SSL VPNPlus Training SSL VPNPlus 2005 09 Neo

SSL VPN-Plus Training SSL VPN-Plus © 2005 -09 Neo. Accel, Inc.

COMPANY OVERVIEW © 2005 -06 Neo. Accel, Inc.

Company Snapshot Founded 2004 Offices – Founder: Michel Susai – Headquarters – San Jose, CA • Former Chairman and CEO, and Founder of Net. Scaler (Acquired by Citrix for $325 M) – First Product Shipped Oct 2005 Technology Focus – Secure Remote Access: SSL VPN-Plus™ – Network Access Control: – NAM-Plus™ SSL Based Site to Site VPN Competitive Advantage – Patented Architecture (ICAA™) – 24 -Month Technology Lead Sales Strategy – Enterprise, OEM, Channel © 2005 -06 Neo. Accel, Inc. – Regional Sales Offices • Boston, Houston, San Jose • India, China, Japan Investors – Institutional • Baring Private Equity • NTT – Angel • Sabeer Bhatia (Co-Founder, Hotmail) • Prabhu Goel (Inventor, Verilog)

Sample Customers OEM Service Providers Enterprise Financial Higher Education Health Care Manufacturing Utilities Non-Profit Engineering Insurance Gov’t Automotive Real Estate Construction Logistics Marketing Online Security IT Services Retail © 2005 -06 Neo. Accel, Inc.

Awards and Recognitions SSL VPN Magic Quadrant Q 307 "The company [Neo. Accel]. . . has established multiple OEM deals and sold well in the first half of 2007, . . . outperforming some older and established companies. " -- Gartner SSL VPN MQ 2007 © 2005 -06 Neo. Accel, Inc.

REMOTE ACCESS © 2005 -06 Neo. Accel, Inc.

Remote Access? • Access Secure Application Servers to update customer information or submitting a daily report • Access Corporate Email server • Access Mission Critical Application Servers when at customer site • Access Corporate Intranet to get latest information or checking status of your leave application © 2005 -06 Neo. Accel, Inc.

Who Needs Remote Access? • • Consultants Partners Field Engineers and Sales Team Remote Office Employees Off office hours workers Roaming Executives Bridge branch offices to corporate centre © 2005 -06 Neo. Accel, Inc.

Why VPN? • When Alice talks to Bob © 2005 -06 Neo. Accel, Inc. • Confidential • Integrity • Authentication

VPN Technologies? • PPTP • L 2 TP • IPSec • SSL © 2005 -06 Neo. Accel, Inc.

IPSec Features • • • Site-to-Site Access Complete network access Transparent to Applications Least effect on performance Good security © 2005 -06 Neo. Accel, Inc.

SSL VPN – Secure Socket Layer VPN • Uses SSL protocol for confidentiality, authentication and integrity and then proxies to provide authorized and secure access for private network resource like Web, Client/Server, file sharing etc. • Two modes • Clientless: Proxies web-based applications and uses inbuilt SSL support in browsers to establish VPN and deliver web traffic. • Network Extension: Proxies client-server application, requires a proprietary client application to establish VPN and facilitate client-server application communication © 2005 -06 Neo. Accel, Inc.

SSL VPN Features • • Designed for Remote Access Centralized Access Control Zero user side management One minute deployment Endpoint Security Clientless - Access Anywhere Network Extension • Access Anything © 2005 -06 Neo. Accel, Inc.

Current State of VPNs – Remote Access • 1 st-Generation VPN – IPsec – IP Address-Based Tunnels – All-or-Nothing Network Access for Employees – High License & Administration Costs Users IP Address-Based Tunnels • 2 nd-Generation VPN – SSL – User-Based Tunnels – Conditional Access to Specific Applications Users – Significant Advantages over IPsec (see next slide) User-Based Tunnels 14 © 2005 -06 Neo. Accel, Inc.

2 nd-Generation VPN Advantages over 1 st Generation • Increased Security SSL VPN Drivers • User-Based Tunneling Increased security • Endpoint Security • Granular Access Control 80% Enable clientless VPNs 51% Decrease operating cost 41% Support wide variety of client platforms • Increased Return on Investment • Zero Client Software Costs • Zero Client Upgrade Costs and Pain • Zero Client Management Enable Employee access from handheld devices Enable employee access from kiosks and guest computers 38% 29% 23% % of respondents rating category a driver Source: Infonetics Research, 2006 • Universal Access • Employees, Non-Employees • Access from Any Device – No Device with VPN Client Required • Cross Platform Support (Mac, Linux, Windows, Smart Phones, PDAs) 15 © 2005 -06 Neo. Accel, Inc.

IPSec – Why not? • • Not designed for remote access Traversal problem over NAT devices Firewall configuration required All corporate services are exposed on f/w No Centralized Access control Per User administration and configuration Interoperability among vendors Time consuming deployment © 2005 -06 Neo. Accel, Inc.

What’s Missing in SSL VPN • Performance Degradation • SSL VPN falls prey to TCP over TCP melt-down • Extra context switching of SSL VPN’s causes performance loss • Poor End User Experience • Limited or no connectivity over low bandwidth or high packet loss networks like • Wireless • DSL • Data Cards • Increased Support Cost • No Site to Site VPN capabilities © 2005 -06 Neo. Accel, Inc.

Why Companies are Not Buying SSL ? • Extra context switching of SSL VPN’s causes performance loss • SSL VPN falls prey to TCP over TCP melt-down • Performance degradation affects the SSL gateway and all users • Many companies stay with IPSec to avoid user complaints What can IT do? © 2005 -06 Neo. Accel, Inc.

Neo. Accel: The Third-Generation VPN • Increased Security – User-Based Access Control with Endpoint Security • Increased ROI, Lower TCO – 10% of IPSec Costs in Large Installations • Ubiquitous Access – Any User from Any Device • IPSec-Level (or Better) Performance • Site-to-Site VPN Support – New! © 2005 -06 Neo. Accel, Inc.

Neo. Accel SSL VPN – Plus Features • Best of World of IPSec and SSL VPN • High Performance • • Overcomes TCP over TCP meltdown • Overcomes Extra Context Switch Designed for Remote Access Centralized Access Control Zero user side management One minute deployment Endpoint Security Clientless - Access Anywhere Network Extension • Access Anything • IPSec replacement capabilities • Site to Site VPN over SSL © 2005 -06 Neo. Accel, Inc.

Neo. Accel SSL VPN-Plus Deployment • Site-to-Site • Endpoint Security • Host Checking • Compression • 4 Forms of Access • Self-Updating Full. Client • Node on the Network • Supports VOIP • IPsec-Like Speeds • Client-Side Cleanup • High Availability Neo. Accel NAM-Plus Gatekeeper App Servers Directory Services Neo. Accel SSL VPN-Plus Gateway with HA Corporate Network / Data Center / DR Site-to-Site Access NAC Integration SSL VPN-Plus Gateway Internet Secure Remote Access roaming user Branch Office roaming user Wireless Users © 2005 -06 Neo. Accel, Inc. Sales Users Guest Users

End to End Secure Access Server Farms E-mail MRP/ERP SSL Applia nce MRP/ERP Unix/NFS Directory Store Intranet / Web Server Endpoint Security Compliance Data Transit Security § Strong Authentication • Eliminate PW Spoofing • Ensure Non-Repudiation § Host Checker • 3 rd Party Software Compliance • Registry, processes, files, custom DLLs • Application Authenticity Check • Recurring Host Check § Cache Cleaner • Eliminate session data • Delete temp files © 2005 -06 Neo. Accel, Inc. Network Security Services Hardened Appliance § Centralized Security Gateway § Network Security • • DDOS Protection URL Attack Protection Network Firewall SSL Transport § Dynamic Authentication Policy • Certificate, Source IP, Host Checker, Cache Cleaner, User Agent, Interface, etc. Dynamic Access Privilege Mgmt Directory Integration § Granular Authorization Rules • • Group Based URL, Host, Port Client/Destination End Point/Connection Check • In-Transit Data Protection • Data Trap • Non-Cacheable HTML rendering • Cookies • Host Name Encoding

PERFORMANCE © 2005 -06 Neo. Accel, Inc.

Packet Loss Leads to Performance Degradation • Packet Loss is a Real World problem • Packet loss translates to severe performance degradation due to architectural flaw in current SSL VPN products from the market leaders • In the US, it is not unusual to see 5~8% packet loss across the public internet • 15 -20% packet loss is typical in wireless networks (i. e. , 802. 11) • In some parts of Asia 50% packet loss is typical • Worldwide average is >24% packet loss © 2005 -06 Neo. Accel, Inc.

Other SSL VPNs: Packet flow This is what will be achieved. This happens when the user is working in office, i. e. connected to LAN D A A D A Private network servers SDSAD SSL VPN client agent running on remote users machine SD SAA D SSL VPN Gateway D: Application TCP data packet A: application TCP ACK packet SD: SSL tunnel data packet SA: SSL tunnel ACK packet © 2005 -06 Neo. Accel, Inc.

TCP-Over-TCP Meltdown All 1 st and 2 nd Generation SSL VPN’s are subject to TCP-Over TCP-Meltdown. Neo. Accel is not! © 2005 -06 Neo. Accel, Inc.

SSL VPN : Packet Drop This is what will be achieved. This happens when the user is working in office, i. e. connected to LAN A A D A Private network servers SADD SD SD SSL VPN client agent running on remote users machine SD SAA D SSL VPN Gateway D: Application TCP data packet A: application TCP ACK packet SD: SSL tunnel data packet SA: SSL tunnel ACK packet © 2005 -06 Neo. Accel, Inc.

How SSL VPN – Plus Improves Performance • Key Technologies • Intelligent Compression Acceleration Architecture (ICAA) : Overcomes TCP over TCP meltdown • Transparent SSL (TSSL) : Kernel ported SSL encryption engine. Reduces Context switching • Acceleration Triggered Compression Engine (ATCE) : Intelligent compression © 2005 -06 Neo. Accel, Inc.

SSL VPN – Plus : Packet Drop This is what will be achieved. This happens when the user is working in office, i. e. connected to LAN A D A Private network servers SD SD DD SSL VPN client agent running on remote users machine SA D SSL VPN Gateway D: Application TCP data packet A: application TCP ACK packet SD: SSL tunnel data packet SA: SSL tunnel ACK packet © 2005 -06 Neo. Accel, Inc.

Non Neo. Accel SSL VPN very slow, huge Packet Loss; TCP-Over-TCP problem Gateway Client Applications L 3 SSLVPN Module Open. SS L Open. SSL User Mode Kernel Mode Client TCP/IP Stack NIC DLL Server TCP/IP Stack Internet VNIC- TUN/TAP IP TCP SSL IP L 3 SSLVPN Module TCP VNIC- TUN/TAP NIC-1 NIC-2 Data Packet flowing across the network Client Context Switch 2 © 2005 -06 Neo. Accel, Inc. Server 2 Private Network

Neo. Accel' SSL VPN-Plus : Packet Flow Client Server Client Applications User Mode Kernel Mode Neo. Accel' SSL VPN-Plus ICAA integrated with kernel level SSL Neo. Accel' SSL VPN-Plus ICAA integrated with Kernel Level SSL Client TCP/IP Stack Server TCP/IP Stack Internet NIC DLL Context Switch Client Server 0 0 IP TCP SSL Node header NIC-1 NIC-2 Data Private Network Packet Processing and VPNization of TCP data © 2005 -06 Neo. Accel, Inc.

Comparison of Neo. Accel vs. Others IPSec SSL VPN App App TCP TCP Unencrypted User Neo. Accel SSL VPN-Plus App SSL ICAA TSSL #1 IP Kernel IP IP TCP Enet IPSec IP Enet © 2005 -06 Neo. Accel, Inc. Enet IP #2 Enet

Why ICAA? • It is observed that other SSL VPN vendors simply tunnel (proxy) a complete Ethernet frame over the SSL connection to private network resulting in two TCP layers for each packet. This results in redundant layer of reliability which causes TCP over TCP meltdown problem. (Slide 4) • Many of the applications are not designed to work over varying bandwidth lousy networks like Internet. • There are known issues with TCP layer when working over Internet. In case of SSL VPNs when multiple application TCP connections are tunneled into a single TCP connection, the effect of TCP problems is increased exponentially. This results in frequent connection disconnects. © 2005 -06 Neo. Accel, Inc.

ICAA Benefits • ICAA avoids the overhead of extra reliability layer induced because of tunneling application TCP traffic into SSL VPN TCP tunnel. • ICAA reduces TCP packet loss recovery time by 30 times by avoiding tunneling of TCP connection inside another TCP connection. • ICAA avoids the TCP layer limitations which makes TCP not suitable for remote application connections over WAN with varying bandwidth and congestion. ICAA avoids parameters like TCP window size and congestion window for each application connection. The parameters of a single SSL VPN TCP tunnel are applied to all application connections. • ICAA does not let application connection to flow over WAN, thus avoiding TCP slow start problem, fragmentation and avoids congestion control algorithm limitations for each application connection. • Even in 0% packet loss networks (like LAN), the number of packets are reduced by 50% straightaway. © 2005 -06 Neo. Accel, Inc.

Conventional SSL implementation slows downs the gateway Total User/Kernel Context Switches: 13 SYN+ACK Client Hello True Random Number Generator Server Hello, Server Certificate, Server Hello Done Client Key Exchange, Change cipher spec, client Finish Change cipher spec, Server Finish Host TCP/IP Stack Hardware Accelerator BN Mod Exponent 3 DES Decrypt Encrypted Request SHA-1 Calculation 3 DES Encrypted Response © 2005 -06 Neo. Accel, Inc. SHA-1 Calculation CONFIDENTIAL SSL Web Server

Neo. Accel’s TSSL Engine speeds up by saving 10 Context Switches Total User/Kernel Context Switches: 3 SYN+ACK Client Hello Server Hello, Server Certificate, Server Hello Done Client Key Exchange, Change cipher spec, client Finish Change cipher spec, Server Finish Host TCP/ IP Stack Web Hard- TSSL Server ware Engine SSL Connection Establishment Accelrator Encrypted Request Encrypted Response © 2005 -06 Neo. Accel, Inc. CONFIDENTIAL

Why TSSL? • It was observed that other SSL VPN vendors do encryption/decryption at application layer which is normally implemented at less privileged level in an OS (Slide 3, 4). This results in slow SSL processing resulting in high latency for applications connections • The high context switching of CPU results in slower packet processing, higher latency, less throughput and low user logins/sec. • Because SSL processing is done at user mode (less privileged mode of OS), there is an overhead between SSL module and SSL hardware accelerator cards. This results in less output from SSL hardware accelerator cards. © 2005 -06 Neo. Accel, Inc.

TSSL Benefits • TSSL avoids the CPU context switching for both SSL VPN Gateway and Client while handling each application connection over SSL VPN resulting in high tunnel throughput. • TSSL helps CPU spend less time doing non-VPN related tasks and helps process VPN data faster resulting in low latency and faster user logins per second. • TSSL enables SSL VPN Gateway and SSL VPN Client to do bulk encryption resulting in better throughput. • TSSL reduces the communication over head between SSL VPN Gateway and SSL accelerator card resulting in maximum throughput and higher SSL transactions per second. • TSSL helps control latency added because of SSL processing for real time traffic like VOIP and video. © 2005 -06 Neo. Accel, Inc.

Why ATCE (Dynamic Compression) ? • Other VPN solutions have a switch like functionality for compression. • Compression benefits are truly based on the available bandwidth and the current load on the VPN gateway. Other VPNs do not consider these factors • A ON/OFF functionality makes compression increase more load of VPN gateway even if compression of data is not required © 2005 -06 Neo. Accel, Inc.

ATCE Benefits • Calibrates compression benefits at regular interval of times. • Low bandwidth connections get more compression benefits compared to higher Internet bandwidth users • Data is compressed only if data is compressible • Optimizes the ratio of load/bandwidth © 2005 -06 Neo. Accel, Inc.

Performance Comparison © 2005 -06 Neo. Accel, Inc.

DEPLOYMENTS © 2005 -06 Neo. Accel, Inc.

SSL VPN-Plus Providing a single point of entry for all remote application needs, secure, reliable and user friendly. A Simple SSL VPN-Plus Solution deployment Private Corporate Network Neo. Accel SSL VPN-Plus Gateway Wireless/mobile user © 2005 -06 Neo. Accel, Inc.

Deployment Options © 2005 -06 Neo. Accel, Inc.

Deployment Options © 2005 -06 Neo. Accel, Inc.

Deployment Options © 2005 -06 Neo. Accel, Inc.

Deployment Options © 2005 -06 Neo. Accel, Inc.

Deployment Options © 2005 -06 Neo. Accel, Inc.

COMPONENTS © 2005 -06 Neo. Accel, Inc.

Various Components’ • Gateway: Base OS • Neo. Accel Hardened OS • SSL VPN-Plus Gateway • Authentication Module Ø Ø Ø Local Database LDAP AD Radius RSA Secure ID Certificate based authentication Ø ACL’s : Network and Application Access Control • Authorization Module • Auditing • End Point Security © 2005 -06 Neo. Accel, Inc.

Various Components’ Contd. • Access Terminals • SSL VPN-Plus portal : Clientless access named Web Access Terminal. Supports IE 5. 0 & above, Firefox, Net. Scape • SSL VPN-Plus client Ø QAT : Browser integrated java based port forward client. Supports Windows 2000, Windows XP, Windows Vista, Windows Server 2000 & 2003 Ø PHAT : Network Extension client. Supports Windows 98, Windows 2000, Windows XP, Windows Vista, Windows Server 2000 & 2003, Windows Mobile, Red Hat 9. 0, Red Hat EL 3, Knoppix, Debian, MAC OSX • Management Console • Requires JRE 1. 4. 2 or above on administrator’s PC © 2005 -06 Neo. Accel, Inc.

Full-Range, High-Capacity Product Line Feature SGX-800 SGX-1200 SGX-2400 SGX-4800 Target Market Entry-Level Sm-Med Enterprise Large Enterprise 50 100 2, 000 100 Mbps 250 Mbps 500 Mbps 950 Mbps Operating System NHOS* NHOS Gigabit Interfaces 4 2 2 2 Yes Yes Hardware Acceleration ─ ─ √ √ Dual Power Supply ─ ─ √ √ Dual Hard Drives ─ ─ √ √ Concurrent Users Throughput High Availability *Neo. Accel Hardened Operating System © 2005 -06 Neo. Accel, Inc.

Neo. Accel Management Console Module 1 © 2005 -06 Neo. Accel, Inc.

Neo. Accel Management Console The Neo. Accel Management Console (NMC) is a java based administration console. To access the NMC open a web browser and enter the following path http(s): //<ipaddress>/sslvpn-plus/nmc Example: https: //192. 168. 10. 1/sslvpn-plus/nmc To access the NMC from the Internet configure your firewall to allow TCP port 443 and TCP port 8090. Be sure to allow pop-up windows from the NMC URL. © 2005 -06 Neo. Accel, Inc.

Access Management Console. . contd • Management Console login: • Default power-user credentials: admin/admin © 2005 -06 Neo. Accel, Inc.

Menu Bar The Menu Bar at the top of the browser has multiple options • Logout of the NMC • Refresh • To refresh the NMC screen • Save current running configuration • Change Password • Change the admin password (recommended) • About • Copyright information • Help • Open Help resources © 2005 -06 Neo. Accel, Inc.

General The landing page is the System/General which displays information such as; Version Number, Processor Information, Memory Utilization and interface information. © 2005 -06 Neo. Accel, Inc.

Interface Configuration The interface configuration allows the administrator to change/modify ip address information for each network interface adapter. To configure the SSL VPN-Plus Gateway for single arm mode select the desired interface and check the box “Configure for Single ARM mode” and click Save. Advanced configuration allows specifying Link speed & MTU size © 2005 -06 Neo. Accel, Inc.

Route The route menu option displays currently configured routes. To add routes to other networks select the Add button and provide the necessary information. © 2005 -06 Neo. Accel, Inc.

DNS The DNS and Hosts Configuration sets parameter related to the SSL VPN-Plus Gateway. Setting Hostname, Primary and Secondary DNS servers as well as defining static computer hostname to IP address mappings. © 2005 -06 Neo. Accel, Inc.

NMC Administration Ability to create multiple administrators with different access over configuration of appliance ranging from full control, restricted or read only access. 1 Full control, 8 Restricted and 8 Read only administrators can be configured. © 2005 -06 Neo. Accel, Inc.

Module 2 – SSL VPN-Plus Module 2 focuses on creating and configuring the SSL VPN-Plus Gateway instance that end users will establish the tunnel with. It is possible and often useful to run multiple instances or gateways on a single device. This allows the administrator to provide different options for user connectivity. One example would be configuring a separate gateway for third party business partners who need tunnel connectivity. Creating a separate gateway with a single authentication source and other options is an effective way to plan your Remote Access strategy. © 2005 -06 Neo. Accel, Inc.

Gateways The Gateways menu allows you to Add/Modify/Remove gateways and parameters. The right hand side of the screen lists the configured options. © 2005 -06 Neo. Accel, Inc.

Modify Gateway Highlight the gateway in previous screen and select Modify. This opens a dialogue window with the General/Authentication and Advanced tabs. Administrator can define the IP address, port, certificate and the cipher used to encrypt traffic over SSL server. A broadcast message can be optionally specified to be displayed to all end users when they get connected to VPN. © 2005 -06 Neo. Accel, Inc.

Authentication Select the Authentication tab to change Authentication options such as Enable or Disable Authentication, prevent multiple logons with same username as well as prioritizing the cascaded authentication server list. Dual Authentication can be enabled wherein the end user will need to authenticate twice against two different authentication servers. © 2005 -06 Neo. Accel, Inc.

Certificate Authentication Enable Client certificate Authentication such that end user will need to provide a certificate to be able to access private network resources. CA list contains the list of CA certificates to which the client certificate can belong. Username can also be extracted from the certificate such that end user will only be allowed to enter password for username extracted from certificate used for authentication. © 2005 -06 Neo. Accel, Inc.

Portal Customization Portal customization allows complete redesign of how the web based access is visible to user. Look & feel can be chosen from a list of Layout & Color schemes. Layout scheme allows for logo, company name or title to be defined as per the corporation. Color scheme allows for complete change in look and feel of the portal. © 2005 -06 Neo. Accel, Inc.

Advanced The Advance tab sets parameters for Enabling Acceleration triggered Compression, Client Auto Update Notification, Endpoint Securing Agents, Virtual Keyboard, SSO, User Logging and timeout values and enabling Forced Timeout. © 2005 -06 Neo. Accel, Inc.

Active Clients The Active Clients shows the users who are logged into the SSL VPN-Plus and information regarding the tunnel established. The administrator can disconnect a single tunnel or all tunnels by select the appropriate button. © 2005 -06 Neo. Accel, Inc.

License The license screen shows the type of license, number of concurrent tunnels allowed and the option to Update License. © 2005 -06 Neo. Accel, Inc.

Update License Select the update license button and enter the Software Serial Number provided to you at time of installation. Click OK © 2005 -06 Neo. Accel, Inc.

Update License cont. • Select Copy to Clipboard • Open License Server • Paste this selection into the License server and retrieve your license • Paste the new license from clipboard • Select OK © 2005 -06 Neo. Accel, Inc.

Certificates Allows the administrator to Add/View/Remove SSL certificates for the gateway © 2005 -06 Neo. Accel, Inc.

Add Certificates Enter the Certificate name and browse to the location where the certificate is stored. Select the Private Key to import the Servers private key as well. © 2005 -06 Neo. Accel, Inc.

View Certificate Allows the administrator to view the contents of the SSL certificate. © 2005 -06 Neo. Accel, Inc.

Module 3 – Users/Groups The Neo. Accel SSL VPN-Plus allows granular control of users and groups. You will find that most of the power of this access control is based on group membership. The ability to limit access methods, apply access control policies, Provide resources to access, do cleanup as well as provide the user with a customized experience is gained by the use of Group policies. When using an external authentication source such as RADIUS or Active Directory it is not necessary to configure users directly on the gateway provided you have selected the Group Extraction option in the configuration of the external authentication servers. Upon presenting credentials to the PHAT client or Portal, the gateway will forward that request to the authentication server and extract the users group membership and apply configured Group Policies to that user. © 2005 -06 Neo. Accel, Inc.

Authentication Servers The SSL VPN-Plus Gateways supports the following authentication methods • Local Database • Active Directory with/without Group Extraction • RADIUS with/without Group Extraction • LDAP with/without Group Extraction • RSA Secure ID • Client Certificates – X. 509 SSL VPN-Plus utilizes a “cascading authentication” mechanism whereby the user credentials supplied at time of login can be validated against multiple authentication servers. Authentication servers are bound to the Gateway instance and not the User/Group. Order of search precedence is determined by the administrator. © 2005 -06 Neo. Accel, Inc.

Menu Section This menu selection will allow the administrator to configure Groups, Users and Auth Servers. © 2005 -06 Neo. Accel, Inc.

List of Authentication Servers © 2005 -06 Neo. Accel, Inc.

Add Auth Server - RADIUS • Select Server type RADIUS • Provide an alias identifier • Enter the IP address of the RADIUS server • Enter the Port listening on the server • Server timeout value in seconds • Shared secret • NAS IP Address • Retry count • Enable/Disable Group Extraction based on the Class attribute in the server Click OK to complete the operation © 2005 -06 Neo. Accel, Inc.

Auth Servers – Active Directory • • • Select Server type Define alias identifier Provide server ip address Set server listening port Set server timeout Configure AD search base Configure bind. DN Supply users password Set Login attribute name Set search filter Enable/Disable Group Extraction (continued next slide) © 2005 -06 Neo. Accel, Inc.

Auth Servers – Active Directory cont. • Set Group attribute name • Sub attribute name • Click OK to add Useful tool for extracting information from AD. LDAP Browser http: //www. ldapbrowser. com © 2005 -06 Neo. Accel, Inc.

Users - Local In many cases the administrator may want to create local users for authentication rather than using an external authentication server. One example would be allowing third party personnel to use the SSL VPN-Plus tunnel and rather than adding this third party user to Active Directory simple configure a local user. © 2005 -06 Neo. Accel, Inc.

Groups This screen shows a list of all Groups configured on the Gateway and allows the addition/modification or removal of Groups. © 2005 -06 Neo. Accel, Inc.

Add Group • • • © 2005 -06 Neo. Accel, Inc. Supply a Group Name Additional description to identify group Set Group Access Policies

Group - Portal • • © 2005 -06 Neo. Accel, Inc. Select Portal tab Enable/disable Public URL access Set Web App links available to this group Select Application list

Group – Portal cont. • File Share list • PHAT client package © 2005 -06 Neo. Accel, Inc.

Group – Network Extension • Allow QAT access • Start QAT automatically • Set Client Configuration Name • Select Tunnel mode • Define Default Gateway for full tunnel • Set Private Network list • Add IP Pool – only necessary if using PHAT access © 2005 -06 Neo. Accel, Inc.

Group – IP Pool (PHAT client) Select the Add button to set the IP Pool that will be assigned to the Group. IP Pools are like DHCP addresses that are configured to provide IP Address, Netmask, DNS servers, WINS server and other options. © 2005 -06 Neo. Accel, Inc.

Group – Private Network List Select the Private IP network that you want to allow via the tunnel. To select multiple subnets hold the Control key down and select then click Add. © 2005 -06 Neo. Accel, Inc.

Group – Private Network ICAA options The administrator can enable/disable private networks from using ICAA® technology. ICAA greatly increases traffic performance but in some cases is not compatible with certain applications/protocols. Exclude allows the administrator to direct the client computer to exclude portions of a private network subnet traffic from being sent over VPN tunnel. © 2005 -06 Neo. Accel, Inc.

Group – Logon & Logoff Scripts Upload certain scripts to be executed when the user gets connected to VPN or at the end of users VPN session. Scripts could be either a batch, Java or vb based. © 2005 -06 Neo. Accel, Inc.

Group – End Point Protection The administrator can enable certain data cleanup mechanisms for set of users belonging to a group. Either Browser cache cleanup can be enabled or blocking of cut/copy/paste can be enabled for the duration of end users session. Secure workspace can be activated such that end user will need to work inside a secure desktop and all data will be stored in a encrypted manner on end users machine, traces of which will be deleted at the end of users VPN session. © 2005 -06 Neo. Accel, Inc.

Authorization The authorization menu selection allows the administrator To configure Access Control Policies, Endpoint Security scans and Security Zones © 2005 -06 Neo. Accel, Inc.

Access Control Policies - ACL This screen is a repository of configured ACL’s. These ACL’s can be applied to Groups and Security Zones to control user access. Much like firewall rules take caution in applying these rules. © 2005 -06 Neo. Accel, Inc.

Add Policy – Network ACL © 2005 -06 Neo. Accel, Inc.

Add Policy – Application ACL Blacklist / Whitelist specific set of application from being executed during the VPN Session on the basis of name or MD 5 of the process. Block VPN Access to allow execution of process , but disallow any of the traffic generated by the process to be sent over VPN tunnel. © 2005 -06 Neo. Accel, Inc.

Apply Group Access Control Policy • Select Groups • Modify • Add ACL on General tab and set priority • OK © 2005 -06 Neo. Accel, Inc.

Endpoint Security Policies allow the administrator to define machine specific scans to validate whether the client computer meets the security policies of the company. These security scans, host validation, are pre-user authentication. The administrator can configure scans for the following items • File • Process • Registry • Ports • Services • WMI • Certificate Template EPS policies are evaluated in the following order of precedence Zone=AND Policy=OR Rule=AND © 2005 -06 Neo. Accel, Inc.

Endpoint Security Policies The SSL VPN-Plus comes with approximately 100 pre-configured Endpoint Security checks. The administrator can create custom check by selecting the Add button. © 2005 -06 Neo. Accel, Inc.

Modify Existing Policy © 2005 -06 Neo. Accel, Inc.

Creating Process Policy To create a Process policy use the Windows Task Manager to locate the running process to test for and note the executable name. In this case the test will check for Skype. exe running. © 2005 -06 Neo. Accel, Inc.

Add Policy – Skype running Select Add Rule and enter the required information © 2005 -06 Neo. Accel, Inc.

Completed Skype EPS check © 2005 -06 Neo. Accel, Inc.

EPS - File The administrator can check for the following attributes of Files by specifying the File Name and full path and File Properties. © 2005 -06 Neo. Accel, Inc.

EPS - Registry The administrator can test for the Existence of Registry entries. © 2005 -06 Neo. Accel, Inc.

EPS – Registry cont. The above example would check to determine if the client machine is a member of the company domain © 2005 -06 Neo. Accel, Inc.

EPS – Port Status This allows the administrator to perform a basic port scan on the Client machine to determine whether certain ports are open/closed/listening © 2005 -06 Neo. Accel, Inc.

EPS - Service This scan detects whether the client computer has a Windows service and whether the service is Running or Not Running. © 2005 -06 Neo. Accel, Inc.

EPS - WMI helps in reading dynamic database of Windows. Rules created using WMI are used to check for health of firewall, anti-virus, anti-spyware. © 2005 -06 Neo. Accel, Inc.

EPS – Certificate Template This scan helps to do a water mark check of the end users machine to identify a corporate issues machine © 2005 -06 Neo. Accel, Inc.

Security Zones Once the administrator has configured EPS policies, upon the client computer establishing a tunnel and prior to authentication, the results of the EPS scan will determine Zone membership. SSL VPN-Plus ships with 5 pre-configured Zones and the ability to create up to 40 different security zones. Membership of a particular zone starts at the Highest level and based upon Pass/Fail of the EPS policies will traverse downward into lower zones where ACL’s may be applied to limit resource access. Zones allow the administrator to over-ride Group policies and control access based upon the validation of the client computer. In general one should never add an allow policy to a Security Zone with the exception of the Quarantine Zone. © 2005 -06 Neo. Accel, Inc.

Zones © 2005 -06 Neo. Accel, Inc.

EPS – Modify Zone Allows the modification of EPS checks for particular Zone. © 2005 -06 Neo. Accel, Inc.

EPS – Modify Zone with ACL This example denies RDP based on the client be placed in Semi-Trusted Zone. © 2005 -06 Neo. Accel, Inc.

EPS Upgrade Periodic synchronization with Global EPS Upgrade server to update factory default list of policies with new releases of firewalls, anti-virus etc and security patches, service packs of windows. © 2005 -06 Neo. Accel, Inc.

Module 5 – Network Extension provides end users with various parameters for PHAT client access as well as QAT. © 2005 -06 Neo. Accel, Inc.

Dynamic IP Address – IP Pool • Functions like DHCP • Create multiple pools for assignment to groups © 2005 -06 Neo. Accel, Inc.

Create Dynamic IP Address Config Set a name, IP Range, Netmask, Primary and Second DNS, DNS suffix And if necessary WINS server and select OK © 2005 -06 Neo. Accel, Inc.

Private Network Lists • Define private network resources that users tunnels will access • Set multiple subnets/hosts for use by Groups © 2005 -06 Neo. Accel, Inc.

Create Private Network Profile Set Name, Private Network, Netmask, Gateway if necessary and Ports if desired. © 2005 -06 Neo. Accel, Inc.

Client Configuration Lists • Set client configuration options that apply to both PHAT and QAT © 2005 -06 Neo. Accel, Inc.

Add Client Configuration The Client Configuration allows the administrator to define various parameters to be applied. These parameters are then applied at the Group level to control such features as Show Endpoint Security Details, Idle Timeouts use DHCP for IP assignment and other parameters. © 2005 -06 Neo. Accel, Inc.

Installation Package Configuration PHAT • Create PHAT packages to be delivered to end users. • Create multiple PHAT packages and assign based on Group membership © 2005 -06 Neo. Accel, Inc.

Add Installation Package Set various client options for use with the PHAT client. © 2005 -06 Neo. Accel, Inc.

Module 6 - Portal The Portal selection allows the administrator to customize web based links that are presented to users upon successful login. The Layout and Colors selections allows the branding of the web based portal to your companies needs including logo and colors. © 2005 -06 Neo. Accel, Inc.

Module 6 - Portal List of Resources that are made available to Groups. © 2005 -06 Neo. Accel, Inc.

Module 6 - Portal Create Web Application which provides a quick link for users to access internal or external websites. © 2005 -06 Neo. Accel, Inc.

Module 6 - Portal Configures Thin Applications such as Telnet, RDP, VNC and SSH which allow the Groups to use integrated Java based applets. © 2005 -06 Neo. Accel, Inc.

Module 6 - Portal Defines web based File Access for CIFS files servers or shared directories. © 2005 -06 Neo. Accel, Inc.

Module 6 - Portal Allows the administrator to change the Login and Portal pages logos, titles and PHAT client banner. © 2005 -06 Neo. Accel, Inc.

Module 6 - Portal Modifies the web portal color scheme to meet your needs © 2005 -06 Neo. Accel, Inc.

Module 7 - Firewall © 2005 -06 Neo. Accel, Inc.

Add Filter Rule © 2005 -06 Neo. Accel, Inc.

Add Port Mapping © 2005 -06 Neo. Accel, Inc.

Module 8 - Tools © 2005 -06 Neo. Accel, Inc.

Ping © 2005 -06 Neo. Accel, Inc.

ARP © 2005 -06 Neo. Accel, Inc.

System Date/Time Allows the administrator to set date and time or synchronize with an external NTP resource © 2005 -06 Neo. Accel, Inc.

Miscellaneous Allows the import and export of the current configuration and other options. Pay special attention to the Client Upgrade URL. © 2005 -06 Neo. Accel, Inc.

Reboot / Shutdown Allows the administrator to Reboot the Gateway or gracefully Shutdown the gateway © 2005 -06 Neo. Accel, Inc.

Module 9 - Logs © 2005 -06 Neo. Accel, Inc.

Logs - User Settings Enable logging for the appliance wherein logs could either be stored on the appliance locally or be sent to an external syslog server periodically © 2005 -06 Neo. Accel, Inc.

Logs - User Settings Logs can be viewed on the system by selecting View Logs. The logs are refreshed every 10 seconds. © 2005 -06 Neo. Accel, Inc.

Logs - Reporting Generate log reports within a specific period of time and apply certain filters to pin point specific logs. These logs can either be viewed over NMC, exported and stored in CSV format in a Excel sheet or printed over printer. © 2005 -06 Neo. Accel, Inc.

Logs - Statistics View, save or print statistics on a daily or a weekly basis. Statistics can be used by administrators administrator for statistical analysis or usage of appliance © 2005 -06 Neo. Accel, Inc.

Thank You. © 2005 -06 Neo. Accel, Inc.