This chapter describes how to define users and groups and how to configure SSL VPN Concentrator access policies and bookmarks for the users and groups.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual • To create complex policies involving groups of host names, IP addresses or IP address ranges, you can define these groups as network objects using Network Resources as described in “Using Network Resource Objects to Simplify Policies” on page 4-22. • To present different portal content to different users (for example, external suppliers), create the new portal layout, then add a new domain, selecting the new portal layout.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual • An FTP server at 10.0.1.5, the user would be blocked by Policy 2. • An FTP server at 10.0.0.10, the user would be granted access by Policy 3. The IP address range 10.0.0.5 - 10.0.0.20 is more specific than the IP address range defined in Policy 1. • An FTP server at ftp.company.com, the user would be granted access by Policy 3. A single host name is more specific than the IP address range configured in Policy 2.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual Editing Global Policy Settings To edit global settings: 1. In the Global Policies table, click the Edit Global Policies link. The Global Settings screen displays. Figure 4-2 2. In the Inactivity Timeout field, enter the number of minutes of inactivity to allow. You can set the inactivity timeout at the user, group and global level.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual When Terminal Services Single Sign-On (SSO) is enabled, a user with a domain account will log in only once, and can then access remote servers without being asked again for his credentials. SSO can be enabled or disabled at the user, group and global level.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual Adding and Editing Global Policies To define global access policies: 1. In the Global Policies section, click Add Policy. An Add Policy window displays. Note: User and group access policies will take precedence over global policies. Figure 4-3 2. From the Apply Policy To pull-down menu, select whether the policy will be applied to a predefined network resource, an individual host, a network, or all addresses. 3.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual 4. From the Service pull-down menu, select the service type. If you are applying a policy to a network resource, the service type is defined in the network resource. 5. From the Status pull-down menu, select PERMIT or DENY to either permit or deny SSL VPN connections for the specified service and host machine. 6. Click Apply to update the configuration.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual Groups Configuration When configuring Groups, remember that user policies take precedence over all group policies and group policies take precedence over all global policies, regardless of the policy definition. (A user policy that allows access to all IP addresses will take precedence over a group policy that denies access to a single IP address). SSL VPN Concentrator Groups are also defined from the Users and Groups menu.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual . Figure 4-6 2. In the Group Name field., enter a descriptive name for the group. 3. In the Domain menu, select the appropriate domain. The domain will determine the authentication method for the group. 4. Click Apply to update the configuration. Once the group has been added, the new group appears in the Groups table on the User and Groups menu. All of the configured groups are displayed in the table in the Users and Groups menu.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual Figure 4-7 2. From the Terminal Services SSO pull-down menu, select Use Global, Enable, or Disable. When Terminal Services Single Sign-On (SSO) is enabled, a user with a domain account will log in only once, and can then access remote servers without being asked again for his credentials. SSO can be enabled or disabled at the user, group and global level.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual The maximum timeout setting is 232 or over 100,000 minutes, although setting the timeout to 0 on the Global Settings page disables the inactivity timeout (if 0 is also configured as the inactivity timeout for the user and group). 4. Click Apply to save the configuration changes. Defining and Editing Group Policies With group access policies, all traffic is allowed by default.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual 3. In the Policy Name field, define a name for the policy. Note: SSL VPN Concentrator policies apply to the destination address(es) of the SSL VPN connection, not the source address. You cannot permit or block a specific IP address on the Internet from authenticating to the SSL VPN Concentrator through the policy engine. That type of policy would need to be defined by a firewall rule. 4.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual To define group bookmarks: 1. In the Group Bookmarks section of the Group Settings menu, click Add Bookmark. An Add Bookmark menu displays. When group bookmarks are defined, all group members will see the defined bookmarks from the SSL VPN Portal. Individual group members will not be able to delete or modify group bookmarks. . Figure 4-9 2. In the Bookmark Name field, enter a descriptive name. 3.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual 1. Click the name of the group that you wish to remove from the Groups table. The Group Settings menu displays. 2. In the Group Settings window, click Delete Group. The Users and Groups menu displays and the deleted group no longer appears in the list of defined groups. Note: A group cannot be deleted if users have been added to the group or if the group is the default group created for an authentication domain.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual Figure 4-10 Adding a New User To create a new user: 1. In the Users and Groups menu, click Add User. An Add User menu displays. Figure 4-11 2. In the User Name field, enter the user name for the user. This is the name the user will enter in order to log into the SSL VPN portal. 3. From the Group pull-down menu, select the name of the group to which the user belongs. Setting Up User and Group Access Policies v2.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual 4. Click Apply. If the selected group is in a domain that uses external authentication, such as Kerberos, RADIUS, NT Domain, or LDAP, then the Add User menu will close and the new user will be added to the Users and Groups table. Note: Groups configured to use Radius, LDAP, NT Domain, or Kerberos authentication do not require passwords because the external authentication server will validate user names and passwords.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual Figure 4-13 Editing a User To edit a user: 1. In the Users table in the Users and Groups menu, click the name of the user. The User Settings menu displays as shown in Figure 4-14. • The Edit User Settings section shows the User Name, Group Name, and Domain Name. These fields are not configurable. To modify information supplied in these fields, remove the user by clicking Delete User and then recreate the user with the correct information.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual . Figure 4-14 2. To modify the user password, enter the new user password in the Password field. 3. In the Confirm Password field, enter the new password again. 4. From the Terminal Services SSO pull-down menu, select Use Group, Enable, or Disable. When Terminal Services Single Sign-On (SSO) is enabled, a user with a domain account will log in only once, and can then access remote servers without being asked again for his credentials.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual 5. In the Inactivity Timeout field, enter the number of minutes of inactivity to allow for users in the group. You can set the inactivity timeout at the user, group and global level. Set the timeout as 0 in the user and group configuration to use the global timeout setting.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual Defining and Editing User Policies To define user access policies: 1. On the Edit User Settings screen, click Add Policy. An Add Policy menu displays. Figure 4-15 2. In the Apply Policy To pull-down menu, select whether the policy will be applied to a predefined network resource, an individual host, a network or all addresses. 3. In the Policy Name field, enter a name for the policy.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual 6. Click Apply to update the configuration. Once the configuration has been updated, the new policy appears in the Edit User Settings menu. The user policies will be displayed in the Edit Users Settings screen in the User Policies table in the order of priority, from the highest priority policy to the lowest priority policy. Defining and Editing a User Bookmarks To define user bookmarks: 1. In the Edit User Settings menu, click Add Bookmark.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual Deleting a User To delete a user: 1. Click the Delete link adjacent to the users name in the Users table. The user is removed from the table in the Users and Groups menu, or 2. Click the user name that you wish to remove. The Edit User Settings window will display. 3. In the Edit User Settings window, click Delete User. Once deleted, the user no longer appears in the table in the Users and Groups menu.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual 2. Click Add Resource. An Add Network Resource menu similar to the following displays. Figure 4-18 3. In the Resource Name field, enter a name for the Network Resource. 4. From the Services pull-down menu, select the type of service to which the Network Resource will apply. 5. Click Apply. The new Network Resource appears in the table on the Network Resources menu. Figure 4-19 To edit the Network Resource. 1.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual . Figure 4-20 2. From the Object Type pull-down menu under Add Resource Addresses, select either IP Address or IP Network: • If you selected IP Address, enter an IP address or fully qualified domain name in the IP Address/Name field. • If you selected IP Network, enter the IP network address in the Network Address field. Enter the mask length in the Mask Length (0-31) field.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual Figure 4-21 . Note: You may define up to 128 addresses or address ranges per Network Resource To delete a defined resource, click Delete in the Defined Resource Addresses table adjacent to the resource you wish to delete. Setting Up User and Group Access Policies v2.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual 4-26 Setting Up User and Group Access Policies v2.
Chapter 5 Configuring the Remote Access Web Portal This chapter explains how to create multiple Web portals for different users and how to customize the appearance of a portal.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual Note: The default portal address is https://. If the default portal is changed from the default (SSL-VPN), you can use the URL address https:///portal/SSL-VPN to access the administration domain geardomain. The administration domain, geardomain, is attached to the SSLVPN portal layer. To view the Portal Layout screen: Click Portal Layouts under the SSL VPN Portal menu on the left navigation pane.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual The configuration of the VPN Tunnel and Port Forwarding features are described in Chapter 6, “Configuring the SSL VPN Tunnel Client and Port Forwarding”. Adding Portal Layouts The SSL VPN Concentrator administrator may define individual layouts for the SSL VPN portal. The layout configuration includes the theme, menu layout, portal pages to display, portal application icons to display, and web cache control options.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual 2. In the Portal Layout and Theme Name section: a. Enter a descriptive name for the portal layout in the Portal Layout Name field. This name will be part of the path of the SSL VPN portal URL. Note: Custom portals are accessed at a different URL than the default portal. For example, if your SSL VPN portal is hosted at https://vpn.company.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual These directives help prevent clients browsers from caching SSL VPN portal pages and other web content. Note: NETGEAR strongly recommends enabling HTTP meta tags for security reasons and to prevent out-of-date web pages, themes and data being stored in a user’s web browser cache. e.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual Adding Terminal Services Applications to the Portal If you selected the option Applications page (in the SSL VPN Portal Pages to Display section), then the Portal Layout screen will expand to include an Applications Page–Available Terminal Services Applications section. You can now add Terminal Services application icons to display in the Applications page. Figure 5-4 To add a Terminal Services application: 1.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual 4. From the Icon Image menu, select an image to appear on the Applications page. 5. Click Add Application to add the new application to the SSL VPN Portal Applications page. Apply the portal layout to one or more SSL VPN Concentrator authentication domains. Customizing the Banner An administrator can further customize the portal by uploading a a customized image for the banner. To upload a banner image: 1.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual Duplicating and Editing Portal Layouts You can edit the features of an existing portal; for example, create a banner or banner message that displays at the top of the page; or show or hide all applicable bookmarks (user, group, and global) for each user. You can, optionally, upload an HTML file. You can also create another portal with all of the features of the existing portal by changing the existing portal layout name.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual To modify the features of an existing portal: 1. Under the SSL VPN Portal menu on the left navigation pane, click Portal Layouts. The Portal Layouts screen displays. 2. In the Layout Name column, click the portal you want to edit. The Portal Layouts screen displays. 3. Enter a new Banner Title and Banner message, and check the Display banner message on login page checkbox to display a custom message at the top of the new page. 4.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual The Remote Desktop Connection client is launched from the Start button by choosing Start/ Programs/Accessories/Remote Desktop Connection. If your computer uses ActiveX Terminal Services 5.0 with Windows XP Professional SP2, you may see an error stating that you cannot establish a connection to the server.
Chapter 6 Configuring the SSL VPN Tunnel Client and Port Forwarding This chapter describes the configuration for the SSL VPN Tunnel Client and for Port Forwarding. When a remote user accesses the SSL VPN Concentrator from a PC that allows ActiveX content, these two powerful features can be activated. For each of these features, the SSL312 installs a small client program on the user’s PC that enables a more direct level of network access than is possible from the browser alone.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual • Detects and reroutes individual data streams to the Port Forwarding connection rather than opening up a full tunnel to the corporate network. • Offers more fine grained management than VPN Tunnel. Administrators define individual applications and resources that will be available to remote users.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual – Split tunnel – Sends only traffic destined for the internal network based on the specified client routes. All other traffic is sent to the internet. Split tunnel allows you to manage your company bandwidth by reserving the VPN tunnel for corporate traffic only. Beyond what is defined in “Web Browser Requirements” on page 1-2, the VPN Tunnel Client has some specific operating requirements. For • Mac OS. VPN Tunnel supports Version 1.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual In the Client IP Address Range section of the screen, you can define the IP address range to assign to incoming VPN Tunnel clients. The default range begins with 192.168.251.1 and ends with 192.168.251.254. 2. In the Client Address Range Begin field, enter the first IP address of the IP address range. 3. In the Client Address Range End field, enter the last IP address of the IP address range. 4.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual If the assigned client IP address range is in a different subnet than the corporate network or if the corporate network has multiple subnets, you must define Client Routes. To add an SSL VPN Tunnel client route: 1. Select the VPN Tunnel menu on the left navigation pane. 2. In the Destination Network field under Add Routes for VPN Tunnel Clients section, enter the network address of a local area network or subnet. For example, enter 192.168.0.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual 5. Restart the SSL VPN Concentrator software if VPN Tunnel Clients are currently connected to the SSL VPN Concentrator. Restarting forces clients to reconnect and receive new addresses and routes. Now users are able to connect to the SSL VPN Concentrator and receive a virtual IP address from the client address range. . To delete a VPN Tunnel Client Route: 1.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual To configure applications for Port Forwarding: 1. From the Access Administration menu in the left navigation pane, select the Port Forwarding option. The Port Forwarding configuration screen displays. Figure 6-3 2. In the Configured Applications for Port Forwarding section, enter the IP address of an internal server or host computer in the IP Address field. 3.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual Table 6-1. Port Forwarding Applications/TCP Port Numbers (continued) TCP Application Port Number SSH 22a Telnet 23a SMTP (send mail) 25 HTTP (web) 80 POP3 (receive mail) 110 NTP (network time protocol) 123 Citrix 1494 Terminal Services 3389 VNC (virtual network computing) 5900 or 5800 a. Users can specify the port number together with the host name or IP address.
Chapter 7 Additional System Configuration This chapter describes additional network and configuration management functions provided by the Web Management Interface.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual • Default gateway address (Firewall/Router address): 192.168.1.254 In the configuration shown in the diagram, the IP addresses of devices in the local network are configured in the 192.168.1.0/24 subnet and the default gateway for these devices is the internal IP address of the local firewall or router, 192.168.1.254. Corporate Server IP Address 192.168.1.3 Firewall/Router IP Address 192.168.1.254 LAN Subnet 192.168.1.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual Figure 7-2 2. Enter the Ethernet Port 1 subnet mask that has been configured for your network. The subnet mask value should be the same value as the subnet mask configured on your network computers. The factory default is 255.255.255.0 (The subnet mask specifies the network number portion of an IP address.). 3. Only if you plan to use two port mode, enable routing mode by checking this checkbox. The second Ethernet port will be enabled.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual 5. Enter the subnet mask. The subnet mask specifies the network number portion of an IP address. The factory default is 255.255.255.0. 6. Click Apply to save your settings. From the Network screen, you can define the default network route. The default route is required for Internet access. 1. In the Default Gateway section, enter the IP address of the router or default gateway of the network in the Default Gateway Address field.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual To configure a static route: 1. In the Add Static Routes section, enter the destination network address of the static route in the Destination Network field. The destination network address is an IP address in the remote network subnet. Note: The destination network address may be a valid IP address or it may be a subnet address that ends in .0, such as 192.168.0.0. 2.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual Figure 7-3 Network Host Table Settings For the convenience of users, you can configure the SSL VPN Concentrator to translate host names or fully qualified domain names (FQDNs) to IP addresses. This function is configured in the Host Table menu. Note: The SSL VPN Concentrator can act as a NetBIOS client to learn local network host names and their corresponding IP addresses. To configure host resolution: 1.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual 3. In the Host Name field, enter the host name or Fully Qualified Domain Name of the machine. For example, enter mycomputer or www.netgear.com. Do not enter names with spaces or other non-alphanumeric characters such as apostrophes or commas. 4. In the optional Alias field, enter the host alias. For example, if you entered the FQDN www.netgear.com in the Host Name field, then you can enter a shorter name, such as www or web in the Alias field.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual 1. In the Network menu, check the DNS Settings radio button. The Network menu displays the fields for entering the DNS Settings. Figure 7-5 2. Enter the Hostname for the SSL VPN Concentrator. The hostname identifies the SSL VPN Concentrator on the network. Use only letters and numbers for the hostname; do not enter nonalphanumeric characters such as spaces or apostrophes. 3.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual Setting Date and Time To configure the SSL VPN Concentrator date and time settings: 1. Under the System Configuration menu in the left navigation pane, click Date and Time. The SSL VPN Concentrator uses the date and time settings to timestamp log events, verify certificate validity, and for other internal purposes. Figure 7-1 2. From the Select Your Time Zone drop-down menu, select your time zone. 3.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual • If you selected Use default NTP servers, NETGEAR’s primary and secondary NTP servers for your time zone will appear. • If you selected Use custom NTP servers, enter an NTP server IP address or fully-qualified domain name (FQDN) in the address fields. (For redundancy, enter a backup custom server address in the Secondary Server Name and IP Address fields.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual Figure 7-2 Encrypting the Configuration File For security purposes, you can encrypt the configuration files. However, if the configuration files are encrypted, they cannot be edited or reviewed for troubleshooting purposes. To encrypt the configuration files: In the Utilities menu, check the Encrypt configuration file checkbox. The Configuration files will be encrypted when they are exported to disk and decrypted when they are imported.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual Figure 7-3 3. Choose the location to save the configuration file. The file is named CONF.ZIP by default, but it can be renamed. 4. Click Save to save the configuration file. Importing a Configuration File To import a saved configuration file: 1. In the Utilities menu, click Import. A submenu will display. Figure 7-4 2. Click Browse to locate a saved configuration zip file. The configuration zip file should contain the GEARHOST.CONF, SMM.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual Erasing the Configuration and Restoring the Default Settings Two methods are available for erasing the configuration and restoring the factory default settings. You can press and hold the front panel Factory Defaults push button for more than five seconds, or you can use the Erase button in the Utilities menu. All settings will be restored to defaults with the exception of the Certificates Table.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual 1. Download the new firmware from NETGEAR’s support site. If the file is a zip archive, extract it and save it to your PC. 2. In the Utilities menu, click Upgrade. A submenu will display. Figure 7-6 3. Click Browse to locate the saved firmware file on your PC. 4. Select the file and then click Upload. 5. Once the file has been uploaded, restart the SSL VPN Concentrator server for the upgrade to be complete.
Chapter 8 Monitoring and Logging This chapter describes the SSL VPN Concentrator status information, logging, alerting and reporting features. It describes: • SSL VPN Concentrator Status • Active Users • Event Log • Log Settings • Diagnostics SSL VPN Concentrator Status The Status window shows important state and configuration information. Be sure to check the Status window for error messages and to confirm that the SSL VPN Concentrator is configured properly.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual Figure 8-1 From the Status page, you may view: • The SSL VPN Concentrator software version • The amount of RAM memory in kilo Bytes (kB) • The current memory usage in percent (%). • The current CPU usage in percent (%).
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual Active Users The Active Users screen displays the active users and administrators logged into the SSL VPN portal. To view the Active Users log file: Click Active Users under the Monitoring menu in the left navigation pane. Figure 8-2 The Active Users window displays the current users or administrators logged into the SSL VPN Portal or the SSL VPN Concentrator administrative interface.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual Event Log The SSL VPN Concentrator provides web based logging. It also provides the ability to send log messages to an external syslog server using the syslog protocol and to E-mail log files and alert messages to an E-mail address or pager. To configure syslog and event log settings, see “Log Settings” on page 8-5. To view the SSL VPN Concentrator event log: Click Event Log under the Monitoring menu in the left navigation menu.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual • User name. The User name field shows the authenticated name of the user or administrator that generated the log event. • Log message. The message field describes the event that occurred. Examples of log messages include Administrator login successful and SSL VPN Concentrator restarting. The event log table may be sorted and filtered. To sort the event log by category: 1. Click the category header to be sorted, such as Time or Source. 2.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual so most standard firewall and networking reporting products can accept and interpret the SSL VPN Concentrator log files. The SSL VPN Concentrator syslog service transmits syslog messages to external syslog server(s) listening on UDP port 514. To configure Syslog Settings, E-mail Settings and Log and Alert Categories for syslog and alert settings: 1. Under the System Configuration menu in the left navigation pane, click Log Settings.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual 3. If you have a backup or second syslog server, enter the IP address or domain name of the Secondary Syslog Server in the Secondary Syslog Server field. 4. In the E-mail Settings section: a. To receive e-mail notification, enter your full e-mail address (username@domain.com) in the E-mail Event Logs to field. The event log file will be e-mailed to the specified e-mail address before the event log is cleared.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual Log categories are organized from most to least critical. Once a category is selected, then all events equal to or more critical than the selected log category and will be logged. The default Log and Alert levels are: • Syslog Messages: Debug • Event Log: Debug • Alerts: Error 6. Click Apply to confirm your settings. 8-8 Monitoring and Logging v2.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual Diagnostics Basic network diagnostic tools are available in the Diagnostics menu. Under the Monitoring menu in the left navigation menu, click Diagnostics. The Diagnostics window displays. Figure 8-5 The following diagnostic functions are available: • Ping an IP Address – Enter an IP address and click Ping to send a ping packet request to the specified IP address.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual 8-10 Monitoring and Logging v2.
Appendix A Default Settings and Technical Specifications This appendix provides the factory default settings and technical specifications for the ProSafe SSL VPN Concentrator 25 SSL312. Factory Default Settings You can use the push button located on the front of your device to reset all settings to their factory defaults. This is called a hard reset. • To perform a hard reset, push and hold the Factory Defaults button for approximately 5 seconds, until the TEST light turns on.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual Table A-1. SSL312 Default Configuration Settings Feature Description Concentrator Ethernet MAC Address See bottom label. Time Zone GMT Time Zone Adjusted for Daylight Saving Time Automatically enabled if DST available in area selected; otherwise disabled. Console Port 9600 bps, 8 data bits, 1 stop bit, no parity, no flow control Technical Specifications Table A-2.
Appendix B Related Documents This appendix provides links to reference documents you can use to gain a more complete understanding of the technologies used in your NETGEAR product. Document Link Template for creating an end-user guide http://documentation.netgear.com/ssl312/enu/202-10208-01/appnote.doc Internet Networking and TCP/IP Addressing http://documentation.netgear.com/reference/enu/tcpip/index.htm Wireless Communications http://documentation.netgear.com/reference/enu/wireless/index.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual B-2 Related Documents v2.
Index Numerics 10.0.0.1 Port 2 default 7-3 192.168.1.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual configuration settings restoring defaults 7-13 IP default login 2-4 console port A-2 Ethernet Port 2 default address 7-3 IP default login 2-4 crt.zip 2-12 Event Log 8-4 CSR 2-9 event logging 7-14 configuration zip file name 7-12 csr.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual Group Policy Add 4-11 Add Bookmark 4-13 Add Name 4-12 network resource 4-11 rules 4-12 Service Type 4-12 LDAP Authentication Domains 3-7 group settings defining 2-15 M Groups Add Name 4-9 configuring 4-8 Domain 4-9 editing 4-9 Inactivity Timeout 4-10 Terminal Services SSO 4-10 Management Interface 2-5 Login 2-4 H NAT 2-2 Host Name resolution, configuring 6-8 Hostname 7-8 HTTP meta tags 5-4 https //10.0.0.1 2-4 //192.168.1.
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual NT Domain 3-2, 3-3 RAM memory 8-2 NTP, custom servers 7-10 RDP 4-23 O one port topology 2-1 Remote Desktop Connection client for Linux 5-10 client for Macintosh 5-10 client for Windows 5-9 P Resource Addresses deleting 4-25 PAP RADIUS 3-4 restart 8-9 routing topology 2-2 ping 8-9 Policy service type 4-7 S policy hierarchy 4-2 Screen Size Terminal Services 4-7, 4-13, 4-21 Port 1 default login 2-4 Secondary DNS Server 7-8 port add
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual syslog server 8-4 support 8-5 V system monitoring 7-14 T VPN Tunnel adding IPAddress ranges 6-3 adding static route 6-5 Client address range 6-5 TCP/IP 2-3, 7-4 VPN Tunnel Client 6-1 TCP/IP settings 2-4 VPN Tunnel client adding routes 6-4 configuring address range 6-3 Technical Specifications A-2 Terminal Services adding applications 5-6 clients 5-9 Screen Size 4-7, 4-13, 4-21 Terminal Services SSO 4-4, 4-10, 4-18 Virtual Network Comp
NETGEAR ProSafe SSL VPN Concentrator 25 SSL312 Reference Manual Index-6 v2.
