We had a look at the gateway.
Right.
Using this, we'll add thick client thin client to it.
How do you add the thin client?
It's called you go to your web context again.
Admin context.
It's called port Forward.
Inclined is also known as, quote, forward.
Now, the way you do it is.
You have to do it separately here.
When you hear right, you have to create the port forward separately.
And then specify the name of the port forwarding list.
I'll call it R1.
Now, look here.
This is important.
Local port.
I'll keep it as 25,000 remote server.
I want to access ten, 11.
11.1.
For example, remote port.
I want to access 23 here.
Description is important.
Usually you don't have description, right?
Description is optional in this command.
This is the only command I have seen where description you have to put.
I'll call it.
This is Telnet to R1.
So what you're doing is you're going into port forward.
You're saying local port is 25,000.
Remote server is 1011 11.1.
Remote port is 23.
And description.
Is delayed.
I one.
Where do you call this port forward list?
I'll explain.
Just keep it in mind.
I'll get out of here.
Where do I call this port?
Forward.
Inside the policy group.
Admin.
Policy put forward name was what are.
So you create the list somewhere.
You create the list outside.
You call it.
Where?
In under the policy.
Think of this as default.
This has to be there.
You'll work between these two.
So the boat forward is.
Called R1.
It was here.
Also called.
Let's see how this helps us.
Keep.
Remember this part.
Then log out again now.
Thin client requires you to have the perfect version of Java on your PC.
Right.
So most of the times they will you will not be able to find it.
But I would recommend that you use your Windows XP as a VM machine and update the Java there because
the latest version of Java on XP works perfectly okay.
Okay.
Click.
Okay.
What do you see?
Thin client application.
I'll start.
Now click.
Continue.
Except.
The encrypted session.
Java.
Right.
Always trust.
Yes.
This is your thinking.
This is your thin client.
What?
Your thin client basically is saying very simple things.
It's guiding your SSL VPN.
Now, since this is a layer seven application, it sits on top of all the applications that you are
running Java.
On top of all the applications you're running.
So whenever you ping or telnet, it has to go through Java first and then it will go down.
Okay, so now what?
Basically Java is saying is if you try to access 127 001 at which port number.
25,000.
Your packet.
We'll be going through.
SSL VPN for ten, 11, 11 one four port number 20.
Earlier you only had to access http http.
Ten 1111.
Now you are saying is if this part matches, whatever is here will also go through the tunnel.
It's sitting here on top of everything else, making sure that it reads the connection, what it actually
means.
Let me just show it to you.
If you party into 127 .0.0.1, which port number?
25,000.
25,001 27 001.
You're actually going to go where?
To.
Right now.
It was closed because.
Obviously.
Since Java again is a Layer seven application, it sits on top of everything else.
So you go to 127 001 Telnet again open.
I didn't use the phone.
This.
Going through what?
Going through the tunnel.
So any kind of traffic now can go through the tunnel.
Now, maybe you want it to do it for Smtp.
You want it to reach 1011, 11.4 for Smtp traffic.
How would you do it?
You go to your outer.
You go out, you say VPN context admin.
Context.
I will say port forward.
Now, this will be called R2, local port, let's say 20,000.
Remote server is which one?
Which one do I want to access?
Ten, 11 11.4.
Remote port is which one?
25.
Description is Smtp to 25.
Where do I call this policy group?
Admin?
Policy put forward is also our.
So you'll see that now.
Or you can only have one.
So you can only have one.
If you wanted to add, you could add it to the first one.
I have one there.
Right?
So I could say yes in the same one where VPN context, admin context.
So when I have port forward R1 here I could add another line where you could say local port is 20,000,
remote server is 1011 11.4 remote code is 25.
Description is Smtp 75.
So if you check now.
You go to your.
Policy.
Admin policy.
Support forward as are.
No port for our.
So if you check now show run begin.
The VPN.
Right.
So in the same one you have two now, one for this is your thin client.
It's called R1 right now.
And you're calling it where?
In the policy in your group policy.
So if you go right now again and you reset this, you log out.
Log back in again.
Welcome.
Right.
Now you have two applications.
One is Telnet to R1.
The other one is Smtp to 25.
So if you go to 127 001 at port number 20,000, your packet will actually go where your packet will
be encapsulated as Smtp to ten, 11, 11.
Not for the outside, encapsulation will still be the same SSL.
Protecting this part and sending it across.
Again DCP.
443 going from 30.25 to 20 dot.
This job of putting the protocol into the encapsulation is thin clients.
That's what Syncline does.
So earlier, where you had only Http and FTP, it was not in your control, which one do you use?
The only control you had was over the fact that you could use this URL bar.
That's all you had control over.
Right.
If you compare that to this now, you can have any protocol which has a port number to go through.
Anything that is using port numbers.
A well known destination port number.
It will go through what your Http sorry, your SSL traffic, it will be encrypted.
All you have to do is just map.
Map this and find the right job.
Just mean the latter is more difficult.
Okay.
Why is it choosing?
That's the local loopback address.
127 So remember, it's a reserved right.
128 is used.
126 is the last class address.
Between them is 127 which is reserved for loopback.
I could, but I don't have any application to run Smtp, my server.
I don't have an Smtp server on our phone.
Again.
127 .0.0.1 Port number 25.
If I use 20,000 it will try to go to Smtp from where the source is.
One.
No, no.
I'm trying to access 127 zero.
From the PC.
From the.
The client is trying to access this.
But that's the countryside.
Yeah.
So it's getting Java.
What does Java do?
Java is working on top of everything right now.
He's trying to access 127 .0.0.1.
When Java sees he's actually trying to go there, he changes the destination.
He says, No, you're not going there.
You're actually going to ten, 11, 11.1 port number 23, and you're also going through this tunnel.
Java does it for you.
The thin client.
That's his job.
When he is.
You are trying to go to 127 001 at port number 25,000.
You're matching a condition in Java.
On that application that is running on top of it is running here on top of everything else.
And it checks anywhere else we want to go.
Java will let you go because you're not matching those lines.
But if you match, it's just like if you remember, it's just like easy VPN client.
If you match the split tunnel ACL you have to go through.
If you did not match, it lets you go.
It was sitting on top of everything else, right?
It makes a decision based on the port number and the address both should match.
127 001 as well as the port number if.
Just looking great.
That is the look back.
That is local address 127 001.
It is your own address.
It's usually used to check your own Nic card if it's working properly or not.
If you if you want to check if you have IP address on your Nic card and you can ping it, use 127 001,
you're pinging yourself.
Local address.
Your local address.
Okay.
Claire Guys.
Claire Right now, Cosmetics.
You could do a lot of cosmetics.
Cosmetics in here.
First of all, let me see if I have a TftP server which is running.
I want to show you something.
It is started.
Let me go to the gateway.
Copy from TftP.
To flash.
151 .3. 25 Source file name is.
And I had an image.
Destination file name is this.
So it copies.
It's too far away.
There you go.
So flash.
I have the file in here.
Right.
So what I can do is web VPN, context admin.
Context.
Right.
There's something called login.
Photo.
The name of the file is SJ Dot.
Okay.
So.
You just have to put the file in your flash.
Just a quick show of how it's done.
Put the file in the flash.
Copy it here.
Out.
Right.
All you have to do is just put the file in the flash, call it in the SSL VPN gateway.
It comes through login.
There you go.
In.
It's nothing complicated.
Once you know how it works, it's pretty simple.
All you have to understand is how the thin client works.
The rest is easy.
Right.
You could do some other stuff.
For example, right now there's a URL bar, right?
Which is quite dangerous because anyone can go anywhere.
All he has to do is just enter the information.
So what you could also do is you could go to your VPN gateway.
The VPN context.
Hardman.
This context.
In the policy group admin.
Policy.
You have this option called hide URL bar.
So you will hide the URL bar.
Right.
But what if you wanted people to access certain URLs?
For that you'll have to create a URL list.
Call it again.
I'm.
I'm creating the list.
Where?
Here just where I created my port.
Fast forward.
I'll create my URL list.
I'll call it list.
And then I'll specify the different changes that I do.
I'll call it Earl.
And here I'll make the changes.
Heading.
This will be our one.
Going to our one then Earl text.
Or maybe the heading is something else.
Heading is.
Access.
Then url text is.
R1 url value.
Ten 1111 dot one.
Your value is just ten, 11.
11, one.
Okay.
I just have to type.
Your text is R1URL value, then specify the CPU.
Ten 1111 dot.
Where do I call this?
A list?
In the policy right.
Policy group admin policy.
Your list is.
Was part.
So I created here.
I said, okay, the heading is access only.
You like that?
Then I also said what your URL value.
URL text is our one url value is.
Http.
Ten.
11.
11.1.
Call it.
Where?
Right after port forward.
I said you are you are a list is.
Can I call the list?
Polyforms.
So have a look now.
We just change?
On the router.
Yep.
I put both as you are there.
Here I put the both things as.
You don't have the URL bar anymore.
You don't have the URL, you have limited options which are only there for whom?
For you.
So you just click on it.
You'll get to add one.
Right.
Limited access, stuff like that.
I mean, you can explore now when you go here, you can explore all these options which you have available
to you.
You can change the color.
The CSD will do the CSD in your what do you call it?
RSA.
We'll see it in RSA Login message Login photo.
You can change the logo.
If you wanted to list is your server for this.
You write so many different things which you could do.
All through the same web thing.
What you can do also at the same time is say, for example, I want you to create another context.
This is one context, right?
What if I wanted to create another context?
I'll call it sales context.
No port forwarding.
I do not require any port forwarding here.
I just want this guy to be able to access a URL.
Which URL?
R2 r4 at ten 1111 dot.
For.
I'll call his list.
Right policy.
I'll call it sales policy.
Welcome to sales.
Actions.
I don't want him to file browser or anything like that.
No port forwarding only.
You are a list.
The name of the list is.
Correct.
Policy name.
Sales policy authentication list is the same, but the domain now is what?
And here it's up to you.
What do you want this to be?
It's just a name, but this is what you will use in the forward slash, whatever you put here.
Right.
So here I will just put sales and inserts.
That's all I have to do, right?
Nothing more than this.
So I'll go here.
Get it done.
Now, again, when you're doing this, when you're trying to do this, it will not work in the beginning.
First, you have to close down your browser and then start it again because it remembers the old session.
Then try again.
150 .1.2.2 but not admin sales.
The ctp's.
Not.
Continue.
Got it.
This is not sure if I use Sha and Cisco.
You're not able to get in and Cisco was for admins.
You're not an admin anymore.
For sales you are Rob.
Password is welcome to sales.
You have your page.
No file browse.
I didn't enable file file browsing so CIF is not there anymore.
No.
Thin client.
I didn't put that.
Also, the only access you have is forgot to hide the bar.
Forgot to hide the bar in the policy.
I have to use hide URL bar so we'll not be there.
The only access that he will have available to him is also those are for go to after checkout after
and come back again.
Okay, One note this one thing.
Remember this that your R4 and R1 do not have a default gateway for them.
They're talking to ten, 11, 11 two.
They're talking to the gateway.
The gateway is proxying for the.
Keeping track of all the sessions.
Okay.
Clear.
This is how it works.
Let's do that.
One last thing also.
VPN context.
Sales Context.
Policy group sales.
Policy.
Hide.
The people can log out.
Log in again.
But all.
Okay.
Access to one device only so you can limit it based on the view.
Salespeople are getting a different view.
Admin people are getting a different view.
Admin people are getting the thin client and all those things.
Sales people are only getting what access to certain Http servers.
Okay.
Everybody clear with web VPN.
Stop this up.