SSL VPN - whitelisted URL - remote users cant access

[lukeprimm_]

We have a Juniper 4000 SSL VPN in place which hosts around 80 mobile clients. We have started using a new leased web portal that for security reasons, uses whitelisting to control access. We gave them our 6 remote office IPs but the problem lies with our VPN users. We use split tunnel on our vpn so users are using their local gateways for web traffic when connected through our VPN, which of course are not whitelisted. We obviously cant whitelist all remote user IP addresses.

Any ideas on how we might solve this? Thanks

[zanyterp_]

Is this access that could be handled through the web-based rewriter or do users need to use another application (through the VPN tunnel) for the access? If it can be handled through the web rewriter, you can create a bookmark for users to click on and they will connect to the site through the IVE web engine and use that IP (IVE internal port) as the connection.

Or is the web portal something you can send through the VPN tunnel that you could give a subnet for?

[lukeprimm_]

Thanks for the quick reply. Im not familiar with the rewriter, actually Im not very familiar with the Juniper at all. This web portal is a simple website hosted somewhere in the world, nothing to do with our private environment. The rewriter might work, do you have any more info on it. whitpaper? Thanks again.

[zanyterp_ · Accepted solution]

The rewriter is what allows users to connect to web-based bookmarks through the SA without needing a VPN tunnel.

There is no whitepaper other than the admin guide. For a summary of how to configure it, though, I can provide that without an issue.

In the admin UI of the SA/IVE (Juniper), you will need to do the following to configure access:

1) Users>User Roles>roleName>General>Options: Make sure that web is enabled

2) Users>Resource Profiles>Web, Create new profile

3) Give the profile a name

4) Fill in the URL

5) Set the ACL you will want to use

6) Save & Continue

7) Choose the role you want to use

8) Save changes

Now, login as a user to that role and test to see if you have the link and the behavior you see when browsing the site. As long as you have the IVE IP listed in the whitelist, I expect that it should allow access/work.

[lukeprimm_]

Thanks. I found the User guide. I will try those instructions and see if they work for our issue. Thanks again

[zanyterp_]

you are welcome; good luck!