Configure SSL VPN on VMware NSX

VMwareNSX

With SSL VPN-Plus, you can connect to private networks behind a NSX edge gateway. A user can then access applications and servers on the private network. Since this is a SSL VPN, a user can access the private networks by use of a web browser or a client that is installed on the local machine. Below is a diagram taken from the NSX Admin Guide of the clients connect to the private network and also the support operating systems for the SSL VPN client:

 

ssl01

In network access mode, a remote user installs a client on their machine. After the install, the user is able to access the assigned private networks. The SSL VPN requires that port 443 is accessible from the external networks and the SSL VPN client requires the NSX edge IP and port 443 to be reachable from the client system.

To configure network access SSL VPN-Plus:

Navigate to Networking & Security > NSX Edges > Double click the NSX edge > Manage > SSL VPN-Plus > Server Settings. Click Change

ssl02

Select the appropriate information. Click OK.

ssl03

Next we need to add an IP Pool. A IP Pool is a range of virtual IP addresses that are assigned to remote users with they connect to the VPN. Under IP Pools click the green +.

ssl04

 

Enter in the needed information. Click OK.

ssl05

 

Now we want to add the private networks that we want the remote users to access. Under Private Networks click the green +

ssl06

 

Type the private network IP address.

ssl07

Explanation of options:

The Send Traffic Over Tunnel options, specifies whether you want to send private network and internet traffic over the VPN tunnel or to bypass the tunnel and sent traffic directly to the private server/network. If you select Send Traffic Over Tunnel, select Enable TCP Optimization. From the NSX Admin Guide:

Conventional full-access SSL VPNs tunnel sends TCP/IP data in a second TCP/IP stack for
encryption over the internet. This results in application layer data being encapsulated twice in two separate TCP streams. When packet loss occurs (which happens even under optimal internet conditions), a performance degradation effect called TCP-over-TCP meltdown occurs. In essence, two TCP instruments are correcting a single packet of IP data, undermining network throughput and causing connection timeouts. TCP Optimization eliminates this TCP-over-TCP problem, ensuring optimal performance.

When optimization is enabled, specify the port numbers for which traffic should be optimized. Traffic for the remaining ports for that specific network will not be optimized. If no ports numbers are specified, traffic for all ports is optimized.

When TCP traffic is optimized, the TCP connection is opened by the SSL VPN server on behalf of the client. Because the TCP connection is opened by the SSLVPN server, the first automatically generated rule is applied, which allows all connections opened from the Edge to get passed. Traffic that is not optimized will be evaluated by the regular Edge firewall rules. The default rule is allow any any.

Click OK.

Under Authentication is where you decide how the users will authenticate to the VPN tunnel. SSL VPN supports local, AD, LDAP, Radius, or RSA authentication types. The maximum time to authenticate over SSL VPN is 3 minutes. This is because non-authentication timeout is 3 minutes and is not something that you can configure. So in a situation where AD authentication timeout is set to more than 3 minutes or there are multiple authentication servers in chain authorization and the time take for the user authentication is more than 3 minutes, you will not be authenticated. Click the green +

ssl08

For this lab situation, I chose local authentication. Configure the parameters as needed. Click OK.

ssl09

Next we need to create a installation package for the SSL VPN client for the remote user. Under Installation Package click the green +

ssl10

 

First we want to type in a profile name. In the Gateway section, enter in the IP or FQDN of the public IP address of the NSX Edge. Enter in the port number that you specified in the Server Settings section earlier. Click OK.

ssl11

From the NSX Admin Guide, here are a list of the what each Installation Parameter means:

ssl12

Next, since we are using local authentication, we want to add a remote user to the local database. Click OK.

ssl14

Now we need to enable the SSL VPN server. Simple navigate to Dashboard and click Start next to Service.

ssl15

And click Yes to start the service

ssl16

 

Now in order to test things out, I’m going to go over to a VM that I have on a different network and navigate to the external IP of my NSX edge and login there. Enter in the credentials for a created user. Click Login.ssl17

Click the VPN profile name to download the VPN client

ssl18

Click the hyperlink to being the download. Once downloaded, double click the Installer.exe file.

ssl19

Click Yes to continue

ssl20

The client should pull up automatically but if not, look on the desktop and double click it to run it. The VPN profile should be selected. Click Login.

ssl21

Accept the security alert

ssl22

Enter in the creds for one of the VPN users you created. Click OK.

ssl23

Now the VPN connection has been established. You can also check the system tray to see the VPN icon with the status as connected.

ssl24ssl25

Now we see that we can communicate with a VM on private network that we allowed on our VPN.

ssl26

 

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s