1. In the Locations tree of the Management Console, select the location.

   

2. Configure the settings as desired:

   • Name: Provide a unique name for the location. The name should be easily recognizable to Security Client users.

   • Description: Provide a description for the location.

   • Icon: The location icon provides a visual cue to the user which identifies their current location. The location icon displays on the taskbar in the notification area. Use the list to view and select from the available location icons.

   • Update Interval: This setting determines how often the Security Client checks for a policy update when it enters this location. The frequency time is set in minutes, hours, or days. Deselecting this parameter means the Security Client does not check for an update at this location.

   • User Permissions: The following settings determine what the user is allowed to do within the location:

     • Allow Manual Location Change: Permits the end user to change to and from this location. For non-managed locations (such as hot-spots, airports, and hotels), this permission should be granted. In controlled environments, where the network parameters are known, this permission can be disabled. The user cannot switch to or from any locations when this permission is disabled. Instead, the location the Security Client chooses (based on the network environment) is the one that is applied.

     • Save Network Environment: Allows the user to save the network environment to this location, to permit automatic switching to the location when the user returns. Recommended for any locations the user might need to switch to. Multiple network environments can be saved for a single location. For example, if a Location defined as Airport is part of the current policy, each airport visited by the user can be saved as a network environment for this location. This way, a mobile user can return to a saved airport environment, and the Security Client will automatically switch to the Airport location, and apply the defined security settings. A user may, of course, change to a location and not save the environment.

     • Allow Manual Firewall Settings Change: Allows a user to switch from one firewall setting to another.

     • Show Location in Client Menu: Displays the location in the Security Client menu. If this is not selected, the location is never displayed.

   • Use Location Message: Allows an optional Custom User Message to display when the Security Client switches to this location. This message can provide instructions for the end user, details about policy restrictions under this location, or include a hyperlink to more information.

1. In the Locations tree of the Management Console, click the + sign next to the location to expand the location settings, then select Comm Hardware.

   

2. For each communication hardware type listed below, select Apply Global Settings, Allow All Access, or Disable All Access:

   • 1394 (FireWire): Controls the FireWire access port on the endpoint.

   • IrDA: Controls the infrared access port on the endpoint.

   • Bluetooth: Controls the Bluetooth access port on the endpoint.

   • Serial/Parallel: Controls serial and parallel port access on the endpoint.

   • Dialup: Controls modem connectivity for the location. If you want to limit access to specific modems, set this option to Allow All Access and then add the approved modems to the Approved Dial-Up Adapters list.

   • Wired: Controls LAN card connectivity by location. If you want to limit access to specific wired adapters, set this option to All Access and then add the approved adapters to the Approved Wired Adapters list.

3. (Optional) If you selected Allow All Access for the Dialup or Wired settings and you want to limit the adapters that are allowed, add the approved adapters to the appropriate list (Approved Wired Adapters or Approved Dialup Adapters).

   Partial adapter names are permitted. Adapter names are limited to 50 characters and are case sensitive. Only the adapters included in the list are allowed; all other adapters are blocked.

4. (Optional) If you have enabled Wi-Fi (see Wi-Fi Management) and you want to limit the wireless adapters that are allowed, add the approved adapters to the Approved Wireless Adapters list.

   Partial adapter names are permitted. Adapter names are limited to 50 characters and are case sensitive. Only the adapters included in the list are allowed; all other adapters are blocked.

   If the endpoint is in a location that defines only a Wi-Fi access point’s SSID as the network identification (see Wi-Fi Management), the Security Client switches to that location before disabling the unauthorized adapter. A password override should be used to provide a manual location switch if this occurs.

5. Click Save Policy to save the changes.

1. In the Locations tree of the Management Console, click the + sign next to the location to expand the location settings, then select Storage Device Control.

   

2. For CD/DVD, Removable Storage, and Floppy Drive, select one of the following options:

   • Apply Global Setting: Use the global Storage Device Control setting.

   • Allow All Access: Read/write access is allowed.

   • Disable All Access: All access is prevented. When users attempt to access files on a defined storage device, they receive an error message from the operating system or the application attempting to access the local storage device, indicating that the action has failed

   • Read-Only Access: Read-only access is allowed. When users attempt to write to the device, they receive an error message from the operating system or the application attempting to access the local storage device, indicating that the action has failed

   CD/DVD controls all devices listed under DVD/CD-ROM drives in Windows Device Manager. Removable Storage controls all devices listed under Floppy disk drives in Windows Device Manager. Floppy Drive controls all devices listed under Floppy disk drives in Windows Device Manager.

   To disable CD-ROM drives or floppy drives or to set them as read-only, the endpoint device’s Local Security Settings must have both Devices: Restrict CD-ROM access to locally logged-on user only and Devices: Restrict floppy access to locally logged-on user only set as Disabled. By default, these settings are disabled. If you need to disable them or verify that they are disabled, open either the Active Directory group policy object or open Administrative Tools on the target devices. Look in Local Security Settings - Security Options and verify that both settings are disabled.

To add a firewall setting:

1. In the Locations tree of the Management Console, click the + symbol next to the location to expand the location settings, then select Firewall Settings.

2. If you want to define a new firewall setting, click New Component on the Policy toolbar.

   or

   If you want to add an existing firewall setting, click Associate Component on the Policy toolbar.

   The firewall setting is added under the Firewall Settings folder in the Locations tree. If you add a new firewall setting, the name is displayed as New Firewall Settings. If you add an existing firewall setting, the setting’s name is displayed

   

3. On the Firewall Settings page, fill in the following fields:

   • Name: Specify a name for the firewall setting

   • Description: Specify a description.

   • Default Behavior: Select the default behavior for the TCP/UDP ports:

     • Open: All network inbound and outbound traffic is allowed.

     • Closed: All inbound and outbound network traffic is blocked.

     • Stateful: All unsolicited inbound network traffic is blocked. All outbound network traffic is allowed.

       Please note that the Stateful setting does not allow an active FTP session; you must use passive FTP instead. A good reference to explain active versus passive FTP is the Slacksite Web site.

     You can use the TCP/UDP Ports page and the Access Control Lists page to override these default settings for specific ports and protocols.

     For example, assume that the default behavior for all ports is set as All Stateful. The ports lists for Streaming Media and Web Browsing are added to the firewall setting. The Streaming Media port behavior is set as Closed, and the Web Browsing port behavior is set as Open. Network traffic through TCP Ports 7070, 554, 1755, and 8000 would be blocked. Network traffic through ports 80 and 443 would be open and visible on the network. All other ports would operate in Stateful mode, requiring the traffic through them be solicited first.

   • Show Firewall in Client Menu: Select this option to have the firewall displayed in the Security Client menu. This is necessary only if the user is allowed to switch firewalls for a location (see User Permissions).

4. If you want this firewall setting to be the default for this location, right-click the firewall setting in the Location tree, then click Set as Default.

5. Click Save Policy to save your changes.

6. Configure the desired firewall settings by referring to the following sections:.

   • TCP/UDP Ports

   • Access Control Lists

   • Application Controls

1. In the Locations tree of the Management Console, select the Network Environments folder (Defined Locations > location > Network Environments).

2. If you want to define a new network environment, click New Component on the Policy toolbar.

   or

   If you want to add an existing network environment, click Associate Component on the Policy toolbar.

   The network environment is added under the Network Environments folder in the Locations tree. If you add a new network environment, the name is displayed as New Network Environments. If you add an existing network environment, the environment’s name is displayed.

   

3. Name the network environment and provide a description

4. If you want to limit when this network environment is available based on adapter type, use the Limit to Adapter Type field to select the allowed adapter type. The default (All) allows all adapter types.

5. For each service (Gateway, DNS Servers, DHCP Servers, and WINS Server) you want to use to define the network, specify the following information to define the service:

   • IP Address: Limited to 15 characters. Use only the numbers 0-9 and periods (for example, 123.45.6.789)

   • MAC Address (Optional): Limited to 12 characters. Use only the numbers 0-9 and the letters A-F (uppercase and lowercase) separated by colons (for example, 00:01:02:34:05:B6). The DNS Servers list does not include this field.

   • Must Match: Select whether the presence of this service is required to identify the network environment

6. For Dialup Connections, specify the phone book entry:

   The RAS Entry name from the phone book or the dialed number can be specified. Phone book entries can contain alphanumeric characters (a-z, 1-9) and special characters (@, #, $,%, -, etc.), but cannot contain only numeric characters and special characters. Entries that only contain special and numeric characters are assumed to be dialed numbers.

7. If you want to restrict the allowed adapters to specific adapters, use the Adapters list.

   Adapters can be specified to restrict the allowed adapter types (see Step 4) to specific adapters. Enter the SSID for each allowed adapter. If no SSIDs are specified, all adapters of the permitted type are granted access

8. In the Minimum Match field, select the minimum number of network services that must match in order for this network environment to match the device’s current environment.

   This number must be equal to or greater than the number of Must Match services you defined. For example, if you defined four Must Match services and ten optional services, you could specify 7 in the Minimum Match field. This would required all four Must Match services to be matched along with any three of the ten optional services.

9. Click Save Policy to save your changes.

To configure the Wi-Fi Management settings:

1. In the Locations tree of the Management Console, click the + sign next to the location to expand the location settings, then select Wi-Fi Management.

   

2. Select Enable Wi-Fi to enable wireless transmissions in this location.

   This setting enables or disables the endpoint device’s wireless adapters. It applies to all supported Security Client operating systems (Windows 2000, XP, Vista, and 7).

3. Add access points to the Managed Access Points, Filtered Access Points, and Prohibited Access Points lists.

   The access point lists apply only to Windows XP endpoint devices. The Security Client does not support access point lists on Windows 2000, Vista, or 7 endpoint devices.

   The Security Client integrates with the Windows XP Wireless Zero Configuration service to control the access points. The endpoint device should not use any third-party wireless network managers when managing access points through the Security Client. In essence, the Security Client functions as the wireless network manager; using a third-party wireless network manager can interfere with the Security Client and cause unpredictable results.

   If an endpoint device is using a third-party wireless network manager, you should either 1) uninstall the manager, 2) prevent the manager from starting (for example, through an application control in the Firewall settings), or 3) instruct the user to delete any preferred network lists from the manager and not use the manager.

   • Managed Access Points: A managed access point is one for which you automatically distribute and apply Wired Equivalent Privacy (WEP) keys without user intervention. This protects the integrity of the keys by not passing them in the clear.

     Because of the inherent security vulnerabilities of Shared WEP Key Authentication, Novell supports Open WEP Key Authentication only.

     Specify the following information for each managed access point you want to define

     • SSID: Specify the SSID number. The SSID number is case sensitive.

     • MAC Address: Specify the MAC address. This is recommended because SSIDs might be duplicated. If the MAC address is not specified, it is assumed that there are multiple access points beaconing the same SSID number.

     • Key: Specify the WEP key for the access point (either 10 or 26 hexadecimal characters).

     • Key Type: Specify the encryption key index by selecting the appropriate level from the drop-down list.

     • Beaconing: Select this option if the defined access point is currently broadcasting its SSID. Leave it deselected if this is a non-beaconing access point.

     The Security Client attempts to first connect to each beaconing access point listed in the policy. If no beaconing access is located, the Security Client then attempts to connect to any non-beaconing access points (identified by SSID) listed in the policy.

     When one or more access points are defined in the Managed Access Points list, the Signal Strength switching for the Wi-Fi adapter can be set (see Step 4).

   • Filtered Access Points: Specify the access points that can be displayed in the Wireless Zero Configuration interface. This only affects the access points that are displayed to users. Users can still connect to a non-displayed access point by manually entering the information. To prevent a user from connecting to an access point, you must add it to the Prohibited Access Points list.

     Specify the following information for each access point:

     • SSID: Specify the SSID number. The SSID number is case sensitive.

     • MAC Address: Specify the MAC address. This is recommended because SSIDs might be duplicated. If the MAC address is not specified, it is assumed that there are multiple access points beaconing the same SSID number.

   • Prohibited Access Points: Access points in the Prohibited Access Points list do not display in the Wireless Zero Configuration interface, nor can the endpoint device connect to them.

     Specify the following information for each access point you want to prohibit:

     • SSID: Specify the SSID number. The SSID number is case sensitive.

     • MAC Address: Specify the MAC address. This is recommended because SSIDs might be duplicated. If the MAC address is not specified, it is assumed that there are multiple access points beaconing the same SSID number.

4. Configure the Signal Strength settings.

   When more than one WEP-managed access point is defined in the Managed Access Points list, the signal strength switching for the Wi-Fi adapter can be set. The signal strength thresholds can be adjusted by location to determine when the Security Client searches for, discards, and switches to another access point defined in the list.

   The following settings can be adjusted above or below the current defaults:

   • Search: When this signal strength level is reached, the Security Client begins to search for a new access point to connect to. The default setting is Low [-70 dB].

   • Switch: In order for the Security Client to connect to a new access point, that access point must broadcast at the designated signal strength level above the current connection. The default setting is +20 dB.

   The signal strength thresholds are determined by the amount of power (in dB) reported through the computer’s miniport driver. Because each Wi-Fi card and radio might treat the dB signals differently for their Received Signal Strength Indication (RSSI), the numbers vary from adapter to adapter.

   The default numbers associated with the defined thresholds in the Management Console are generic for most Wi-Fi adapters. You should research your Wi-Fi adapter's RSSI values to supply an accurate level. The Novell values are:

   Name	Default Value
   Excellent	-40 dB
   Very Good	-50 dB
   Good	-60 dB
   Low	-70 dB
   Very Low	-80 dB

   These signal strength names match those used by the Microsoft Zero Configuration Service, but the thresholds might not match. Zero Config determines its values based on the Signal to Noise Ratio (SNR) and not solely on the dB value reported from RSSI. For example, if a Wi-Fi adapter receives a signal at -54 dB and has a noise level of -22 dB, the SNR reports as 32dB (-54 - -22=32), which on the Zero Configuration scale translates as Excellent signal strength. However, on the Novell scale, the -54 dB signal indicates a Very Good signal strength.

   The end user never sees the Novell signal strength thresholds; this information is provided to show the difference between what the user might see through Zero Config and what is actually occurring in the Security Client.

   Because both signal strength and encryption type (see Wi-Fi Security) are used to determine the order in which access points are attempted, you must select the preferred method. For example, if signal strength is the preference, the strongest signal is given preference when connecting. If WEP 64 is the encryption requirement and encryption is the preference, access points with the highest encryption strength are given preference over all others.

5. Click Save Policy to save your changes.

To configure the Wi-Fi Security settings:

1. In the Locations tree of the Management Console, click the + sign next to the location to expand the location settings, then select Wi-Fi Security.

   

2. Select the Minimum Security level.

3. If you want to display a message to users when a connection fails because of insufficient security, select Message if Minimum not met, then fill in the message fields.

4. Click Save Policy to save your changes.