Secure Mobile Access 12.4 Administration Guide
- Secure Mobile Access 12.4.3
- Introduction
- About Secure Mobile Access
- Secure Mobile Access on SMA Appliances
- About SMA Documentation
- What’s New in This Release
- Discontinued Features
- Deprecated Features
- Features of Your SMA Appliance
- Related Documentation
- System Requirements
- About Secure Mobile Access
- Installation
- Installation and Initial Setup
- Network Architecture
- Preparing for the Installation
- Installation and Deployment Process
- Specifications and Rack Installation
- Front Panel Controls and Indicators
- Connecting the Appliance
- Powering Up and Configuring Basic Network Settings
- Web-Based Configuration Using Setup Wizard
- Configuring the Appliance Using the Management Console
- Moving the Appliance into Production
- Powering Down and Restarting the Appliance
- Next Steps
- Installation and Initial Setup
- Management
- Working with Appliance Management Console
- Logging In to AMC
- Logging Out
- AMC Basics
- Administrator Accounts
- Managing Multiple Secure Mobile Access Appliances
- Working with Configuration Data
- Deleting Referenced Objects
- User Management
- Users, Groups, Communities, and Realms
- Using Realms and Communities
- Configuring Realms and Communities
- Creating Realms
- Adding Communities to a Realm
- Creating and Configuring Communities
- Assigning Members to a Community
- Selecting Tunnel Access Methods for a Community
- Selecting Browser Access Methods for a Community
- Using End Point Control Restrictions in a Community
- Configuring the Appearance of WorkPlace
- WorkPlace and Small Form Factor Devices
- About WorkPlace and Small Form Factor Devices
- Optimizing WorkPlace for Display on Small Form Factor Devices
- Creating or Editing a WorkPlace Style
- Creating or Editing a WorkPlace Layout
- Network Tunnel Client Configuration
- Using the Default Community
- Changing the Order of Communities Listed in a Realm
- Configuring RADIUS Accounting in a Realm
- Editing, Copying and Deleting Communities
- Managing Users and Groups
- Integrating an SMA Appliance with a SonicWall Firewall
- Working with Appliance Management Console
- Authentication
- Network and Authentication Configuration
- About Configuring the Network
- Configuring Basic Network Settings
- Configuring Routing
- Configuring Name Resolution
- Certificates
- Let's Encrypt
- Server Certificates
- CA Certificates
- About Intermediate Certificates
- Working with Certificates FAQs
- How do I Obtain a Certificate from a Non-Commercial CA?
- When do Certificates and CRLs Expire?
- Does Secure Mobile Access support SAN Certificates?
- Are Intermediate Certificates supported for End-User Certificate Verification?
- What Are the Different CA Certificates on the Appliance and How Are They Used?
- How many CA Certificates can be Stored on the Appliance?
- Can Private Keys or CSRs Generated from Other Tools be Imported to the Appliance?
- Where Is the AMC Certificate Stored?
- Should I Keep All CA Certificates on the Appliance or Just the Ones I Need?
- Managing User Authentication
- Configuring Authentication Servers
- Configuring Microsoft Active Directory Servers
- Configuring LDAP and LDAPS Authentication
- Configuring RADIUS Authentication
- Integration of SMA with Cisco Duo Security MFA Server
- User-Mapped Tunnel Addressing
- Integration of SMA1000 with RSA SecurID Authentication Manager
- Configuring a PKI Authentication Server
- Additional Field for Custom Certificates
- Configuring a SAML-Based Authentication Server
- One Identity Defender
- Configuring Local User Storage
- Testing AD,LDAP,RADIUS and One Defender Authentication Configurations
- Configuring Chained Authentication
- Enabling Group Affinity Checking in a Realm
- Using One-Time Passwords for Added Security
- Configuring Personal Device Authorization
- Using Your SMA Appliance as a SAML Identity Provider
- Biometric Identification
- Next Steps
- Network and Authentication Configuration
- Administration
- Security Administration
- Creating and Managing Resources
- Resource Types
- Resources and Resource Groups
- Using Variables in Resource and WorkPlace Shortcut Definitions
- Using Session Property Variables
- Using Query-Based Variables
- Creating a Resource Pointing to Users’ Remote Desktops
- Creating a WorkPlace Link Giving Users Access to Their Remote Desktops
- Creating a Variable Containing a Variable
- Modifying Query Results
- Displaying a Series of Shortcuts Using a Single Definition
- Creating and Managing Resource Groups
- Web Application Profiles
- Configuring a Single Sign-On Authentication Server
- Creating Forms-Based Dynamic Single Sign-On Profiles
- Dynamic SSO Profile for Microsoft RDWeb
- Configuring Microsoft RD Web Access in AMC
- Creating Dynamic SSO Profile for Microsoft Remote Desktop Web Client
- Creating Web Application Profile
- Creating RDWeb URL resource with custom access
- Adding RDWeb in start page
- Dynamic SSO Profile for Citrix XenApp
- Configuring Citrix XenApp in AMC
- Creating Dynamic SSO Profile for Citrix XenApp
- Creating Web Application Profile
- Creating Citrix XenApp URL resource with custom access
- Adding Citrix Xenapp in start page
- Kerberos Constrained Delegation
- Configuring SMA Support for Microsoft Outlook Anywhere
- Viewing User Sessions
- Access Control Rules
- Configuring Access Control Rules
- Viewing Access Control Rules
- Access Control Rules for Bi-Directional Connections
- Requirements for Reverse and Cross-Connections
- Securing Application Ports for Reverse Connections
- Adding Access Control Rules for a Forward Connection
- Specifying Advanced Access Control Rule Attributes
- Adding Access Control Rules for a Reverse Connection
- Adding a Pair of Access Control Rules for a Cross-Connection
- Configuring Advanced Access Control Rule Attributes
- Access Methods and Advanced Options
- Adding Users and Resources From Within Access Control Rules
- Editing, Copying, and Deleting Access Control Rules
- Resolving Deny Rule Incompatibilities
- Resolving Invalid Destination Resources
- Configuring Access Control Rules
- Creating and Managing Resources
- System Administration
- Optional Network Configuration
- System Logging and Monitoring
- Overview: System Logging and Monitoring
- Log Files
- Viewing Logs
- Sorting, Searching, and Filtering Log Messages
- Sorting
- Filtering
- Searching
- Exporting Log Files
- Configuring Log Settings
- System Message Log
- Management Message Log
- Management Audit Log
- Network Tunnel Audit Log
- Web Proxy Audit Log
- Client Installation Logs (Windows)
- Configuring the logging settings for managed appliances
- Setting Log Levels
- Configuring Access Request Logging
- Sending messages to a syslog server
- Splunk Integration
- Monitoring the Appliance
- SNMP Configuration
- Managing Configuration Data
- Upgrading, Rolling Back, or Resetting the System
- SSL Encryption
- FIPS Certification
- Software Licenses
- Using Global Overrides
- Security Administration
- End Point Control
- About End Point Control
- Managing EPC with Zones and Device Profiles
- Enabling and Disabling End Point Control
- Configuring and Using Zones and Device Profiles
- Viewing Zones
- Viewing Device Profiles
- Creating a Device Zone
- Creating a Deny Zone
- Creating a Quarantine Zone
- Verifying the URLs
- Configuring the Default Zone
- Defining Device Profiles for a Zone
- Device Profile Attributes
- Advanced EPC: Extended Lists of Security Programs
- Advanced EPC: Using Fallback Detection
- Advanced EPC: Using Preconfigured Device Profiles
- Using Comparison Operators with Device Profile Attributes
- Using End Point Control with the Connect Tunnel Client
- Performing Recurring EPC Checks: Example
- Microsoft Intune
- Creating Zones for Special Situations
- Using End Point Control Agents
- Capture Advanced Threat Protection
- Components
- The WorkPlace Portal
- User Access Components and Services
- About User Access Components and Services
- User Access Agents
- Client and Agent Provisioning (Windows)
- WorkPlace
- WorkPlace Sites
- Adding WorkPlace Sites
- Modifying the Appearance of WorkPlace
- About Custom WorkPlace Templates
- How Template Files are Matched
- Customizing WorkPlace Templates
- Working with WorkPlace Shortcuts
- Adding Web Shortcuts
- Viewing Shortcuts
- Editing Shortcuts
- Creating a Group of Shortcuts
- Adding Network Shortcuts
- Adding a Virtual Desktop Shortcut
- Web Shortcut Access
- Configuring WorkPlace General Settings
- Web Only Access
- Citrix Configuration
- Adding a Text Terminal Shortcut
- Fully Customizing WorkPlace Pages
- WorkPlace Style Customization: Manual Edits
- Network Explorer
- Tunnel Clients
- Web Access
- WorkPlace Lite
- Translated ActiveSync Web Access
- Custom Port Mapped Web Access
- Custom FQDN Mapped Web Access
- Notes for Custom Port Mapped or Custom FQDN Mapped Web Access
- Configuration Requirements
- Known Behavior
- Seamless Editing in SharePoint
- Enabling Storage of Persistent Session Information
- Modifying a Zone to Allow Storing of Persistent Session Information
- Exchange ActiveSync access
- Enabling Exchange ActiveSync access on the appliance
- Exchange ActiveSync sessions
- Notes for Exchange ActiveSync device profiles
- ActiveSync Resource Configuration with SAN Certificates
- Outlook Anywhere Web Access
- Client Installation Packages
- Network Tunnel Client Branding
- The OnDemand Proxy Agent
- Managing Access Services
- About Access Services
- Stopping and Starting the Secure Mobile Access Services
- Configuring the Network Tunnel Service
- Configuring IP Address Pools
- Address Pool Allocation Methods
- Translated Address Pools (Source NAT)
- Routed Address Pools (DHCP)
- RADIUS-Assigned Address Pools
- Static Address Pools
- Best Practices for Configuring IP Address Pools
- Adding Translated IP Address Pools
- Adding Dynamic IP Address Pools
- Adding a Dynamic, RADIUS-Assigned IP Address Pools
- Adding Static IP Address Pools
- Configuring Web Resource Filtering
- Secure Network Detection
- Configuring Custom Connections
- Configuring the Web Proxy Service
- Verifying the Web Proxy Security headers
- Terminal Server Access
- Secure Endpoint Manager (SEM)
- Mobile Connect
- Appendix
- Appliance Command-Line Tools
- Troubleshooting
- About Troubleshooting
- General Networking Issues
- Verify a Downloaded Upgrade File
- AMC Issues
- Authentication Issues
- Using Personal Firewalls with Agents
- Secure Mobile Access Services Issues
- Client Troubleshooting
- Troubleshooting Tools in AMC
- Best Practices for Securing the Appliance
- Network Configuration
- Configure the Appliance to Use Dual Interfaces
- Configure the Appliance to Use Dual Network Gateways
- Protect both Appliance Interfaces with Firewalls
- Enable Strict IP Address Restrictions for the SSH Service
- Enable Strict IP Address Restrictions for the SNMP Service
- Use a Secure Passphrase for the SNMP Community String
- Disable or Suppress ICMP Traffic
- Use an NTP Server
- Protect the Server Certificate that the Appliance is Configured to Use
- Appliance Configuration
- Appliance Sessions
- Administrator Accounts
- Access Policy
- Set Up Zones of Trust
- Setting security level
- Client Access
- Network Configuration
- Configuring the SAML Identity Provider Service
- Configuring External SAML Identity Providers
- Log File Output Formats
- Internationalization Support
- SonicWall Support
Client/Server Resources
Client/server resources are enterprise applications that run over TCP/IP (including applications that use UDP). Examples include thin-client applications such as Citrix; full client/server applications such as Microsoft Outlook; Lotus Notes; SAP; and terminal servers.
You define these types of client/server applications by specifying a host name, an IP address or IP range, a subnet IP address, or a DNS domain. These resources can also be used to define a network object containing multiple Web resources (such as a domain), or to define a network object that can be used to control access based on the source of a connection request.
The below table explains the syntax used to define each of these resource types. Host names can be fully qualified or unqualified.
| Resource type | Example |
| Domain | private.example.com
|
| Host name | bart.private.example.com
|
| Host IP address | 192.0.34.72
|
| IP range | 192.0.34.72 - 192.0.34.74
|
| Subnet | 192.0.34.0 / 255.255.255.0
|
Example
In this example, a Web development team has a single Web server with three virtual Web servers, one for each stage in their development process. Each virtual Web server listens on a different port.
Rather than creating three different URL resources, the Web development team can define the Web server,
which proxies traffic on all ports, as a resource type of Host name or IP (for example,
webdev.yourcompany.com). In addition, they attach a single sign-on Web application profile to it, and now
all three of the virtual Web servers are defined at once, and they share the same SSO profile:
webdev.yourcompany.com
webdev.yourcompany.com:8080
webdev.yourcompany.com:8443
Microsoft Outlook connects to Microsoft Exchange using an unqualified host name. When defining a Microsoft Exchange server as a resource, define it as an unqualified name (for example, CorpMail).
To use Exchange on Android or iOS devices, create a URL resource of the type ActiveSync for Exchange.
Was This Article Helpful?
Help us to improve our support portal