Whats New in Watch Guard SSL v 3

What’s New in Watch. Guard SSL v 3. 2

Watch. Guard SSL v 3. 2 q q q q q Windows 8 and 64 -bit Internet Explorer Support Outlook Anywhere Support Nested Group Support Access Client Settings Synchronization Access Client History Menu Optimized Assessment Scan Confirmation for Startup Commands DNS Suffix Assignment Log File Rotation Deletion Watch. Guard Training 2

Windows 8 and 64 -bit Internet Explorer Support q The SSL device now fully supports the Windows 8 operating system (32 -bit and 64 -bit). q 64 -bit Internet Explorer is now supported with new Active. X loaders for Assessment, Abolishment, and the Access Client. Watch. Guard Training 3

Outlook Anywhere Support q With Microsoft Outlook Anywhere (also known as RPC over HTTP), end users with the Outlook client can get access to corporate email and calendars over the Internet from outside the corporate domain without having to log into a VPN. Watch. Guard Training 4

Outlook Anywhere Support q The SSL device now supports Outlook Anywhere • • The Exchange server does not need to be exposed externally. The processing burden of SSL encryption/decryption is offloaded to the SSL device instead of the Exchange server. Minimal impact on your current network topology. Provides a web resource-based solution (no additional client) and has no impact to the end user Outlook experience. Watch. Guard Training 5

Outlook Anywhere Support — Configuration q To enable Outlook Anywhere on your Exchange Server: • http: //technet. microsoft. com/en-us/library/bb 123542. aspx q To enable Outlook Anywhere on the Outlook Client: • http: //office. microsoft. com/en-us/outlook-help/use-outlook-anywhere-toconnect-to-your-exchange-server-without-vpn-HP 010102444. aspx Watch. Guard Training 6

Outlook Anywhere Support — Configuration q Create client definition for Outlook Anywhere • • Select Manage System > Client Definition. Add Client Definition. Ø uri=*/rpc/* Watch. Guard Training 7

Outlook Anywhere Support — Configuration q Define Client Access settings • Select Resource Access > Manage Global Resource Settings > Client Access Ø Enable these options: – The client does not support cookies – The client cannot authenticate using HTML or WML forms Watch. Guard Training 8

Outlook Anywhere Support — Configuration q Create an OWA Web Resource • • Create a path “rpc/” for Outlook Anywhere “Microsoft-Server-Active. Sync” for Active. Sync q Create an Authentication Method access rule • • • Outlook cannot select an authentication method, so you must determine the authentication method. Apply the access rule on the “rpc/” path If there is only one enabled Authentication Method, this step is not necessary. q Enable SSO • • Create an SSO for Outlook Anywhere Apply on the “rpc/” path Enable the Authentication Method to save login credentials for the SSO Outlook Anywhere and Active. Sync can share one SSO, but OWA cannot because it requires DomainUser name as user name by default. Watch. Guard Training 9

Outlook Anywhere Support — Configuration q Create a Listener (Optional) • • This step is necessary only if you require separate services for Outlook Anywhere, Active. Sync, Outlook Web Access, and regular VPN access. Import a certificate (Manage System > Certificates) Watch. Guard Training 10

Outlook Anywhere Support — Configuration q Create a Listener (Optional) • Create a listener (Manage System > Device Settings) Watch. Guard Training 11

Outlook Anywhere Support — Configuration q Create a Listener (Optional) • Apply NAT for the listener to the external Internet interface on your firewall Watch. Guard Training 12

Outlook Anywhere Support — Configuration q Create a DNS name for device • Link the DNS name to the OWA Web Resource Ø In this example, the Access Point will load this web resource when the client request contains “owa 2. watchguard. com” Watch. Guard Training 13

Nested Group Support q The SSL device now correctly supports nested groups (a ‘child’ user group that belongs to another group) within directory services. q Nested groups are now processed correctly when: • Access rules are applied • Viewed within reports • Viewed in the group display in the admin Web UI Watch. Guard Training 14

Access Client Settings Synchronization q You can store and synchronize individual Access Client preferences, history, and favorite resources on the SSL device. q Synchronization is enabled by default on the SSL device. q On the SSL device, select User Management > Global User Account Settings, then select the new User Client Settings Sync tab. Watch. Guard Training 15

Access Client — Synchronization Settings q New Synchronization tab on the Access Client preferences page: • • • Sync Server — Enter or select your sync server, which is the address of the SSL device. Enable automatic synchronization — Automatically perform a sync when you are connected to the SSL device through a VPN tunnel. Synchronize Now — Perform a manual sync. If you are not connected to the SSL device through a VPN tunnel, you are prompted to authenticate. Watch. Guard Training 16

Favorites — Add Favorite for All New Users q You can add favorites globally for new users, or for a specific user, that can be synchronized to their Access Client settings. q To add favorites that will be synchronized to new users: • • • Click User Management > Global User Account Settings. Select the User Client Settings Sync tab. Click Add Favorite Resource. Watch. Guard Training 17

Favorites — Add Favorite for Specific User q To manage favorites for a specific user: • • • Select User Management > User Accounts. Select a specific user. Select the Favorites tab. q Click Add Favorite Resource. Watch. Guard Training 18

Access Client — History Menu q When a user loads a tunnel successfully, the details of the tunnel configuration are automatically saved in the Access Client History. q Users can easily open a recently accessed tunnel resource. q The History menu can contain a maximum of 15 items. Watch. Guard Training 19

Optimized Assessment Scan q Caches the results of assessment access rules to improve the efficiency of assessing connections where multiple access rules are applied globally or applied to many resources. q To configure the behavior of assessment results caching: • • Select Manage System > Assessment. Select the General Settings tab. Watch. Guard Training 20

Optimized Assessment Scan q These options are enabled when you create a corresponding assessment access rule, and enable you to collect and cache this information: • • • Windows Process Network Anti-virus Firewall Anti-spyware q If you remove the original access rules, these options remain enabled for caching purposes. q Disable these options to improve client scanning efficiency during assessment when you no longer require these assessment options. Watch. Guard Training 21

Confirmation for Startup Commands q A Confirm Command option has been added to the Startup tab of a tunnel resource. • • • When enabled, the end user is prompted to confirm the command before it is run. If this option is disabled, the command is run automatically without confirmation. By default, this option is enabled for all resource wizards except RDP Access and SSH Access, where the command text is not readable. Watch. Guard Training 22

DNS Suffix Assignment q The DNS suffix for a connection is now always applied, even if an IP address assignment fails. q The DNS suffix is assigned automatically if DNS forwarding is enabled in the advanced settings of the Tunnel resource. q The DNS suffix is assigned based on your configured DNS Search Order field on the Manage System > Network Configuration page. Watch. Guard Training 23

Log File Rotation Deletion q You can now configure how many log files to keep on the system before they are deleted. q This prevents excessive log files from filling up your disk space. q For each type of log, in the Log File Rotation section you can configure the Max Files in Rotation. The default is 90. Watch. Guard Training 24

Thank You!