Table Of Contents
Setting Up WebVPN for the End User
TCP Port Forwarding and Application Access
Browser Caching and Security Implications
Application Access—Recovering from Hosts File Errors
How WebVPN Uses the Hosts File
What Happens When the End User Stops Application Access Improperly
Setting Up WebVPN for the End User
This appendix is for the system administrator who sets up WebVPN for end users. It summarizes configuration requirements and tasks for the end user's remote system. It also specifies information to communicate to end users to get them started using WebVPN.
Note
Before you set up WebVPN for the end user, you should have already configured the WebVPN Services Module.
This appendix contains the following sections:
•
Starting WebVPN
The following are required to start WebVPN on an end user's remote system:
•
–
–
–
–
–
•
On Microsoft Windows:
–
–
On Linux:
–
•
•
If pop-ups are disabled on the browser, WebVPN will not warn the end user before disconnecting due to an idle timeout or a maximum connect time.
•
https://address
where address is the IP address or DNS hostname of an interface of the WebVPN module, such as https://10.89.192.163 or https://vpn.company.com.
•
•
Usernames and Passwords
Table A-1 lists the type of usernames and passwords that WebVPN users might need to know.
End User Interface
An end user whose enterprise has configured WebVPN can access the enterprise network by launching a browser and connecting to the WebVPN gateway that is hosted by the enterprise network. The end user presents his or her credentials, authenticates, and sees the portal page (home page) of the enterprise site. The portal page displays those functionalities (for example, e-mail and web browsing) to which the end user has access on the basis of his or her credentials. If the end user has access to all functionalities of the WebVPN gateway, the home page provides links to all those functionalities.
Note
The following sections explain the end user interface in more detail:
•
Page Flow
This section describes the page flow process (see Figure A-1) for a WebVPN session. When the end user enters the Hypertext Transfer Protocol Secure (HTTPS) URL (https://address) into his or her browser, the end user is then redirected to https://address/index.html, where the login page is located.
Note
Figure A-1 Page Flow
Initial Connection
When the HTTPS connection is established, a warning about the SSL/TLS certificate may display. If the warning displays, the end user should install this certificate. If the warning does not display, then the system already has a certificate that the browser trusts.
The end user is then connected to the login page.
Login Page
The login page (see Figure A-2) prompts the end user to enter his or her username and password, which are entered into an HTML form. If an authentication failure occurs, the login page displays an error message.
Figure A-2 Default Login Page
The login page has logos, titles, messages, and colors that may be customized by administrators.
Certificate Authentication
Client certificate authentication is not supported. Only username and password authentication is supported.
Logout Page
The logout page (see Figure A-3) displays if the end user clicks the logout link, or if the session terminates because of an idle timeout or a maximum connection time.
Figure A-3 Logout Page
Portal Page
The portal page (see Figure A-4) is the main page for the WebVPN functionality. You can customize this page to contain the following:
•
•
•
•
•
•
•
•
•
Items that you have not configured are not displayed on the portal page.
Note
Figure A-4 Portal Page
Remote Servers
An end user may enter an address or URL path of a website to which he or she wants to visit either in the text box on the portal page or in the text box on the floating toolbar. Pages from the remote server are displayed in the browser window. The end user can then browse to other links on the page.
Figure A-5 illustrates the portal page of a typical website. By clicking the home icon button on the floating toolbar (see Figure A-6), the end user can go back to the portal page.
Figure A-5 Website with a Toolbar
WebVPN Floating Toolbar
A floating toolbar (see Figure A-6) allows the end user to enter URLs, browse file locations, and choose preconfigured web connections without interfering with the main browser window.
The floating toolbar represents the WebVPN session. If the end user clicks the window's Close button, the WebVPN module prompts the end user to confirm that he or she wants to close the session.
Note
Tip
Figure A-6 Floating Toolbar
DNS and Connection Errors
If an end user specifies a remote server to which he or she cannot connect because of domain naming system (DNS) or other connection errors, an error displays (see Figure A-7). Because of TCP timeouts, it may take a while for connection errors to be returned to the end user.
Figure A-7 DNS Errors
Session Timeout
End users receive a warning approximately 1 minute before the session expires due to inactivity, and they receive another warning when the session expires (see Figure A-8). The local time on the workstation is also displayed to indicate when the message was displayed.
The first message will be similar to the following:
•
Clicking the [Close] button on the idle warning message resets the inactivity timer.
The last message, as shown below, displays when the time runs out (depending on whether the reason of the session termination is known):
•
Figure A-8 Session Inactivity or Timeout Window
TCP Port Forwarding and Application Access
Note
Note
When the end user clicks the Application Access link, a new window is displayed. This window initiates the downloading of a port-forwarding applet. Another window is then displayed. This window asks the end user to verify the certificate with which this applet is signed. When the end user accepts the certificate, the applet starts running, and port-forwarding entries are displayed (see Figure A-9). The number of active connections and bytes that are sent and received is also listed on this window.
Note
You should have configured IP addresses, DNS names, and port numbers for the e-mail servers. The end user can then launch the e-mail client, which is configured to contact the above e-mail servers and send and receive e-mails. Point of Presence3 (POP3), Internet Message Access Protocol (IMAP), and Simple Mail Transfer Protocol (SMTP) protocols are supported.
The window attempts to close automatically if the end user is logged out using JavaScript. If the session terminated and a new port forwarding connection is established, the applet displays an error message.
Figure A-9 TCP Port Forwarding Page
Caution
Table A-2 lists the requirements for Application Access (Port Forwarding) on an end user's remote system.
Table A-2 WebVPN Remote System Application Access Requirements
Client applications installed
—
Cookies enabled on browser
—
Administrator privileges
End user must be local administrator on his or her PC.
Sun Microsystems Java Runtime Environment (JRE) version 1.4 or later installed
WebVPN automatically checks for JRE whenever the end user starts Application Access. If it is necessary to install JRE, a pop-up window displays directing end users to a site where it is available.
Client applications configured, if necessary.
Note
To configure the client application, use the server's locally mapped IP address and port number. To find this information, do the following:
1.
2.
3.
Windows XP SP2 patch
End users running Windows XP SP2 must install a patch from Microsoft that is available at the following address:
http://support.microsoft.com/?kbid=884020
This problem is a known Microsoft issue.
Using Other WebVPN Features
Table A-3 lists the requirements for various WebVPN features.
Table A-3 WebVPN Remote System Configuration and End User Requirements
Web Browsing
Usernames and passwords for protected websites
Using WebVPN does not ensure that communication with every site is secure. See the "Security Tips" section.
The look and feel of web browsing with WebVPN might be different from what end users are accustomed to. For example, when using WebVPN, note the following:
•
•
–
–
–
Also, depending on how you configured a particular account, the following might have occured:
•
•
Network Browsing and File Management
File permissions configured for shared remote access
Only shared folders and files are accessible through WebVPN.
Server name and passwords for protected file servers
Domain, workgroup, and server names where folders and files reside
Users might not be familiar with how to locate their files through your organization's network.
Note
Using e-mail:
Application AccessFulfill requirements for Application Access (see the "TCP Port Forwarding and Application Access" section)
To use e-mail, start Application Access from the WebVPN home page. The e-mail client is then available for use.
Note
Other Mail Clients
Cisco has tested Microsoft Outlook Express versions 5.5 and 6.0.
WebVPN should support other SMTPS, POP3S, or IMAP4S e-mail programs, such as Netscape Mail, Lotus Notes, and Eudora, but Cisco has not verified them.
Using e-mail:
Web AccessWeb-based e-mail product installed
Supported products are as follows:
•
Netscape, Mozilla, and Internet Explorer are supported with OWA 5.5 and 2000.
Internet Explorer 6.0 or higher is required with OWA 2003. Netscape and Mozilla are not supported with OWA 2003.
•
Other web-based e-mail products should also work, but Cisco has not verified them.
Using the WebVPN floating toolbar
Most platforms except for PocketPC
To paste text into a text field, press Ctrl-V. Right-clicking is disabled in the floating toolbar.
Using the Cisco SSL VPN Client (SVC)
To retrieve SVC log messages using the Windows Event Viewer, go to Program Files > Administrative Tools > Event Viewer in Windows.
Using Secure Desktop Manager
A Secure Desktop Manager-supported browser
On Microsoft Windows:
•
•
On Linux:
•
Using Cache Cleaner or Secure Desktop
A Cisco Secure Desktop-supported browser
Any browser supported for Secure Desktop Manager.
Security Tips
Advise end users always to log out from the WebVPN session when they are done. (To log out of WebVPN, click on the logout icon on the WebVPN toolbar or quit the browser.)
Advise end users that using WebVPN does not ensure that communication with every site is secure. WebVPN ensures the security of data transmission between the remote end user's PC or workstation and the WebVPN module on the corporate network. If the end user then accesses a non-HTTPS web resource (located on the Internet or on the internal network), the communication from the corporate WebVPN module to the destination web server is not secured.
Browser Caching and Security Implications
If end users use WebVPN through a public or shared Internet system, such as at an Internet cafe or kiosk, to ensure the security of their information after terminating or logging out of the WebVPN session, end users must delete all files that they saved on the PC during the WebVPN session. These files are not removed automatically upon disconnect.
Note
Application Access—Recovering from Hosts File Errors
It is very important to tell end users to close the Application Access window properly by clicking the close icon. If they do not close the window properly, the following could occur:
•
•
These errors can result from end users terminating the Application Access window in any improper way:
•
•
•
How WebVPN Uses the Hosts File
The hosts file on the end user system maps IP addresses to hostnames. When the end user starts Application Access, WebVPN modifies the hosts file by adding WebVPN-specific entries. When the end user stops Application Access by properly closing the Application Access window, WebVPN returns the hosts file to its original state. The hosts file goes through the following states:
•
•
a.
b.
•
a.
b.
•
What Happens When the End User Stops Application Access Improperly
If the end user improperly terminates Application Access, the hosts file is left in a WebVPN-customized state. WebVPN checks for this possibility the next time that the end user starts Application Access by searching for a hosts.webvpn file. If WebVPN finds the file, the end user receives a "Backup HOSTS File Found" error message, and Application Access is temporarily disabled.
When end users shut down Application Access improperly, they leave the remote access client/server applications in a suspended state. If end users try to start these applications without using WebVPN, the applications might malfunction. End users might find that hosts that they normally connect to are unavailable. This situation could commonly occur if end users run applications remotely from home, fail to quit the Application Access window before shutting down the computer, and then try to run the applications later from the office.
What to Do
To reenable Application Access or malfunctioning applications, end users should do the following:
•
•
Reconfiguring the Hosts File Automatically Using WebVPN
If end users are able to connect to their remote access server, they should follow these steps to reconfigure the hosts file and reenable both Application Access and the applications:
Step 1
Step 2
Step 3
•
•
•
Reconfiguring the Hosts File Manually
If end users are not able to connect to their remote access server from their current location, or if end users have customized the hosts file and do not want to lose their edits, they should follow these steps to reconfigure the hosts file and reenable both Application Access and the applications:
Step 1
Step 2
If any lines contain this string, your hosts file is WebVPN customized. If your hosts file is customized, it looks similar to the following example:
123.0.0.3 server1 # added by WebVpnPortForward123.0.0.3 server1.example.com vpn3000.com # added by WebVpnPortForward123.0.0.4 server2 # added by WebVpnPortForward123.0.0.4 server2.example.com.vpn3000.com # added by WebVpnPortForward123.0.0.5 server3 # added by WebVpnPortForward123.0.0.5 server3.example.com vpn3000.com # added by WebVpnPortForward# Copyright (c) 1993-1999 Microsoft Corp.## This is a sample HOSTS file used by Microsoft TCP/IP for Windows.## This file contains the mappings of IP addresses to host names. Each# entry should be kept on an individual line. The IP address should# be placed in the first column followed by the corresponding host name.# The IP address and the host name should be separated by at least one# space.## Additionally, comments (such as these) may be inserted on individual# lines or following the machine name denoted by a '#' symbol.## For example:## 102.54.94.97 rhino.acme.com # source server# 38.25.63.10 x.acme.com # x client host123.0.0.1 localhostStep 3
Step 4
Step 5
Step 6
