Configuring the SSL VPN service

Indicate the IP address that users must use to reach the SNS firewall to set up SSL VPN tunnels.

• For IP addresses: they must be public, and therefore accessible over the Internet,

• For FQDNs (e.g., ssl.company.tld): they must be declared on the DNS servers that the workstation uses when it is outside the corporate network.
  If you have a dynamic public IP address, you can use the services of a provider such as DynDNS or No-IP. In this case, configure this FQDN in the module Configuration > Network > Dynamic DNS.

Select the object representing the networks or hosts that will be reached through the VPN tunnel. This object makes it possible to automatically set on the workstation the routes needed to reach resources that can be accessed via the VPN.

You will need to set filter rules to more granularly allow or prohibit traffic between remote workstations and internal resources. You may also need to set static routes for access to the network assigned to VPN clients on corporate network devices located between the SNS firewall and the internal resources provided.

Select the object corresponding to the network that will be assigned to VPN clients in UDP and TCP. While you can assign a different network, the VPN client will always choose the UDP network first to ensure better performance.

Choosing the network or sub-networks:

• The network mask must not be smaller than /28,
• The network dedicated to VPN clients must not belong to any existing internal networks, or networks declared by a static route on the firewall. Since the interface used for the SSL VPN is protected, the firewall would then detect an IP spoofing attempt and block the corresponding traffic,
• To avoid routing conflicts, select less commonly used sub-networks (such as 10.60.77.0/24) as many filtered Internet access networks (public Wi-Fi, hotels, etc) or private local networks already use the first few reserved address ranges.

In either of the following cases, you need to select the object representing the IP address used for setting up UDP SSL VPN tunnels:

• The IP address used for setting up the SSL VPN tunnels (UDP) is not the main IP address of the external interface.

• The IP address used for setting up the SSL VPN tunnels (UDP) belongs to an external interface that is not linked to the default gateway of the firewall.

The listening ports of the SSL VPN service can be changed. Note:

• Some ports are reserved for the SNS firewall’s internal use only and cannot be selected,
• Port 443 is the only port below 1024 that can be used,
• If you change any of the default ports, the SSL VPN could become inaccessible from networks (hotels or public WiFi) on which Internet access is filtered.

You can change the length of time (14400 seconds by default, or 4 hours) after which the keys used by the encryption algorithms will be renegotiated. During this operation:

• The SSL VPN tunnel will not respond for several seconds,
• If multifactor authentication is used, the user will need to enter a new OTP, or approve the new connection on the third-party application (in push mode), in order to stay connected. It would be helpful to set an interval that corresponds to the average length of a workday, such as 28800 seconds (8 hours).

You can instruct VPN clients to include the DNS servers retrieved via the SSL VPN in the workstation's (Windows only) network configuration. If DNS servers are already defined on the workstation, they may be queried.

Select the script to run when the VPN tunnel is opened. Example of a script that makes it possible to connect the Z: network drive to the shared network:

NET USE Z: \\myserver\myshare

Select the desired certificate. The icon indicates certificates with a TPM-protected private key. For more information, refer to the technical note Configuring the TPM and protecting private keys in SNS firewall certificates.

Select the checkbox to enable verification of client workstation and user compliance. When it is enabled:

• Compatible SSL VPN clients can set up SSL VPN tunnels with the firewall only if all the criteria defined in the policy have been met,

• Incompatible SSL VPN clients cannot set up SSL VPN tunnels with the firewall, unless permissive mode has been enabled (see below).

The workstation must be equipped with an active antivirus program with the latest antivirus database updates. This information is based on the status of the antivirus recognized by the Windows Security center. Third-party antiviruses are therefore supported as long as the Windows Security center recognizes their status.

The Windows firewall must be running on the workstation, and the domain network, private network and public network profiles must be enabled. If a profile is disabled, the criterion will be considered non-compliant.

In infrastructures that have deployed SES Evolution, the SES agent must be installed on the workstation. 

Do note that the configuration and status of the SES agent are not taken into account.

Users who hold administrator privileges on the workstation cannot set up SSL VPN tunnels with the firewall.

Workstations in Windows 10 or Windows 11 must be equipped with the Windows versions specified (build numbers) to set up an SSL VPN tunnel with the firewall. If this option is selected, you will be enabling the settings section of the required versions.

Windows 10 and Windows 11 tabs

• Allow a version range: if this option is selected:
  • You have to specify the Minimum version that the workstation must run (by default 10000 for Windows 10 and 20000 for Windows 11),
  • You can specify the Maximum version that the workstation must run. Leave this field empty to allow all versions equal to or higher than the minimum specified version.
• Allow only one version: if this option is selected, you have to specify the exact Windows version that the workstation must run.

If you select Connect the host to a company domain, in the List of Active Directory domains grid, add the domains of the workstations that are allowed to set up SSL VPN tunnels with the firewall.

Do note that this criterion is not related to the configuration of directories on the firewall.

If you select Connect the user to a company domain, in the List of Active Directory domains grid, add the domains of the users that are allowed to set up SSL VPN tunnels with the firewall.

With this criterion, the user's full name, including the domain, will be verified. As such, even if the workstation is connected to a domain, local users on the workstation will not be able to set up SSL VPN tunnels with the firewall. Do note that this criterion is not related to the configuration of directories on the firewall.