19.2 Configuring the IP Address, Port, and NAT

This section describes how to configure the IP addresses, port, subnet address and subnet mask, and protocol for SSL VPN.

19.2.1 Configuring the SSL VPN Gateway without NAT

If your SSL VPN gateway is not configured behind NAT (Network Address Translation), complete the following procedure:

  1. In the Administration Console, click Access Manager > SSL VPNs > Edit.

    The Server configuration page is displayed.

  2. Select Gateway Configuration from the Basic Gateway Configuration section.

    The SSL VPN Gateway Basic Configuration page is displayed.

    Configuring Gateway

    Fill in the following fields:

    • Behind NAT: Do not select this check box.

    • External IP Address: When the Behind NAT check box is not selected, this option is disabled.

    • Listening IP Address: Specify the IP address that SSL VPN listens on. By default, both Enterprise mode as well as Kiosk mode listen on this IP address, but Kiosk Mode listens on the TCP protocol whereas the Enterprise Mode listens on the UDP protocol.

    • Private Address(es): Specifies the IP address of the private interface of the network card. If you have multiple private networks, specify the private IP addresses of the servers, separated by a comma.

    • Encryption Port: The port to encrypt traffic. The default encryption port is 7777.

    • Connection Manager Port: The port on which the connection manager listens to. The default port number is 2010.

      If you change the connection manager port from 2010 to any other port, do the following:

      1. Open config.txt, located at /var/opt/novell/tomcat4/webapps/sslvpn/WEB-INF and change the port number found in the first line of the file to the new number.

      2. Restart the SSL VPN server manually by entering the following commands:

        /etc/init.d/novell-sslvpn stop

        /etc/init.d/novell-sslvpn start

      3. Restart Tomcat manually by entering the following commands:

        /etc/init.d/novell-tomcat4 stop

        /etc/init.d/novell-tomcat4 start

    • OpenVPN Subnet Address: Specify the IP address for the OpenVPN subnet, which is used with the OpenVPN Subnet Mask field to define a pool of addresses that can be dynamically assigned to clients. This information is essential to provide Enterprise mode access.

      NOTE:Make sure that the assigned subnet address and the IP address of the client do not match.

    • OpenVPN Subnet Mask: Specify the mask for the OpenVPN subnet, which is used to define the address pool. This information is essential to provide Enterprise mode access.

      NOTE:For a given subnet mask:

      The number of client connections = (Available IPs based on subnet mask - 2[0 and broadcast address] - 2[for VPN server and server OS] - 4[only if subnet mask is greater than 29]) / 4

    • OpenVPN Port: Specify the OpenVPN port number on which the OpenVPN service listens. This information is essential to provide Enterprise mode access.

    • OpenVPN Protocol: Specify the OpenVPN service protocol. The protocol can either be TCP or UDP. This information is essential to provide Enterprise mode access.

    • Provide Additional IP Address for OpenVPN: Select this check box if you want to provide an additional listening IP address for SSL VPN in the Enterprise mode. By default, both Kiosk mode as well as Enterprise mode listens on the same IP address and port 777, but use different protocols. If you want both the modes to listen on same the protocol and port, then you can select this check box provide an additional IP address for Enterprise mode to listen in the OpenVPN Listening IP Address field. This way, kiosk mode listens on the Listening IP Address that you have configured and Enterprise mode listens on the OpenVPN Listening IP Address, while using the same port and protocol.

      For example, if you want both Kiosk and Enterprise mode to listen on TCP protocol and port 443, then you can add an additional IP address in the OpenVPN Listening IP Address field for Enterprise Mode. In that scenario, Kiosk mode listens on the IP address that you configured in the Listening IP Address field, TCP protocol, and port 443; and Enterprise mode listens on the alias IP address that you configured in the OpenVPN Listening IP Address field, TCP protocol, and port 443.

      NOTE:This is an optional configuration and SSL VPN will continue to operate in both Enterprise mode as well as Kiosk mode, even if this additional IP address is not provided.

    • OpenVPN Listening IP Address: This field is enabled if you select the Provide Additional IP Address for OpenVPN check box. Specify the additional IP address that the SSL VPN will listen on in the Enterprise mode.

    • OpenVPN NAT External IP Address: This field is not enabled if the servers are not behind NAT.

    • Inactivity Timeout (Minutes): Configure the time in minutes after which an idle connection should be closed. If no data exchange takes place during the stipulated time, the connection is closed. An inactive connection is closed after a stipulated time so that the resources are freed to allow additional incoming connections. The inactivity timeout period can be one minute to 1800 minutes. The default inactive timeout period is 30 minutes.

    • Encryption: Select the type of encryption. It can be either AES 128 or AES 256. AES 256 is the default and recommended encryption mode.

    • Debug Level: Set this option to On if you want more information in the log files. This option is set to Off by default. Setting the debug level to On helps the administrator in solving any issues with the SSL VPN.

  3. To save your modifications, click OK, then click Update on the Configuration page.

19.2.2 Configuring the SSL VPN Gateway behind NAT

You can configure SSL VPN to be behind NAT. When you do this, you must provide an external IP address, which will be associated with the internal IP address.

Figure 19-1 Configuring SSL VPN behind NAT

  1. In the Administration Console, click Access Manager > SSL VPNs > Edit.

    The Server configuration page is displayed.

  2. Select Gateway Configuration from the Basic Gateway Configuration section.

    The SSL VPN Gateway Basic Configuration page is displayed.

    You can configure NAT as follows:

    • Behind NAT: Select the check box to specify that the SSL VPN Gateway is behind NAT.

    • External IP Address: This field is enabled when the Behind NAT check box is selected. Specify the IP address by which the external user on the Internet can access the SSL VPN server.

    • OpenVPN NAT External IP Address: This field is enabled if you select the Behind NAT and Provide Additional IP Address for OpenVPN check boxes. Specify the external IP address, when the server is behind NAT in the Enterprise mode. This is an optional configuration and the SSL VPN operates in Enterprise mode as well as Kiosk mode, even if this additional IP address is not provided.

    NOTE:For more information on configuring other fields, refer to Section 19.2.1, Configuring the SSL VPN Gateway without NAT.

  3. To save your modifications, click OK, then click Update on the Configuration page.