ePortal and SSL VPN

[stitch]

Hi all

 

We are looking into using a Cisco SSL VPN appliance to allow our staff to access Serco’s ePortal to complete their end of year reports at home. Does anybody have any experience in doing this with either Cisco or any other SSL VPN solution.

 

Thanks

[plexer]

Is this a browser based vpn that requires no certificates etc... on the host machine?

 

Ben

[Geoff]

Why do you want to use a VPN? Have you checked it'll work over your RBC/LEAs notwork infrastructure?

[stitch]

Thanks for the replies

 

We have been advised by our LEA that it would be best if we provide our own SSL VPN access and bypass theirs, so that we would have more control over it and that it would also integrate with our admin network and Active Directory. This would then allow members of staff to connect to the VPN appliance, their home PC would then be checked for a presence of an up to date anti virus and anti spyware solution before that person is allowed to login. That member of staff would then have access to Serco's ePortal and also access to other in house applications that we run and their user area.

The SSL VPN solution that we have been looking at provides the end user with a browser based windows orientated front end complete with mapped drives. We have not yet decided to use certificates or not, but if we do we have been advised by our LEA to use purchased one.

 

Thanks

[m25man]

I would think this should be cross posted to a different forum.

 

SSL-VPN would be an ideal solution for this the certificate is in the box itself and access can be managed easily through a local ACL or via LDAP to your AD.

 

The VPN bit is where you are likely to get caught out.

 

Your needs will be met purely through using the reverse proxy functions so you will never need to implement the VPN part of the solution.

 

The real important bit is that you do not need to install or configure any software on the client pc!

 

Plumb in the box, get the grid provider to port forward https (443) from an external IP to the appliance job done!

 

The SSL tunnel is automatically created between your browser and the box the connection to your eportal is in http port 80 no reconfiguration of CMIS at all.

 

We do this all the time and it's by far the best solution for getting the schools admin teams connected from home.

 

There are a few bugs with RDP and VPN with most makes of appliance at present when Vista or RDP V6 is used but with XP everything is fine.

Most manufacturers claim to be able to sort the Vista issues out shortly so if you intend to use Vista clients you might want to check compatability first.

 

Netgears SSL-VPN is about £200 the Sonicwall is £300 (watch out for the upgrade maintenance though) a very cheap and effective solution.

[maniac]

I've got E-portal running through a webVPN using SSL explorer (which is free!) It works exceedingly well for me.

 

I also have it available directly from the schools website as well (https://www.nbc.medway.sch.uk/eportal) so staff have the choise depending on where they are and what they're doing. The version through the VPN runs quicker. Using the VPN, selected staff can also connect to their desktop PC using the remote desktop connection, this allows them to use CMIS as well.

 

mike.

[plexer]

The gpl version of SSL Exporer is free.

 

The gui install enterprise version costs.

 

Please could you give some idea of how you got on installing it, what you installed it on, where it fits into your infrastructure please maniac?

 

Thanks,

 

Ben

[maniac]

I've got a server hosted at medway council (our LEA) which can talk both ways (i.e to the outside world, and to our network) the address http://www.nbc.medway.sch.uk points to this server, and I can host anything on it I want.

 

I've currently got our website hosted on it, E-portal, Exchange web access and SSL explorer. I'm using LDAP authentication which uses our active directory database for user authentication. SSL explorer runs on port 49302 on my server, as this was the first available port medway council could offer me.

 

Installing it was surprisingly easy. I had the basic features up and running in less than half an hour, that was from never using it before!

 

The community edition of SSL explorer has practically all the features I need, file access, remote desktop connection over VPN, and of course webforwarding over VPN for e-portal etc. You can see my installation at https://www.nbc.medway.sch.uk:49302 and if you PM me I'll give you a login account with limited access so you can see what it looks like when you've logged in.

 

Mike.