What am I missing with VPN enforcement?

Question

I'm making sense of how to implement the VPN Enforcement feature and would like to hear from others who have set it up.
The way I understand it to work is this...
User connects to the internet (eg with a laptop using a 3G card). Once it detects the internet connection, it switches to the Location specified in the "Switch To" setting on the VPN Enforcement page.
And I have it prompting to connect to the VPN client at this point.
What is puzzling me is... what's the point?
It doesn't seem to make a difference whether the user connects to the VPN or not. The Location in the Switch To setting can have certain restrictions but once connected to the VPN, the Location doesn't change. So, before or after connection to the VPN the same restrictions are in place.
Perhaps I'm missing something in the way this is meant to work.
How has anyone else set this up?
Ideally what I want to happen is....
User connects to the internet - so has enough restrictions (or un-restrictions) to allow this. This would include connecting at an airport or hotel where you connect via a web page. Usually this would be with a 3G modem
then the user is forced to connect to their VPN (in our case we have a dongle and log in. So, I can cause the login screen to appear on VPN switching)
Only allow internet access as long as the VPN is connected. And block access if it is not.
Any thoughts are happily received, thanks
Alison

Answer 1

Here is a brief description of what needs to be done in order for VPN Enforcement to work.
1) The "Unknown" location should have a "stateful" firewall assigned. This allows the endpoint to see all APs and also authenticate to them.
2) The VPN Location should have an "all closed" firewall. This location will be used to switch to once the endpoint gains internet connection (the ZSC checks this automatically). You have to setup a single ACL rule
that points to the IP address of your VPN concentrator (so now the only accessible service/device is the VPN)
3) In the "VPN Enforcement" settings, enter the IP address of the VPN concentrator, the trigger location (at a minimum this is the Unknown), and "Switch to" locations (this is the location you set up in step 2)
5) Again, in "VPN Enforcement" configure the settings needed to make your VPN client to connect "automagically" to the VPN concentrator (client path, and optionally any arguments).
Please note that internet connectivity triggers the enforcement. If someone connects to an AP or wired network that requires authentication (such as you see at a coffee house or hotel), then the Internet connectivity fails.
Hope this clarifies,
Daniel
>>>
From: AWhitwood<[email protected]>
To:novell.support.zenworks.endpoint-security-management
Date: 7/8/2009 10:06 PM
Subject: Re: What am I missing with VPN enforcement?
Excellent - thanks Indy
That is pretty much the same as what I'm setting up. Would you mind
expanding on how you've set this up....I've put your original comments
in blue
1) Users log in and change their location to 'Wired/Wireless/3G'.
I know our users won't manually switch Locations themselves.
I've got this set up to detect the Unknown location which is anything
that is away from the office wired network.
2) Once they have connected to a secure wifi hotspot or their vodafone
3g dongle is connected the location automatically switches to 'Secure
VPN'.
Once they are on the internet, ourLcoation does switch from
"Unknown" to "Away from the Office" (or "VPN" in your system). Can I
ask you what your Firewall settings are on your VPN location? Are there
any restrictions? eg I had it All Blocked but of course it stopped it
connecting the VPN client so I've now got it set to All Stateful.
3) After a few seconds the Cisco VPN Client automatically loads and the
user has to connect via that to get internet connectivity otherwise they
get nothing.
I have this too - the client VPN launches and the user is prompted
to login. But what if they don't? what stops the internet working for
them if they didn't log in? When you say "otherwise they get nothing" -
what is it that prevents them getting to the internet if they have not
connected to the VPN. This is exactly what I'm trying to set up so I'm
very happy to hear that you've done it. What is puzzling me is how to
have it blocking internet access unless it is through the VPN.
I think its purpose is to make sure all internet traffic goes through
your VPN and firewalls, settings, etc etc...
Exactly what I want ! Thanks - I've just got to figure out how to
do it.
Hope that helps,
That helped a lot.
Alison
AWhitwood
AWhitwood's Profile: http://forums.novell.com/member.php?userid=4390
View this thread: http://forums.novell.com/showthread.php?t=379389