Secure Mobile Access 12.4 Administration Guide
- Secure Mobile Access 12.4.3
- Introduction
- About Secure Mobile Access
- Secure Mobile Access on SMA Appliances
- About SMA Documentation
- What’s New in This Release
- Discontinued Features
- Deprecated Features
- Features of Your SMA Appliance
- Related Documentation
- System Requirements
- About Secure Mobile Access
- Installation
- Installation and Initial Setup
- Network Architecture
- Preparing for the Installation
- Installation and Deployment Process
- Specifications and Rack Installation
- Front Panel Controls and Indicators
- Connecting the Appliance
- Powering Up and Configuring Basic Network Settings
- Web-Based Configuration Using Setup Wizard
- Configuring the Appliance Using the Management Console
- Moving the Appliance into Production
- Powering Down and Restarting the Appliance
- Next Steps
- Installation and Initial Setup
- Management
- Working with Appliance Management Console
- Logging In to AMC
- Logging Out
- AMC Basics
- Administrator Accounts
- Managing Multiple Secure Mobile Access Appliances
- Working with Configuration Data
- Deleting Referenced Objects
- User Management
- Users, Groups, Communities, and Realms
- Using Realms and Communities
- Configuring Realms and Communities
- Creating Realms
- Adding Communities to a Realm
- Creating and Configuring Communities
- Assigning Members to a Community
- Selecting Tunnel Access Methods for a Community
- Selecting Browser Access Methods for a Community
- Using End Point Control Restrictions in a Community
- Configuring the Appearance of WorkPlace
- WorkPlace and Small Form Factor Devices
- About WorkPlace and Small Form Factor Devices
- Optimizing WorkPlace for Display on Small Form Factor Devices
- Creating or Editing a WorkPlace Style
- Creating or Editing a WorkPlace Layout
- Network Tunnel Client Configuration
- Using the Default Community
- Changing the Order of Communities Listed in a Realm
- Configuring RADIUS Accounting in a Realm
- Editing, Copying and Deleting Communities
- Managing Users and Groups
- Integrating an SMA Appliance with a SonicWall Firewall
- Working with Appliance Management Console
- Authentication
- Network and Authentication Configuration
- About Configuring the Network
- Configuring Basic Network Settings
- Configuring Routing
- Configuring Name Resolution
- Certificates
- Let's Encrypt
- Server Certificates
- CA Certificates
- About Intermediate Certificates
- Working with Certificates FAQs
- How do I Obtain a Certificate from a Non-Commercial CA?
- When do Certificates and CRLs Expire?
- Does Secure Mobile Access support SAN Certificates?
- Are Intermediate Certificates supported for End-User Certificate Verification?
- What Are the Different CA Certificates on the Appliance and How Are They Used?
- How many CA Certificates can be Stored on the Appliance?
- Can Private Keys or CSRs Generated from Other Tools be Imported to the Appliance?
- Where Is the AMC Certificate Stored?
- Should I Keep All CA Certificates on the Appliance or Just the Ones I Need?
- Managing User Authentication
- Configuring Authentication Servers
- Configuring Microsoft Active Directory Servers
- Configuring LDAP and LDAPS Authentication
- Configuring RADIUS Authentication
- Integration of SMA with Cisco Duo Security MFA Server
- User-Mapped Tunnel Addressing
- Integration of SMA1000 with RSA SecurID Authentication Manager
- Configuring a PKI Authentication Server
- Additional Field for Custom Certificates
- Configuring a SAML-Based Authentication Server
- One Identity Defender
- Configuring Local User Storage
- Testing AD,LDAP,RADIUS and One Defender Authentication Configurations
- Configuring Chained Authentication
- Enabling Group Affinity Checking in a Realm
- Using One-Time Passwords for Added Security
- Configuring Personal Device Authorization
- Using Your SMA Appliance as a SAML Identity Provider
- Biometric Identification
- Next Steps
- Network and Authentication Configuration
- Administration
- Security Administration
- Creating and Managing Resources
- Resource Types
- Resources and Resource Groups
- Using Variables in Resource and WorkPlace Shortcut Definitions
- Using Session Property Variables
- Using Query-Based Variables
- Creating a Resource Pointing to Users’ Remote Desktops
- Creating a WorkPlace Link Giving Users Access to Their Remote Desktops
- Creating a Variable Containing a Variable
- Modifying Query Results
- Displaying a Series of Shortcuts Using a Single Definition
- Creating and Managing Resource Groups
- Web Application Profiles
- Configuring a Single Sign-On Authentication Server
- Creating Forms-Based Dynamic Single Sign-On Profiles
- Dynamic SSO Profile for Microsoft RDWeb
- Configuring Microsoft RD Web Access in AMC
- Creating Dynamic SSO Profile for Microsoft Remote Desktop Web Client
- Creating Web Application Profile
- Creating RDWeb URL resource with custom access
- Adding RDWeb in start page
- Dynamic SSO Profile for Citrix XenApp
- Configuring Citrix XenApp in AMC
- Creating Dynamic SSO Profile for Citrix XenApp
- Creating Web Application Profile
- Creating Citrix XenApp URL resource with custom access
- Adding Citrix Xenapp in start page
- Kerberos Constrained Delegation
- Configuring SMA Support for Microsoft Outlook Anywhere
- Viewing User Sessions
- Access Control Rules
- Configuring Access Control Rules
- Viewing Access Control Rules
- Access Control Rules for Bi-Directional Connections
- Requirements for Reverse and Cross-Connections
- Securing Application Ports for Reverse Connections
- Adding Access Control Rules for a Forward Connection
- Specifying Advanced Access Control Rule Attributes
- Adding Access Control Rules for a Reverse Connection
- Adding a Pair of Access Control Rules for a Cross-Connection
- Configuring Advanced Access Control Rule Attributes
- Access Methods and Advanced Options
- Adding Users and Resources From Within Access Control Rules
- Editing, Copying, and Deleting Access Control Rules
- Resolving Deny Rule Incompatibilities
- Resolving Invalid Destination Resources
- Configuring Access Control Rules
- Creating and Managing Resources
- System Administration
- Optional Network Configuration
- System Logging and Monitoring
- Overview: System Logging and Monitoring
- Log Files
- Viewing Logs
- Sorting, Searching, and Filtering Log Messages
- Sorting
- Filtering
- Searching
- Exporting Log Files
- Configuring Log Settings
- System Message Log
- Management Message Log
- Management Audit Log
- Network Tunnel Audit Log
- Web Proxy Audit Log
- Client Installation Logs (Windows)
- Configuring the logging settings for managed appliances
- Setting Log Levels
- Configuring Access Request Logging
- Sending messages to a syslog server
- Splunk Integration
- Monitoring the Appliance
- SNMP Configuration
- Managing Configuration Data
- Upgrading, Rolling Back, or Resetting the System
- SSL Encryption
- FIPS Certification
- Software Licenses
- Using Global Overrides
- Security Administration
- End Point Control
- About End Point Control
- Managing EPC with Zones and Device Profiles
- Enabling and Disabling End Point Control
- Configuring and Using Zones and Device Profiles
- Viewing Zones
- Viewing Device Profiles
- Creating a Device Zone
- Creating a Deny Zone
- Creating a Quarantine Zone
- Verifying the URLs
- Configuring the Default Zone
- Defining Device Profiles for a Zone
- Device Profile Attributes
- Advanced EPC: Extended Lists of Security Programs
- Advanced EPC: Using Fallback Detection
- Advanced EPC: Using Preconfigured Device Profiles
- Using Comparison Operators with Device Profile Attributes
- Using End Point Control with the Connect Tunnel Client
- Performing Recurring EPC Checks: Example
- Microsoft Intune
- Creating Zones for Special Situations
- Using End Point Control Agents
- Capture Advanced Threat Protection
- Components
- The WorkPlace Portal
- User Access Components and Services
- About User Access Components and Services
- User Access Agents
- Client and Agent Provisioning (Windows)
- WorkPlace
- WorkPlace Sites
- Adding WorkPlace Sites
- Modifying the Appearance of WorkPlace
- About Custom WorkPlace Templates
- How Template Files are Matched
- Customizing WorkPlace Templates
- Working with WorkPlace Shortcuts
- Adding Web Shortcuts
- Viewing Shortcuts
- Editing Shortcuts
- Creating a Group of Shortcuts
- Adding Network Shortcuts
- Adding a Virtual Desktop Shortcut
- Web Shortcut Access
- Configuring WorkPlace General Settings
- Web Only Access
- Citrix Configuration
- Adding a Text Terminal Shortcut
- Fully Customizing WorkPlace Pages
- WorkPlace Style Customization: Manual Edits
- Network Explorer
- Tunnel Clients
- Web Access
- WorkPlace Lite
- Translated ActiveSync Web Access
- Custom Port Mapped Web Access
- Custom FQDN Mapped Web Access
- Notes for Custom Port Mapped or Custom FQDN Mapped Web Access
- Configuration Requirements
- Known Behavior
- Seamless Editing in SharePoint
- Enabling Storage of Persistent Session Information
- Modifying a Zone to Allow Storing of Persistent Session Information
- Exchange ActiveSync access
- Enabling Exchange ActiveSync access on the appliance
- Exchange ActiveSync sessions
- Notes for Exchange ActiveSync device profiles
- ActiveSync Resource Configuration with SAN Certificates
- Outlook Anywhere Web Access
- Client Installation Packages
- Network Tunnel Client Branding
- The OnDemand Proxy Agent
- Managing Access Services
- About Access Services
- Stopping and Starting the Secure Mobile Access Services
- Configuring the Network Tunnel Service
- Configuring IP Address Pools
- Address Pool Allocation Methods
- Translated Address Pools (Source NAT)
- Routed Address Pools (DHCP)
- RADIUS-Assigned Address Pools
- Static Address Pools
- Best Practices for Configuring IP Address Pools
- Adding Translated IP Address Pools
- Adding Dynamic IP Address Pools
- Adding a Dynamic, RADIUS-Assigned IP Address Pools
- Adding Static IP Address Pools
- Configuring Web Resource Filtering
- Secure Network Detection
- Configuring Custom Connections
- Configuring the Web Proxy Service
- Verifying the Web Proxy Security headers
- Terminal Server Access
- Secure Endpoint Manager (SEM)
- Mobile Connect
- Appendix
- Appliance Command-Line Tools
- Troubleshooting
- About Troubleshooting
- General Networking Issues
- Verify a Downloaded Upgrade File
- AMC Issues
- Authentication Issues
- Using Personal Firewalls with Agents
- Secure Mobile Access Services Issues
- Client Troubleshooting
- Troubleshooting Tools in AMC
- Best Practices for Securing the Appliance
- Network Configuration
- Configure the Appliance to Use Dual Interfaces
- Configure the Appliance to Use Dual Network Gateways
- Protect both Appliance Interfaces with Firewalls
- Enable Strict IP Address Restrictions for the SSH Service
- Enable Strict IP Address Restrictions for the SNMP Service
- Use a Secure Passphrase for the SNMP Community String
- Disable or Suppress ICMP Traffic
- Use an NTP Server
- Protect the Server Certificate that the Appliance is Configured to Use
- Appliance Configuration
- Appliance Sessions
- Administrator Accounts
- Access Policy
- Set Up Zones of Trust
- Setting security level
- Client Access
- Network Configuration
- Configuring the SAML Identity Provider Service
- Configuring External SAML Identity Providers
- Log File Output Formats
- Internationalization Support
- SonicWall Support
Displaying a Series of Shortcuts Using a Single Definition
When you create a variable based on a user’s session properties or the results of a query, the variable can resolve to one value per user attribute (for example, sAMAccountName and lastLogon), or multiple values (such as a list of groups to which a user belongs, or the workstations a user is permitted to log in to). When a variable can have multiple values, you have the option of creating one shortcut for it that is automatically displayed as a series of shortcuts in WorkPlace.
In this example, we’ll create a single shortcut that will result in a series of WorkPlace shortcuts, one for each workstation the user is allowed to access. Here’s an overview of the process:
Step | Description |
A | Create a variable named User_workstations that points to a multi-valued attribute in an AD or LDAP server named userWorkstations. In the directory store, this attribute lists the workstations a user is allowed to access. For example, a user might have a personal workstation at work, and another workstation that’s used for order inventory. |
B | Create a host resource named Workstation_list that points to the User_workstations variable. For the user in this example, the resource has two possible values. |
C | Create a WorkPlace graphical terminal shortcut that points to the Workstation_list resource. The link for this shortcut will refer to a special, built-in variable named {URL_REF_VALUE}, which will automatically result in separate links in WorkPlace for each of the workstations a user is permitted to use. |
D | Test WorkPlace. If the shortcut does not appear, it may be because the directory store query is not returning any results. Testing it will also help you see whether you need to adjust the location of the shortcuts in your WorkPlace layout. |
A: Create a variable that points to a user attribute in the AD server
-
In the AMC, navigate to Security Administration > Resources.
-
Click on the Variables tab.
-
Click the + (New) icon, and then enter a name for the variable:
User_workstations
. -
Select User attribute in the Type list, and then specify the realm that uses the directory store you want to query.
-
In the drop-down menu of attributes returned from the AD store, select userWorkstations.
-
In the Output list, select Multiple results.
- In the User field, enter the name of a representative user (someone who is likely to use this shortcut), and then query the AD/LDAP store for the values of userWorkstations by clicking Test.
- The test results will indicate what character (for example, a comma or a semicolon) you should enter in the Delimiter field.
-
Click Save.
The new variable ({User_workstations}) appears in the list and can now be used to define or describe other variables, resources, or WorkPlace shortcuts.
B: Create a host resource that points to the {User_workstations} variable
-
In the AMC, navigate to Security Administration > Resources.
-
Click the + (New) icon, and then select Host Name or IP Address.
-
Enter
Workstation_list
as the resource name. -
In the Host name or IP address field, click {variable}, and then select {User_workstations}, the variable you created in Step A.
-
Click Insert, and then click {variable} again to close the list.
-
Edit the entry for Host name or IP address to add the portion of the address that the computers on your network share. The completed entry might look something like this:
{User_Workstations}.dept.company.com
C: Create a WorkPlace shortcut that points to the Workstation_list resource
-
In the AMC, navigate to User Access > Workplace.
-
Click the Shortcuts tab.
-
Click the + (New) icon.
-
Select Graphical terminal shortcut from the drop-down list.
The General tab of the Add Graphical Terminal Shortcut page displays.
- In the Position field, specify the shortcut’s position in the list. The default is 1. (It’s possible to change its position later in your WorkPlace layout.)
- In the Resource drop-down menu, select the resource to which this shortcut will be linked: Workstation_list.
- In the Link text field, type the first part of the hyperlink users will see. For example, enter
My workstation(s):
followed by a space. -
Using a variable you can have the link end in each succeeding value for Workstation_list; if there is more than one, then more than one shortcut will be displayed in WorkPlace. Click {variable}, and then select {URL_REF_VALUE} from the list. Click Insert to add the variable to the link text, and then close the list by clicking {variable} again. The entry for Link now looks like this:
My workstation(s): {URL_REF_VALUE}
-
Click Finish to save the shortcut. (For a description of the settings on the Advanced page, see Adding Graphical Terminal Shortcuts to Individual Hosts.)
This shortcut will automatically result in separate links in WorkPlace for each of the workstations a user is permitted to use. The two WorkPlace links in our example—one to a personal workstation and one to a workstation for entering orders—would look like this for the user ageorge.
D: Troubleshooting WorkPlace
-
If users log in to WorkPlace and do not see the shortcut you created, check the following:
- Is the user in the right community? In the main navigation menu in AMC, click User Sessions, and then click the user’s name to get session details. The user may not be assigned to the right community, or there may be a rule preventing him or her from accessing the resource.
- Does the variable return a result for this user? In the main navigation menu in AMC, click
Resources, and then go to the Variables page. Click the variable named
User_workstations
, enter the name of the person who is not seeing the shortcut, and then click Test. If no result is returned, the shortcut will not be displayed.
- Check your WorkPlace layout. When you create a shortcut, you have the opportunity to add it to a group of shortcuts or to the default group (Standalone shortcuts). To change the position of the shortcut, click Realms, and then click the name of the community to which this user belongs. The WorkPlace Appearance page indicates which layout is being used. To modify page content, click Manage layouts.
Was This Article Helpful?
Help us to improve our support portal