E-raamat: Juniper(r) Networks Secure Access SSL VPN Configuration Guide

Introduction		xi
Defining a Firewall		1	(46)
Introduction		2	(1)
Why Have Different Types of Firewalls?		2	(8)
Physical Security		2	(8)
Back to Basics: Transmission Control Protocol/Internet Protocol		10	(14)
TCP/IP Header		12	(12)
Firewall Types		24	(1)
Application Proxy		24	(4)
Pros		25	(1)
Cons		26	(2)
Gateway		28	(10)
Packet Filters		29	(3)
Stateful Inspection		32	(6)
Summary		38	(1)
Solutions Fast Track		38	(2)
Frequently Asked Questions		40	(7)
Setup		47	(30)
Introduction		48	(1)
Initial CLI Setup		48	(4)
IVE Console Setup		48	(4)
Initial Web Setup		52	(10)
Accessing the IVE through the WebUI		52	(1)
Configuring Date and Time		53	(2)
Configuring Licensing on the IVE		55	(2)
Network Settings in the AdminUI		57	(5)
Certificates		62	(7)
Generating a CSR		62	(6)
Other Certificates		68	(1)
Security and System Settings		69	(4)
Security Settings		69	(2)
System Options		71	(2)
Summary		73	(1)
Solutions Fast Track		73	(2)
Frequently Asked Questions		75	(2)
Realms, Roles, and Resources		77	(42)
Introducing Realms, Roles, and Resources		78	(2)
Configuring Realms		80	(19)
Selecting and Configuring General Settings		81	(6)
Selecting and Configuring Authentication Policies		87	(2)
Selecting and Configuring Role Mapping		89	(4)
Optimizing User Attributes		93	(5)
Admin Realms		98	(1)
Configuring Roles		99	(7)
User Roles		99	(1)
General Settings		99	(5)
Standard Options		104	(1)
Meeting Options		104	(1)
Admin Roles		105	(1)
Configuring Resources		106	(7)
Introducing Resource Profiles		107	(5)
Introducing Resource Policies		112	(1)
Summary		113	(1)
Solutions Fast Track		113	(3)
Frequently Asked Questions		116	(3)
Authentication Servers		119	(24)
Introduction		120	(1)
Local Authentication		121	(1)
LDAP		122	(7)
NIS		129	(1)
ACE		129	(2)
Radius		131	(2)
AD/NT		133	(2)
Anonymous		135	(1)
SiteMinder		135	(2)
Certificate		137	(1)
SAML		138	(1)
Summary		139	(1)
Solutions Fast Track		139	(2)
Frequently Asked Questions		141	(2)
Secure Application Manager		143	(38)
Introduction		144	(1)
Why Use SAM?		144	(1)
Feature Availability		145	(1)
Chapter Overview		145	(1)
Secure Application Manager		145	(5)
SAM Versions		146	(2)
How to Deploy the SAM Applet to Connecting Computers?		148	(2)
Secure Application Manager Implementation		150	(18)
Enabling SAM and Configuring Role Options		150	(3)
Configuring SAM on a Role		153	(5)
Configuring SAM Resource Policies		158	(4)
Configuring SAM Resource Profiles		162	(6)
Secure Application Manager User Experience		168	(1)
Troubleshooting		169	(8)
Secure Application Manager Troubleshooting		169	(8)
Summary		177	(1)
Solutions Fast Track		177	(2)
Frequently Asked Questions		179	(2)
Terminal Services and Citrix		181	(40)
Introduction		182	(3)
Why Use the Juniper Citrix Terminal Services Proxy?		183	(1)
Feature Availability		184	(1)
Chapter Overview		184	(1)
Terminal Services		185	(17)
Terminal Services Implementation		186	(9)
Configuring Terminal Services Resource Policies		195	(1)
Configuring Terminal Services Resource Profiles		196	(3)
Configuring Terminal Services and Citrix Using a Hosted Java Applet		199	(2)
Terminal Services User Experience		201	(1)
Citrix		202	(10)
Citrix Client Types		205	(2)
Citrix Implementation		207	(3)
Citrix User Experience		210	(1)
Launching Terminal Services Sessions and Java Applets from an External Site		211	(1)
Terminal Services and Citrix Troubleshooting		212	(5)
IVE-Side Troubleshooting		213	(4)
Summary		217	(1)
Solutions Fast Track		217	(2)
Frequently Asked Questions		219	(2)
Network Connect		221	(36)
Introduction		222	(2)
Why Use Network Connect?		223	(1)
Feature Availability		224	(1)
Chapter Overview		224	(1)
Network Connect		224	(24)
Network Connect Implementation		225	(9)
Configuring Network Connect Resource Policies		234	(9)
Network Connect Implementation Options		243	(3)
Network Connect Client Distribution		246	(2)
Network Connect Troubleshooting		248	(5)
Summary		253	(1)
Solutions Fast Track		253	(2)
Frequently Asked Questions		255	(2)
Endpoint Security		257	(78)
Introduction		258	(1)
Host Checker		258	(46)
Host Checker Functionality		259	(1)
Host Checker Components		259	(13)
Configuring Host Checker Rules		272	(22)
Applying Host Checker Policies to the IVE		294	(8)
Troubleshooting Host Checker		302	(2)
Cache Cleaner		304	(8)
Cache Cleaner Deployment		304	(4)
Implementing Cache Cleaner		308	(4)
Secure Virtual Workspace		312	(8)
Secure Virtual Workspace Options		312	(8)
IVE/IDP Integration		320	(10)
IDP/IVE Signaling		322	(8)
Summary		330	(1)
Solutions Fast Track		331	(2)
Frequently Asked Questions		333	(2)
Web/File/Telnet/SSH		335	(66)
Introduction		336	(1)
Clientless Remote Access Overview		336	(2)
Web Access Overview		336	(1)
File Access Overview		337	(1)
Telnet/SSH Access Overview		337	(1)
Web Access		338	(40)
Web Bookmarks		338	(5)
Web Resource Policies		343	(29)
Web Resource Profiles		372	(1)
Web Resource Profile Types		373	(5)
File Access		378	(13)
File Bookmarks		378	(6)
File Resource Policies		384	(6)
File Resource Profiles		390	(1)
Telnet/SSH Access		391	(6)
Telnet/SSH Sessions		392	(3)
Telnet/SSH Resource Policies		395	(2)
Summary		397	(1)
Solutions Fast Track		397	(2)
Frequently Asked Questions		399	(2)
Maintenance Section		401	(46)
Introduction		402	(1)
System		402	(9)
Platform		403	(1)
Upgrade/Downgrade		404	(2)
Options		406	(2)
Installers		408	(3)
Import/Export		411	(7)
System (Binary) Import/Export		411	(2)
User Accounts (Binary) Import/Export		413	(1)
IVS Import/Export		414	(1)
XML Import/Export		415	(3)
Push Configuration		418	(2)
Targets		419	(1)
Results		420	(1)
Push Config Transport		420	(1)
Archiving		420	(2)
Archiving Servers		420	(2)
Local Backups		422	(1)
Troubleshooting		422	(19)
System Status and Resource Trending		423	(2)
User Sessions: Policy Tracing and Simulation		425	(5)
Session Recording		430	(3)
System Snapshot		433	(1)
TCP Dump		434	(2)
Commands		436	(1)
Remote Debugging		437	(1)
Debug Logs		438	(1)
Node Monitor		439	(1)
Cluster: Network Connectivity		440	(1)
Summary		441	(1)
Solutions Fast Track		441	(3)
Frequendy Asked Questions		444	(1)
Links to Sites		445	(2)
System Section		447	(32)
Introduction		448	(1)
Status		448	(2)
Active Users		450	(1)
Meeting Schedule		450	(1)
Configuration		450	(13)
Licensing		451	(1)
Security		452	(1)
Certificates		452	(5)
NCP		457	(1)
Sensors (IDP)		457	(3)
Client Types		460	(2)
Secure Meeting		462	(1)
Network		463	(3)
Overview		463	(1)
Internal + External Port Management		464	(1)
VLANs		465	(1)
Routes		465	(1)
Hosts		466	(1)
Network Connect		466	(1)
Clustering		466	(3)
Status		467	(1)
Cluster Properties		468	(1)
Virtual Systems		469	(1)
Management		470	(1)
Logging/Monitoring		470	(6)
Logging		470	(3)
Sensor Logging		473	(1)
Client Logs		473	(1)
SNMP		473	(2)
Statistics		475	(1)
Summary		476	(1)
Solutions Fast Track		476	(2)
Frequently Asked Questions		478	(1)
Sign-in Policies		479	(30)
Introduction		480	(1)
IVE Sign-in Structure		480	(1)
IVE Licensing		481	(1)
Sign-in Pages		481	(14)
Standard Sign-in Pages		482	(3)
Secure Meeting Sign-in Pages		485	(2)
Configuring a Standard Sign-in Page		487	(1)
Custom Sign-in Pages		487	(8)
Sign-in Policies		495	(11)
IVE Licensing		496	(1)
Sign-in Policy Types and Properties		496	(2)
Sign-in Policy Evaluation		498	(3)
Creating Sign-in Policies		501	(3)
Sign-in Policy Maintenance		504	(2)
Summary		506	(1)
Solutions Fast Track		506	(2)
Frequently Asked Questions		508	(1)
Logging		509	(40)
Introduction		510	(1)
Log Types and Facilities		510	(11)
Log Severity Levels		510	(1)
Event Logs		511	(2)
User Access Logs		513	(3)
Admin Access Logs		516	(2)
Sensor Logs		518	(1)
Client Logs		518	(1)
Active User Logs		519	(1)
Meeting Schedule		520	(1)
Log Filtering		521	(5)
Log Formats		521	(2)
Log Filtering		523	(3)
Log Management		526	(1)
Saving Logs		526	(1)
Deleting Logs		527	(1)
Syslog Exporting		527	(2)
Setting Up Syslog Exporting		528	(1)
SNMP Management		529	(7)
SNMP Configuration on the IVE		530	(4)
SNMP Objects		534	(2)
System Resource Monitoring		536	(6)
System Statistics		536	(2)
Central Management Graphs		538	(4)
Reporting		542	(3)
ClearView Reporter Feature Overview		542	(2)
Other Reporting Tools		544	(1)
Summary		545	(1)
Solutions Fast Track		545	(2)
Frequently Asked Questions		547	(2)
Enterprise Features		549	(18)
Introduction		550	(1)
Instant Virtual Systems		550	(3)
VLANs and Source Routing		553	(1)
Administration Techniques		554	(2)
Network Connect Considerations		556	(1)
Clustering		556	(5)
Understanding Cluster Communication and Status		561	(2)
Summary		563	(1)
Solutions Fast Track		563	(2)
Frequently Asked Questions		565	(2)
Index		567

Rob Cameron (JNCIS-FWV, JNCIA-M, CCSP, CCSE+) is a Security Solutions Engineer for Juniper Networks. He currently works to design security solutions for Juniper Networks that are considered best practice designs. Rob specializes in network security architecture, firewall deployment, risk management, and high-availability designs. His background includes five years of security consulting for more than 300 customers. This is Robs second book; the previous one being Configuring NetScreen Firewalls (ISBN: 1-932266-39-9) published by Syngress Publishing in 2004. Neil R. Wyler (JNCIS-FWV, JNCIA-SSL) is an Information Security Engineer and Researcher located on the Wasatch Front in Utah. He is the co-owner of two Utah-based businesses, which include a consulting firm with clients worldwide and a small software start-up. He is currently doing contract work for Juniper Networks, working with the companys Security Products Group. Neil is a staff member of the Black Hat Security Briefings and Def Con hacker conference. He has spoken at numerous security conferences and been the subject of various online, print, film, and television interviews regarding different areas of information security. He was the Lead Author and Technical Editor of Aggressive Network Self-Defense (Syngress, 1-931836-20-5) and serves on the advisory board for a local technical college.