Virtual Assist (SSL-VPN 2000 / SSL-VPN 4000 / SRA 4200 only)
Virtual Access (if configured by administrator

Bookmarks

Options Online Help Tips/Help Logout
The Home page provides customized content and links to network resources. The Home Page may contain support contact information, VPN instructions, company news, or technical updates.
Only a Web browser is required to access intranet Web sites, File Shares, and FTP sites. VNC, Telnet and SSHv1 require Java. SSHv2 provides stronger encryption than SSHv1, requires SUN JRE 1.4 or above and can only connect to servers that support SSHv2. Terminal Services requires either Java or ActiveX on the client machine. As examples of tasks you can perform and environments you can reach through Virtual Office, you can connect to:
Intranet Web or HTTPS sites If your organization supports Web-based email, such as Outlook Web Access, you can also access Web-based email The entire network by launching the NetExtender client FTP servers for uploading and downloading files The corporate network neighborhood for file sharing Telnet and SSH servers Desktops and desktop applications using Terminal Services or VNC. Email servers via the NetExtender client.
The administrator determines what resources are available to users from the SonicWALL SSL VPN Virtual Office. The administrator can create user, group, and global policies that disable access to certain machines or applications on the corporate network. The administrator may also define bookmarks, or preconfigured links, to Web sites or computers on the intranet. Additional bookmarks may be defined by the end user. SonicWALL NetExtender is a software application that enables remote users to securely connect to the remote network. With NetExtender, remote users can virtually join the remote network. Users can mount network drives, upload and download files, and access resources in the same way as if they were on the local network.

Certificates

If the SSL-VPN appliance uses a self-signed SSL certificate for HTTPS authentication, then it is recommended to install the certificate before establishing a NetExtender connection. If you are unsure whether the certificate is self-signed or generated by a trusted root Certificate Authority, SonicWALL recommends that you import the certificate. The easiest way to import the certificate is to click the Import Certificate button at the bottom of the Virtual Office home page.
Using Virtual Office Features
This chapter provides details on how to use the features in the SonicWALL SSL VPN user portal, including NetExtender, configuring bookmarks, accessing services, and using file shares. This chapter contains the following sections:

To log in to the SonicWALL SSL VPN Virtual Office using RSA two-factor authentication, perform the following steps.

Step 1

Enter the IP address of the SSL-VPN appliance in your computers browser. The authentication window is displayed.

Step 2 Step 3

Enter your username in the Username field. The first time you log in to the Virtual office, your entry in the password field depends on whether you have been given a PIN or if you need to create the PIN.
If you already have a PIN, enter the passcode in the Password field. The passcode is
the user PIN and the SecurID token code. For example, if the users PIN is 8675 and the token code is 30966673, then the passcode is 867530966673.
If you do not have a PIN, enter the SecurID token code in the Password field. Step 4
Select the appropriate Domain.

Note Step 5

If manually entering the Domain, it is case-sensitive. Click Login.

Creating a New PIN

The RSA Authentication Manager automatically determines when users are required to create a new PIN. will determines that user associated with a particular token requires a new PIN. The SSL-VPN appliance prompts the user to enter new PIN.
If the user is configured for the Allowed to Create a PIN option, users are first asked if they want the system to generate a PIN. To have the system generate a PIN, type y and click OK. To create your own PIN, type n and click OK.

Step 2

The new PIN is displayed. To accept the PIN type y and click OK. To have the system generate a different PIN, type n and click OK.
If you declined to accept a system-generated PIN, or if your username is configured for Required to Create a PIN, you are prompted to enter your new PIN. Enter the PIN in the New PIN field and again in the Confirm PIN field and click OK.

Step 4

The RSA Authentication Manager verifies that the new PIN is an acceptable PIN. If the PIN is accepted, the user is prompted to log in with the new passcode.
Waiting for the Next Token Mode
If user authentication fails three consecutive times, the RSA server requires the user to generate and enter a new token. To complete authentication, the user is prompted to wait for the token to change and enter the next token.
VASCO User Authentication Process
The following sections describe user tasks when using RSA two-factor authentication:
Logging into the SSL VPN Virtual Office Using VASCO Two-Factor Authentication on page 20 Creating a New PIN on page 19
Logging into the SSL VPN Virtual Office Using VASCO Two-Factor Authentication
To log in to the SonicWALL SSL VPN Virtual Office using VASCO two-factor authentication, perform the following steps:
Enter your username in the Username field.

Using One-Time Passwords

Enter the passcode in the Password field. The passcode is the user PIN and the VASCO Digipass token code. For example, if the users PIN is 8675 and the token code is 30966673, then the passcode is 867530966673. Select the appropriate Domain.

The following sections describe how to use one-time passwords:
User Prerequisites, page 21 User Configuration Tasks, page 21 Verifying User One-Time Password Configuration, page 23 Troubleshooting Common Errors, page 23
Users must have a user account enabled in the SSL VPN management interface. Only users enabled by the administrator to use the One-Time Password feature will need to perform the following configuration tasks. The administrator must enable a correct email address that is accessible by the user. Users cannot enable the One-Time Password feature and they must be able to access the SSL VPN Virtual Office portal.
The One-Time Password feature is supported on the SonicWALL SSL-VPN 2000, SSL-VPN 4000, and SRA 4200 security appliances.
To use the One-Time Password feature, perform the following steps:
If you are not logged into the SSL VPN Virtual Office user interface, open a Web browser and type the Virtual Office interface URL in the Location or Address bar and press Enter. Type in your user name in the User Name field and your password in the Password field, then select the appropriate domain from the Domain pull-down. Click Login.
The prompt A temporary password has been sent to user@email.com will appear, displaying your pre-configured email account.

Step 3 Step 4 Step 5

Login to your email account to retrieve the one-time password. Type or paste the one-time password into the Password: field where prompted and click Login. You will be logged in to the Virtual Office.
One-time passwords are immediately deleted after a successful login, and cannot be used again. Unused one-time passwords will expire according to each users timeout policy.
Configuring One-Time Passwords for SMS-Capable Phones
SonicWALL SSL VPN One-Time Passwords can be configured to be sent via email directly to SMS-capable phones. Contact your cell phone service provider for further information about enabling SMS. Below is a list of SMS email formats for selected major carriers, where 4085551212 represents a 10-digit telephone number and area code.

To install and launch NetExtender for the first time using the Internet Explorer browser, perform the following:
Log in to the SSL VPN Virtual Office portal.
Click the NetExtender button.
The first time you launch NetExtender, you must first add the SSL VPN portal to your list of trusted sites. If you have not done so, the follow message will display.
Click Instructions to add SSL VPN server address into trusted sites for help.

Step 5 Step 6 Step 7

Step 8 Step 9
Enter the URL or domain name of your SSL VPN server in the Add this Web site to the zone field and click Add. Click OK in the Trusted Sites and Internet Options windows. install the NetExtender stand-alone application on your computer. The NetExtender installer window opens.
Step 10 Return to the SSL VPN portal and click on the NetExtender button. The portal will automatically
Step 11 If an older version of NetExtender is installed on the computer, the NetExtender launcher will
remove the old version and then install the new version.
Step 12 If a warning message that NetExtender has not passed Windows Logo testing is displayed, click
Continue Anyway. SonicWALL testing has verified that NetExtender is fully compatible with Windows 7, Vista, XP, 2000, and 2003.
Launching NetExtender Directly from Your Computer
After the first access and installation of NetExtender, you can launch NetExtender directly from your computer without first navigating to the SSL VPN portal. To launch NetExtender, complete the following procedure:
Navigate to Start > All Programs. Select the SonicWALL SSL VPN NetExtender folder, and then click on SonicWALL SSL VPN NetExtender. The NetExtender login window is displayed.
The IP address of the last SSL VPN server you connected to is displayed in the SSL VPN Server field. To display a list of recent SSL VPN servers you have connected to, click on the arrow.
Enter your username and password. The last domain you connected to is displayed in the Domain field.
The NetExtender client will report an error message if the provided domain is invalid when you attempt to connect. Please keep in mind that domain names are case-sensitive. The pulldown menu at the bottom of the window provides three options for remembering your username and password:
Save user name & password if server allows Save user name only if server allows Always ask for user name & password

Step 6

Having NetExtender save your user name and password can be a security risk and should not be enabled if there is a chance that other people could use your computer to access sensitive information on the network.

Right click on the icon in the task bar and click on Properties. The NetExtender Preferences window is displayed. Click on Connection Scripts.
To enable the domain login script, select the Attempt to execute domain logon script checkbox. When enabled, NetExtender will attempt to contact the domain controller and execute the login script. Optionally, you may now also select to Hide the console window. If this checkbox is not selected, the DOS console window will remain open while the script runs.
Enabling this feature may cause connection delays while remote clients printers and drives are mapped. Make sure the domain controller and any machines in the logon script are accessible via NetExtender routes. To enable the script that runs when NetExtender connects, select the Automatically execute the batch file NxConnect.bat checkbox. Optionally, you may now also select to Hide the console window. If this checkbox is not selected, the DOS console window will remain open while the script runs. To enable the script that runs when NetExtender disconnects, select the Automatically execute the batch file NxDisconnect.bat checkbox. Click Apply.

Step 5 Step 6

Configuring Batch File Commands
NetExtender Connection Scripts can support any valid batch file commands. For more information on batch files, see the following Wikipedia entry: http://en.wikipedia.org/wiki/.bat. The following tasks provide an introduction to some commonly used batch file commands.
Step 1 Step 2 Step 3 Step 4
To configure the script that runs when NetExtender connects, click the Edit NxConnect.bat button. The NxConnect.bat file is displayed. To configure the script that runs when NetExtender disconnects, click the Edit NxDisconnect.bat button. The NxConnect.bat file is displayed. By default, the NxConnect.bat file contains examples of commands that can be configured, but no actual commands. Too add commands, scroll to the bottom of the file. To map a network drive, enter a command in the following format:
net use drive-letter\\server\share password /user:Domain\name
For example to if the drive letter is z, the server name is engineering, the share is docs, the password is 1234, the users domain is eng and the username is admin, the command would be the following:
net use z\\engineering\docs 1234 /user:eng\admin Step 5

To install NetExtender from the CLI, navigate to the directory where you saved NetExtender.tgz and enter the tar -zxf NetExtender.tgz command.
Type the cd netExtenderClient command. Type./install to install NetExtender.
Launch the NetExtender.tgz file and follow the instructions in the NetExtender installer. The new netExtender directory contains a NetExtender shortcut that can be dragged to your desktop or toolbar.
The first time you connect, you must enter the SonicWALL SSL VPN server name in the SSL VPN Server field. NetExtender will remember the server name in the future.
Enter your username and password. The first time you connect, you must enter the domain name. NetExtender will remember the domain name in the future.
You must be logged in as root to install NetExtender, although many Linux systems will allow the sudo./install command to be used if you are not logged in as root.
Step 10 To view the NetExtender routes, go to the NetExtender menu and select Routes.
Step 11 To view the NetExtender Log, go to NetExtender > Log.
Step 12 To generate a diagnostic report with detailed information on NetExtender performance, go to
Step 13 Click Save to save the diagnostic report using the default nxdiag.txt file name in your
Installing and Using NetExtender for Windows Mobile
SonicWALL SSL VPN now supports NetExtender for the Windows Mobile platform. NetExtender for Windows Mobile provides the following features:
One-time passwords Two-factor authentication HTTP proxy Connection profiles Windows Mobile 5 PocketPC version Windows Mobile 6 Professional/Classic version
NetExtender supports the following Windows Mobile platforms:
Windows Mobile 5 Smart Phone version and Windows Mobile 6 Standard version are not currently supported. To use NetExtender on your Windows Mobile device, perform the following tasks:
Navigate to the URL or IP address for your SSL VPN Virtual Office using the browser in your Windows Mobile device. Log in with your username and password. Click on the NetExtender icon. Follow the on-screen instructions to install NetExtender. When NetExtender is installed, you may be prompted to restart your device. Click Yes. From your Windows Mobile device, launch NetExtender. The NetExtender login screen displays. Enter the IP address or domain name for your SSL VPN server in the Server field. The IP address of the last SSL VPN server you connected to is displayed by default. To display a list of recent SSL VPN servers you have connected to, click on the arrow. Enter your username and password. The last domain you connected to is displayed in the Domain field. The pulldown menu at the bottom of the window provides three options for remembering your username and password:

Step 7 Step 8 Step 9

Step 10 Click Connect. When NetExtender successfully connects, the NetExtender Status window
displays. Select the Show NetExtender Routes checkbox to see routes.
Step 11 Click on the Menu button to see the NetExtender properties menu.
Step 12 Select the Sent & Received menu tab to adjust the metric used for sent and received statistics
on the status window. Select the Throughput menu tab to adjust the throughput measurement displayed on the status window.
Step 13 To configure NetExtender options, click the Menu button. The following options are displayed:
Connection Profiles - Displays all of the NetExtender connections that you have used on this device. To remove a Connection Profile, highlight the profile, click the Menu button, and click Remove.
System Settings - Provides several configuration options.
Hide NetExtender when closing window - Hides NetExtender when you click the ok

button.

Display precise number in status - Displays the exact numbers of sent and receive
Automatically establish the underlying connection - Uses the Windows Mobile
Connection Manager to establish the devices connection to the mobile network. The Connection Manage is designed to determine the optimum network type (such as 3g or wi-fi). If this option is disabled, the user manages the connection manually.
Connection Manager compatibility mode - This mode is enabled by default to make
NetExtender Mobile work with applications calling the Microsoft Connection Manager API. In limited cases, server applications may not work properly through NetExtender Mobile, so users can use this selection to disbable the compatibility mode
If a user disables the Connection Manager compatibility mode, a confirmation message will prompt the user that this may cause some some applications using the Connection Manager API to not work properly.
Enable Framing & Caching optimizations - This setting increases the performance
of NetExtender Mobile when it is under a heavy load, such as when downloading big files over NetExtender.
Enable NetExtender log - Records log entries for NetExtender events. Overwrite the previous log when NetExtender starts - Maintains a single
NetExtender log file that is overwritten with each new NetExtender session. Disabling this option will create a separate log file for each NetExtender session.
Proxy Settings - Provides the ability to manually specify a proxy server.
Passwords in NetExtender Mobile
NetExtender Mobile supports the ability for users to change passwords. Also, if configured by an administrator, users can be alerted that the their password is scheduled to expire soon. If a user must change their password, a screen prompt will ask for the users old password, along with a new password and re-verification of the new password.

Another screen prompt will be presented to the user, if their password is scheduled to expire within a configured number of days by the administrator. Click Yes to enter updated password information.
The process for updating password information is the same as above.

Using Virtual Assist

Related Documents
The following Technical Notes provide more information on advanced NetExtender scenarios:
Running NetExtender on a Different TCP Port Using the SonicWALL CDP Agent over a SonicWALL NetExtender Connection Using SonicWALL NetExtender to Access FTP Servers Resolving NetExtender Error With McAfee Enterprise 8.5
Virtual Assist is an easy to use tool that allows SonicWALL SSL VPN users to remotely support customers by taking control of their computers while the customer observes. Virtual Assist is a lightweight, thin client that installs automatically using Java from the SonicWALL SSL VPN Virtual Office without requiring the installation of any external software. For computers that do not support Java, Virtual Assist can be manually installed by downloading an executable file from the Virtual Office. Before using Virtual Assist, you must meet the following requirements:
Virtual Assist is only supported on deployments utilizing the SSL-VPN 2000, SSL-VPN 4000, and SRA 4200 platforms. Virtual Assist is only supported on Windows platforms. Virtual Assist is certified to work on Windows 7, Windows Vista, Windows XP and Windows 2000.
When a user requests service as a customer, Virtual Assist should not be run while connected to the system via RDP for Windows 7 and Windows Vista platforms. Virtual Assist runs as a service for proper access to the customers system, so correct permissions cannot be set if it is run from an RDP connection. There are two sides to a Virtual Assist session: the customer view and the technician view. The customer is the person requesting assistance on their computer. The technician is the person providing assistance. A Virtual Assist session consists of the following sequence of events:

1. 2. 3.

The technician launches Virtual Assist from the SonicWALL SSL VPN Virtual Office. The technician monitors the Assistance Queue for customers requesting assistance. The customer requests assistance by one of these methods:

The Virtual Assist login window displays. Enter the following information and click Login:
Server - The IP address or domain name of SonicWALL SSL-VPN appliance. Username and Password - The username and password for the technicians account on the appliance. Domain - The domain name for the portal. The default value is LocalDomain.
The domain name is case sensitive.
Step 10 The Virtual Assist standalone application launches.
Step 11 The technician is now ready to assist customers.
Performing Virtual Assist Technician Tasks
To get started, the technician logs into the SonicWALL SSL-VPN appliance and launches the Virtual Assist application.
Each technician can only assist one customer at a time. Once the technician has launched the Virtual Assist application, the technician can assist customers by performing the following tasks:
Inviting Customers by Email on page 64 Assisting Customers on page 65 Using the Virtual Assist Taskbar on page 66 Using the Virtual Assist File Transfer on page 67 Controlling the Virtual Assist Display on page 68
Inviting Customers by Email
To invite a customer to Virtual Assist, use the email invitation form on the left of the Virtual Assist window.
Customers who launch Virtual Assist from an email invitation can only be assisted by the technician who sent the invitation. Customers who manually launch Virtual Assist can be assisted by any technician. Enter the customers email address in the Customer E-mail field. Optionally, enter Technician E-mail to use a different return email address than the default technician email. Some mail servers require that an email address be entered, and that it be on a valid domain. Optionally, enter an Additional Message to the customer. Click Invite. The customer will receive an email with an HTML link to launch Virtual Assist. Customers requesting assistance will appear in the Assistance Queue, and the duration of time they have been waiting will be displayed.

Step 4 Step 5 Step 6

Assisting Customers
A pop-up window in the bottom right task bar alerts the technician when a customer is in the assistance queue. Double-click on a customers user name to begin assisting the customer.
The customers entire desktop is displayed in the bottom right window of the Virtual Assist application.

The technician now has complete control of the customers keyboard and mouse. The customer can see all of the actions that the technician performs. During a Virtual Assist session, the customer is not locked out of their computer. Both the technician and customer can control the computer, although this may cause confusion and consternation if they both attempt to drive at the same time. The customer has a small tool bar in the bottom right of their screen, with three options.
The customer has the following options during a Virtual Assist session:
Active - Toggles to the View Only mode, where the technician can view the customers computer but cannot control the computer. Chat - Initiates a chat window with the technician. End Virtual Assist - Terminates the session.
Using the Virtual Assist Taskbar
The Technicians view of Virtual Assist includes a taskbar with a number of options.
Refresh - Refreshes the display of the customers computer. File Transfer - Launches a window to transfer files to and from the customers computer. Chat - Launches the chat window to communicate with the customer. The technician can also use the dedicated chat window in the bottom left window of the Virtual Assist application. System Info -Displays detailed information about the customers computer.
Reboot Customer - Reboot the customers computer. Unless you have Requested full control, the customer will be warned about and given the opportunity to deny the reboot. Switch Screen - Switches to a second monitor if the customers computer has more than one monitor configured.
Request Full Control Technicians can request full control of a customers desktop, allowing them to reboot the system, delete files, or over-write files on the customers computer without the customer being repeatedly prompted for permission. Select Request Full Control under the Commands menu to issue a request that will appear on the customers desktop.
Using the Virtual Assist File Transfer
The File Transfer window is used to transfer files to and from the customers computer. The file directory of the technicians computer is shown on the left and the customers computer on the right.
The File Transfer window functions in much the same manner as Windows Explorer or an FTP program. Navigate the File Transfer window by double-clicking on folders and selecting files. The File Transfer window includes the following controls:

Or you may need to login to the Virtual Office and click the Virtual Assist button.
If you launched Virtual Assist from an email invitation, the application launches directly to the customer queue. If you manually launched the Virtual Assist application or launched it from the Virtual Office, the login window displays.
Enter the following information and click Login:
Login As - Select customer. Server - The IP address, IPv6 address, or hostname of the SonicWALL SSL-VPN appliance. IPv6 addresses must be enclosed in brackets (the [ and ] symbols). Username - Enter your name. Assistance Code - If the technician provided you with an assistance code, enter it here. Issue Description - Optionally, you can enter a brief description of your problem.
Click Login.The Virtual Assist standalone application launches. the Windows firewall.
Step 10 If you receive the following security alert, click Unblock to allow Virtual Assist traffic through
Step 11 A pop-up window indicates that you are in the Virtual Assist queue. The technician will be
alerted that you are ready. Click Cancel to cancel the Virtual Assist request.
Step 12 When the technician initiates the session, the Virtual Assist toolbar appears in the bottom right
of your screen. The technician now has control of your computer.
During a Virtual Assist session, you are not completely locked out of your computer. Both the technician and customer can control the computer, although this may cause confusion and consternation if they both attempt to drive at the same time. You can resume control when the technician is not actively typing or moving the mouse. And you can end the session at any time by clicking the End Virtual Assist button in the bottom right corner.
Step 13 Click the Chat button or enter Alt-c to open an instant message style chat session with the
technician. The Chat button is located in the bottom right corner of your desktop next to the End Virtual Assist button.
Step 14 The technician can also open a Chat window to communicate with you. To chat, type text in the

Launch the File Shares Applet by clicking on the File Shares button in the Virtual Office portal. Click on the Bookmarks button on the task bar in the remote window. A pull down menu displays with the message Loading Bookmarks. Keep the mouse within the pull down menu as the File Shares Applet loads the bookmarks.
Once loaded, click book mark to load the desired file or folder.

Moving Files and Folders

The File Shares Applet is designed for ease of use. There is more than one way to perform file transfers. This section provides an example of a folder that is copied from a remote machine onto the local machines desktop, deleted from the remote machine, and moved back from the local machine unto the remote machine, all from the File Shares Applet.
Launch the File Shares Applet by clicking on a bookmark in the Virtual Office portal. Double-click the C:\ drive, double-click the Documents and Settings folder, then double-click a specific folder, for example, the one that holds the Desktop folder. The current directory shows the Desktop folder. Select a file or folder from the remote machine and drag its icon onto the Desktop folder in the local machine. This will copy the item from the remote machine directly onto the desktop.
Once the transfer is complete, double-click on the Desktop folder. The folder copied from the remote machine will display in that folder.
The item still exists on the remote machine. To initiate a move, not a copy, you must use the Move command from the right-click menu.
To delete the original file or folder, select it by clicking on it once, and press the Delete button on the tool bar. Alternatively, the item can be deleted by using the right-click menu. The File Shares Applet displays a delete confirmation window. Click the Delete button in the pop-up to delete the item.

Warning

The File Shares Applet will completely delete the file or folder from the remote machine. In the case of a folder, nested items will also be deleted. These items will not be sent to the recycle bin on either machine and are not recoverable.

SonicWALL, Inc. 2001 Logic Drive San Jose, CA 95124-3452
PN: 232-001841-00 Rev A 2/10
2010 SonicWALL, Inc. is a registered trademark of SonicWALL, Inc. Other product names mentioned herein may be trademarks and/or registered trademarks of their respective companies. Specifications and descriptions subject to change without notice.
T +1 408.745.9600 F +1 408.745.9300 www.sonicwall.com