secure gateway user guide v1

8/12/2019 Secure Gateway User Guide v1

1/26

COMPANYCONFIDENTIAL PAGE 1OF 26

Shaw Secure VPN Gateway (IVE)

User Guide

Author: IT Security and Compliance, Shaw Cablesystems G.P.

Status

This document is final. Additions and changes will be made as different products are supported or commontroubleshooting steps are identified.

Index

1 Supported Systems

2 Quick Start

3 System Requirements

3.1 Minimum Hardware Requirements

3.2 Minimum Software Requirements3.2.1 Qualified Platform3.2.2 Compatible Platform3.2.3 Core Functionality (Web and File Browsing)3.2.4 Advanced Functionality

3.2.4.1 Client-side Java Applets3.2.4.2 Secure Terminal Access3.2.4.3 Java version of Secure Application Manager (J-SAM)3.2.4.4 Windows version of Secure Application Manager (W-SAM)3.2.4.5 Network Connect3.2.4.6 Host Checker3.2.4.7 Secure Virtual Workspace3.2.4.8 Cache Cleaner3.2.4.9 Terminal Services

3.2.5 Windows Vista Support

3.3 Checking and Upgrading Software Versions3.3.1 Windows

3.3.1.1 Performing Windows Update3.3.1.2 Internet Explorer

3.3.2 Firefox3.3.3 Sun JRE (Java Runtime Environment) and MS JVM3.3.4 Red Hat and Fedora Core Linux3.3.5 Macintosh

3.3.5.1 Safari3.3.5.2 Netscape

3.3.6 Solaris3.3.7 Mozilla

4 Logging In

4.1 Host Checker and Cache Cleaner


2/26

SHAW SECURE VPNGATEWAY (IVE)

SECURE GATEWAY USER GUIDE V1.DOC


4.2 Authentication4.2.1 Authentication Failure

5

Home Page

5.1 Browser Bar5.1.1 Floating Browse Bar

5.2 Browse Field

5.3 Web Bookmarks

5.4 Files

5.5 Terminal Sessions5.5.1 Telnet and SSH Sessions

5.6 Client Application Sessions5.6.1 Network Connect

5.6.1.1 Network Connect and Internet Explorer

6 Secure Meetings

6.1 Scheduling Meetings

6.2 Conducting Meetings

7 Logging Out

8 Frequently Asked Questions (FAQ)

9 Troubleshooting

10 Document Information

10.1 People

10.2 Document History

1 Supported Systems

The Shaw secure VPN gateway allows access to a limited set of resources from any internet browser. Thisincludes home office computers and personal computers that are not supported by Shaw IT services.

Unless your workstation or laptop was provisioned by Shaw IT services then we cannot guarantee supportor connectivity to the VPN gateway. Your personal system may not meet the minimum securityrequirements to connect to the VPN or be incorrectly configured. This document is indented to be used asan installation and troubleshooting guide in the event you have problems connecting.

2 Quick Start

Shaws Secure VPN Gateway is accessible from anywhere on the internet and basic functionality isdelivered entirely over the web. To access the gateway simply browse to the following address:

http://ive.sjrb.ca

Important:Although the secure gateway checks for malicious software installed on your system, if you

suspect you have a virus or you system shows any unexpected behaviour (i.e. popups, unexpectedshutdowns, extremely degraded performance), DO NOTattempt to launch the VPN. If you have a Shaw


3/26




computer please have it examined by IT Desktop Services, otherwise have it checked for malicioussoftware by a qualified professional before connecting.

3 System Requirements

3.1 Minimum Hardware Requirements

The minimum recommended hardware requirements for client systems to utilize the full functionality of theVPN gateway are as follows:

CPU Pentium III 733MHz or equivalent

Memory 256 MB

Hard Disk 20 GB

Network 10/100 Ethernet with broadband internet connection

Operating System See Minimum Software Requirements below

3.2 Minimum Software Requirements

3.2.1 Qualified Platform

The platforms listed in the qualified category have been systematically tested by QA as part of the currentrelease.

3.2.2 Compatib le Platform

The platforms listed in the compatible category have not been systematically tested by our QAdepartment in this release but based on testing in previous releases and knowledge of the platform JuniperNetworks (the secure gateway vendor) expects that the functionality will work and will fully support theseplatforms.

3.2.3 Core Funct ionality (Web and File Browsing)

Qualified platforms:

- Windows XP Pro SP1: Internet Explorer 6.0, Firefox 2.0

- Windows XP Pro SP2: Internet Explorer 7.0, Internet Explorer 6.0, Firefox 2.0

- Windows 2000 SP4: Internet Explorer 6.0, Internet Explorer 5.5, Netscape 8.0, Firefox 1.5

- Windows 98 SE: Internet Explorer 6.0, Netscape 4.79

- Mac OS X 10.4: Safari 2.0- Mac OS X 10.3.2: Safari 1.1, Internet Explorer 5.2

- Mac OS X 10.2.8: Safari 1.0

- Mac 9.2: Internet Explorer 5.1.5 and Netscape 4.79

- Suse Linux 10: Firefox 2.0

- Fedora Core 5: Firefox 2.0

Compatible platforms:

- Windows Server 2003: Internet Explorer 6.0

- Windows XP Home Edition: Internet Explorer 6.0, Firefox 1.5 and greater

- Windows XP Media Center Edition 2002: : IE 6.0


4/26




- Windows XP SP1 and SP2: AOL 8.0

- Windows 2000 SP4: Firefox 1.5 and greater.

- Mac OS X 10.2.8: Safari 1.1 and greater

- Suse Linux 9.3: Mozilla 1.6 and Firefox 1.5 and greater

- Red Hat Linux 9.0: Mozilla 1.6 and Firefox 1.5 and greater

- Solaris 9: Mozilla 1.4

3.2.4 Advanced Functionality

3.2.4.1 Client-side Java Applets


- Windows XP Pro SP2: Internet Explorer 7.0, Internet Explorer 6.0 running Sun JRE 1.5.0_07,Firefox 2.0 running Sun JRE 1.5.0_07

- Windows 2000: Internet Explorer 6.0 running Sun JRE 1.5.0_07, Internet Explorer 5.5 SP2 runningMicrosoft JVM, Firefox 1.5 running Sun JRE 1.4.2

- Windows 98 SE: Internet Explorer 6.0 running MS JVM.

- Mac OS X 10.4: Safari 2.0 running Java 1.5

- Mac OS X 10.3.2: Safari 1.1 and above running Java 1.4.2_09

- Mac OS X 10.2.8: Safari 1.0 running Java 1.4.1_01

- Suse Linux 10: Firefox 2.0 running Sun JRE 1.5.0_07

- Fedora Core 5: Firefox 2.0 running Sun JRE 1.5.0_07

Compatible platforms:- Windows XP Pro SP1: Internet Explorer 6.0 running Sun JRE 1.4.1_01 and greater, Firefox 1.5

and greater running Sun JRE 1.4.1 and greater.

- Windows XP Home Edition: Internet Explorer 6.0 running Sun JRE 1.4.1_01 and greater, Firefox1.5 and greater running Sun JRE 1.4.1 and greater.

- Windows XP Media Center Edition 2002: Internet Explorer 6.0 running Sun JRE 1.4.1_01 andgreater.

- Windows 2000: Internet Explorer 6.0 running MS JVM or Sun JRE 1.4.1_01 and greater, InternetExplorer 5.5 SP2 running MS JVM or Sun JRE 1.4.1 and greater, Firefox 1.5 and greater runningSun JRE 1.4.1_01 and greater.

- Windows 2000: Netscape 8.0 running Sun JRE 1.5.0_05

- Red Hat Linux 9.0: Mozilla 1.6 running Sun JRE 1.4.2_04 and greater.

- Suse Linux 9.3: Firefox 1.5 and Firefox 2.0 running Sun JRE 1.4.2_04 and higher.

- Windows 98: Internet Explorer 6.0 running Microsoft JVM or Sun JRE 1.4.2_04 and higher.

- Red Hat Linux 9.0: Firefox 1.5 and greater running Sun JRE 1.4.2_04 and higher.

- Mac OS 10.2.8: Safari 1.1 running Java 1.4.2_04

3.2.4.2 Secure Terminal Access


- Windows XP Pro SP2: Internet Explorer 7.0, Internet Explorer 6.0 running Sun JRE 1.5.0_07,

Firefox 2.0 running Sun JRE 1.5.0_07


5/26





- Windows 98 SE: Internet Explorer 6.0 running MS JVM.







- Windows XP Pro SP1: Internet Explorer 6.0 running Sun JRE 1.4.1_01 and greater, Firefox 1.5and greater running Sun JRE 1.4.1 and greater.

- Windows XP Home Edition: Internet Explorer 6.0 running Sun JRE 1.4.1_01 and greater, Firefox

1.5 and greater running Sun JRE 1.4.1 and greater.






- Windows 98: Internet Explorer 6.0 running Microsoft JRE or Sun JRE 1.4.2_04 and higher.


- Mac OS 10.2.8: Safari 1.1 running Sun JRE 1.4.2_04

3.2.4.3 Java version of Secure Appl ication Manager (J-SAM)


- Windows XP Pro SP2: Internet Explorer 7.0, Internet Explorer 6.0 running Sun JRE 1.5.0_07,Firefox 2.0 running Sun JRE 1.5.0_07


- Windows 98 SE: Internet Explorer 6.0 running MS JVM.- Mac OS X 10.4: Safari 2.0 running Java 1.5





Note for Mac and Linux implementations:

- Automatic editing of hosts file is only available for root users

- Ports less than 1024 are only available for root users



6/26




- Windows XP Pro SP1: Internet Explorer 6.0 running Sun JRE 1.4.1_01 and greater, Firefox 1.5and greater running Sun JRE 1.4.1 and greater.

- Windows XP Home Edition: Internet Explorer 6.0 running Sun JRE 1.4.1_01 and greater, Firefox

1.5 and greater running Sun JRE 1.4.1 and greater.






- Windows 98: Internet Explorer 6.0 running Microsoft JVM or Sun JRE 1.4.2_04 and higher.


- Mac OS 10.2.8: Safari 1.1 running Sun JRE 1.4.2_04

- Solaris 9: Mozilla 1.4 running Sun JVM 1.4.2_04

Note for Mac, Linux, and Solaris implementations:

- Automatic editing of hosts file is only available for root users

- Ports less than 1024 are only available for root users

3.2.4.4 Windows version of Secure Appl ication Manager (W-SAM)


- Windows XP Pro SP2: Internet Explorer 7.0, Internet Explorer 6.0, Firefox 2.0 with Sun JRE 1.5\

- Windows 2000: Internet Explorer 6.0, Internet Explorer 5.5 SP2, Firefox 1.5 with Sun JRE 1.5 and1.4.2.


- Windows 98 SE: Internet Explorer 6.0 (WSAM + NetBIOS is not supported in Windows 98)


- Windows XP Pro SP1: Firefox 1.5 and greater running Sun JRE 1.4.1 and greater.



3.2.4.5 Network Connect


- Windows XP Pro SP2: Internet Explorer 7.0, Internet Explorer 6.0, Firefox 2.0 with Sun JRE 1.5

- Windows 2000: Internet Explorer 6.0, Internet Explorer 5.5 SP2, Firefox 1.5 with Sun JRE 1.5 and1.4.2.


- Windows 98 SE: Internet Explorer 6.0



7/26




- Mac OS X 10.3.2: Safari 1.1 and above, running Java 1.4.2_04

- Mac OS X 10.2.8: Safari 1.0 and 1.1, running above Java 1.4.1_04




- Windows XP Pro SP1: Firefox 1.5 and greater running Sun JRE 1.4.1 and greater.



- Red Hat Linux 9.0 on x86 platforms: Firefox 1.5 and greater running Sun JRE 1.4.2_04

- Suse Linux 9.3 on x86 platforms: Firefox 1.5 and greater running Sun JRE 1.4..2_04

3.2.4.6 Host Checker


- Windows XP SP2: Internet Explorer 7.0, Internet Explorer 6.0 and Firefox 2.0

- Windows 2000 SP4: Internet Explorer 5.5 SP2

- Windows 98: Internet Explorer 6.0 and Firefox 1.5

- Mac OS X 10.4: Safari 2.0

- Mac OS X 10.3.7: Safari 1.2

- Suse Linux 10: Firefox 2.0

- Fedora Core 5: Firefox 2.0


- Windows XP SP1: Firefox 1.5 and greater.


- Windows XP Media Center Edition 2002: : Internet Explorer 6.0

- Windows 2000: Internet Explorer 6.0, Firefox 1.5 and greater.

- Windows NT: Internet Explorer 6.0

- Windows 98: Firefox 1.5 and greater.

- Mac OS X 10.3.7: Safari 1.1 and greater.- Red Hat Linux 9.0: Firefox 1.5 and greater

3.2.4.7 Secure Virtual Workspace


- Windows XP Pro SP2: Internet Explorer 7.0

- Windows XP Pro SP1 and SP2: Internet Explorer 6.0, and Firefox 2.0.

- Windows 2000 SP4: Internet Explorer 6.0, Internet Explorer 5.5 SP2, and Firefox 1.5.

Compatible platform:

- Windows XP Home: Internet Explorer 6.0, Firefox 1.5 and greater


8/26




3.2.4.8 Cache Cleaner



- Windows XP Pro SP1 and SP2: Internet Explorer 6.0 and Firefox 2.0

- Windows 2000 SP4: Windows 2000: Internet Explorer 6.0, Internet Explorer 5.5 SP2.


- Windows 98 SE: Internet Explorer 5.5 SP2




- Windows XP Media Center Edition 2002: Internet Explorer 6.0

3.2.4.9 Terminal Services



- Windows XP Pro SP1 and SP2*: Internet Explorer 6.0 and Firefox 2.0.

- Windows 2000 SP4: Internet Explorer 6.0, Internet Explorer 5.5 SP2, Firefox 2.0 and Firefox 1.5.





- Windows XP Media Center Edition 2002: Internet Explorer 6.0

* Windows XP SP2 contains a bug which prevents connections to loopback addresses. This functionality isrequired for J-SAM, W-SAM, and Terminal Services. Hot fix 884020,http://support.microsoft.com/default.aspx?scid=kb;en-us;884020includes the fix however; due to possiblesecurity vulnerabilities our recommendation is to apply the latest Microsoft security update that includesthis fix.

3.2.5 Windows Vista Support

As of Jan 19, 2007 we do not support Windows Vista for advanced functionality. It has been reported thatbasic features such as web browsing and file transfers do work with the current release of windows Vista

running internet explorer 7. We expect full feature functionality to be released and supported by the end ofApril 2007.

3.3 Checking and Upgrading Software Versions

You may need to upgrade your operating system or software components in order to launch and properlydisplay the secure gateway and/or use advanced features like network connect. Shaw recommends thatyou install all available updates, according to your operating system vendors recommendations andensure that your system is functioning normallybefore connecting to the VPN gateway.

3.3.1 Windows

To check the version of windows you are currently running, as well as the service pack that is installed:

1. right click on My Computer on the desktop and select Properties


9/26




2. in the General tab you should see the windows version as well as the service pack level underthe heading System:

Figure 3.3.1(1) System Properties window in Windows XP

To upgrade your version of windows you must purchase an upgrade or replacement copy. Please seehttp://www.microsoft.com/windows/default.mspxfor more information.

Service packs can be downloaded from Microsoft but we recommend running windows update beforeusing the VPN, windows update will automatically upgrade your system to the latest service pack.

3.3.1.1 Performing Windows Update

To perform a windows update, which will update your windows components to the latest versions as wellas install any missing service packs, perform the following steps:

1. launch internet explorer

2. in the Tools menu select Windows Update you will be taken to the windows update site andprompted to update your components as needed.


10/26




Figure 3.3.1(1) Tools Menu in Internet Explorer

Depending on the last time windows update was run you may be prompted several times to reboot yoursystem. After rebooting please repeat the above steps until the windows update site reports that yoursystem is up-to-date.

3.3.1.2 Internet Explorer

To check the version of internet explorer that you are running perform the following steps:

1. launch internet explorer

2. in the Help menu select About Internet Explorer you should see the version and service packlevel of internet explorer

Figure 3.3.1.2(1) About Internet Explorer Window

Internet explorer can be updated to the latest version by running windows update as specified in section3.3.1.1. Alternatively internet explorer installation files can be downloaded athttp://www.microsoft.com/windows/ie/default.mspx

3.3.2 Firefox

To check the version of Firefox that you are running perform the following steps:


11/26




1. launch Firefox

2. in the Help menu select About Mozilla Firefox you should see the version

Figure 3.3.2(1) About Mozilla Firefox Window

The latest version of Mozilla Firefox can be downloaded at http://www.mozilla.com/en-US/firefox/

3.3.3 Sun JRE (Java Runtime Environment) and MS JVM

To find out which version of Java you are currently running visit http://www.javatester.org/version.html

Javatester.org provides specific instructions for determining the version of Java you are running with yourbrowser. It also contains links to Suns website where you can download and install the latest version (orolder versions) of the Sun JRE. To download the latest version from Sun go tohttp://java.com/en/download/

Microsoft no longer supports their JVM. If you require a specific version please upgrade to the Sun JREfrom Sun Microsystems.

Suns JRE runs on Linux, Solaris, Windows and Mac OS(X).

3.3.4 Red Hat and Fedora Core Linux

To find out the version of red hat Linux you are running you can look in the /etc/redhat-release file. Youshould see a string to indicate the version you are running.

Figure 3.3.4(1) Contents of /etc/redhat-release file


12/26




You may download* the latest versions of Red Hat install media fromhttps://www.redhat.com/apps/download/

*If you do not have an active subscription with Red Hat you will need to purchase the install media.

Fedora core is an open-source community supported operating system but major versions can bedownloaded from http://fedora.redhat.com/Download/

3.3.5 Macintosh

Only core functionality is available with Mac OS 9.2. OSX is required for any advanced functionality. Todetermine the version of Mac OS you are running:

1. click on the Apple icon in the top left corner of your screen and select About This Mac.

2. this should bring up version information about the version of Mac OS you are running

Figure 3.3.5(1) About This Mac Window

Please refer to apples support site, http://www.apple.com/support/to determine if you can upgrade theMac OS version on your system.

3.3.5.1 Safari

To determine the version of safari you are currently running:

1. Open your Safari web browser by clicking on the Safari icon in the dock.

2. Click on Safari in your Safari menu, located at the top of your screen.

3. A drop-down menu will now appear. Choose the option labelled About Safari.

4. A dialog box will now appear containing the browser's version number.


13/26




Figure 3.3.5.1(1) About Safari Window

The latest version of safari can be downloaded at http://www.apple.com/support/downloads/safari.html

3.3.5.2 Netscape

Netscape Version 4.79 for Mac PowerPC as well as most other operating systems can be downloaded athttp://browser.netscape.com/ns8/download/archive47x.jsp

3.3.6 Solaris

Solaris runs SunOS. Your version of SunOS can be found by running the command uname a

SunOS will report its version numbers as follows:

SunOS 5.8 = Solaris 8

SunOS 5.9 = Solaris 9SunOS 5.10 = Solaris 10

Please visit Suns website at http://www.sun.comto see which version of Solaris your system can supportand if you are eligible for an upgrade.

3.3.7 Mozilla

The latest version of the Mozilla browser suite can be downloaded athttp://www.mozilla.org/releases/#1.7.13

4 Logging In

To access the login page for the secure access VPN gateway point you internet browser to the followingaddress:

http://ive.sjrb.ca

Important:Although the secure gateway checks for malicious software installed on your system, if yoususpect you have a virus or you system shows any unexpected behaviour (i.e. popups, unexpectedshutdowns, extremely degraded performance), DO NOTattempt to launch the VPN. If you have a Shawcomputer please have it examined by IT Desktop Services, otherwise have it checked for malicioussoftware by a qualified professional before connecting.

Once connected to the system, you may create a bookmark in your web browsers favourites orbookmarks folder so that you do not need to type the entire address in to connect in the future.

The secure gateway is accessible from both inside the Shaw network and on the internet. Some featuresthat work on the internet may not work when connecting from the inside. You should access the resourcedirectly if you are connected to Shaws internal network.


14/26




4.1 Host Checker and Cache Cleaner

Before you are presented with a page to provide your user id and password, the gateway will attempt toload several software components to check for the following types of malicious software running on your

system:

- keyloggers

- viruses and Trojans

- malware

- other potentially malicious software

You should see a screen indicating that the host checker and cache cleaner are loading.

Figure 4.1(1) Loading Secure Gateway Components

The secure gateway can download and deploy the host checker and cache cleaner software using activex(on windows) or with Java (on other operating systems, or as a fallback install method on windows)

If you are presented with a Java window or an activex warning about software needing to be installed fromJuniper Networks Inc. you must say Yes, otherwise the host checker and cache cleaner may fail to loadpreventing you from logging into the VPN.


15/26




Figure 4.1(2) ActiveX install warning

Figure 4.1(3) ActiveX install warning

Host checker and cache cleaner may cause one or more the following images (processes) to run on yoursystem:

- dshostchecker.exe

- dscachecleaner.exe

- jhoe.exe

- dsncservice.exe

- dssamproxy.exe

- dssamui.exe

The execution of these programs before you login or during your session is normal. If you have securitysoftware that alerts you of these processes or may block their execution, you will be unable to login. Youmust allow the execution of these processes if prompted by firewall or security so ftware.

The host checker process will place an icon in your tray to notify you of malicious software it detects. Youcan also use it to check the status of the host checker application by right clicking the icon and selecting

Details.

Figure 4.1(4) Host checker and Java tray icons

The appearance of the Java icon (coffee cup) is normal during your session.

Note for Shaw Secure Users

It has been observed that the Shaw Secure product may try to block the execution of these programs. Ifprompted please allow these programs to run.


16/26




4.2 Authentication

The credentials you must provide to login to the VPN gateway are your Shaw corporate e-mail addressand your domain password. (I.e. the same password you use to login to your workstation)

Figure 4.2(1) Secure Gateway Login Page

Some users may have more than one e-mail address. The address you must use is your primary e-mailaddress. The e-mail address field is not case sensitive.

If you are unsure of your primary e-mail address you can check your properties in the global address book.(Address Book in Outlook.) Your primary e-mail address is indicated by the prefix SMTP: (note the capitalletters, secondary addresses will be lowercase)

Figure 4.2(2) Outlook Address Book Contact Properties (multiple e-mail addresses example)


17/26




4.2.1 Authentication Failure

A failed username or password combination will produce an Invalid Username or Password message andprompt you to re-authenticate. Your windows domain account will be locked after 5 failed attempts. Please

contact the IT Service Centre (4944) to have your account un-locked.

Due to security concerns we cannot do password resets over the phone without some form of identityverification.

5 Home Page

A successful login will present you with the Secure VPN Gateway home page. The home page contains allof your pre-defined links, user created links, and links to launch advanced utilities like network connect,secure application manager and secure meetings.

Figure 5(1) Home page browser bar (top) and browse field (bottom)

Your level of access and which panels and features are displayed or accessible on your home pagedepend on how your account was setup. If you have any questions about missing access or accesschanges please contact the IT Service Centre (4944)

5.1 Browser Bar

The browser bar is located in the top left of the web page. It provides an interface that should always bedisplayed while using the secure gateway. The buttons on the bar provide functionality to:

- Home: return to the home page from any other page you are currently viewing.

- Meetings: host or join a secure meeting

- Preferences: change the appearance of your home page, change your password and configureyour secure meeting preferences

- Session Timer: the session timer tells you the remaining time until your session is disconnected.The session timer is reset every time you login.

- Help: opens the comprehensive online help system

- Sign Out: logout of the secure VPN gateway and terminate all VPN components running on yoursystem

5.1.1 Floating Browse Bar

When browsing away from the home page to internal sites the VPN gateway will re-write your pages with abrowser bar that allows you to navigate back to the home page or sign out regardless of the page you areon.

Figure 5.1.1(1) Floating Browse Bar

You can move the browse bar to either side of the active page by clicking the arrow icon beside the homeicon.


18/26




5.2 Browse Field

The browse field is a text entry field that functions similar to the address field on your internet browser,allowing you to enter website addresses (and other resources) to access directly.

You can enter the following types of resources in the browse field:

Use this format To

http://www.domain.com

OR

https://www.domain.com

OR

domain.com

Browse web pages

i.e. shawnet

\\server\share

OR

smb://server/share

Access shares on Windows file servers

i.e. \\dilbert\someuser$

telnet://host:portSSH://host:port

Start a telnet/SSH session to connect to the specifiedhostname and port

ica:// Start Citrix terminal services to connect to the specifiedhostname (Windows only)

rdp:// Start Microsoft terminal services or a remote desktopsession to the specified hostname (Windows only)

outlook:inbox

OR

outlook:today

OR

(any x:y format that your browser supports)

Access your Outlook inbox or calendar (Windows only).

(For any text you enter as x:y, the secure gateway passes itto your browser without executing it.) You must have Outlookinstalled for this feature to work.

5.3 Web BookmarksThe Web Bookmarks panel on the secure gateway home page provides a centralized location for links tocorporate resources. A resource can be any Web page or Web application that can be accessed throughthe secure gateway. The secure gateway rewrites the links in this panel in order to secure traffic betweenyour computer and the Web resource. When you click a link or use the Browse field at the top of thesecure gateway home page, the transmitted page content is rewritten.

If your system administrator enables the option for personal bookmarks, you can create your own links inthe Web Bookmarks panel by clicking the + (plus sign) icon.

Figure 5.3(1) Web Bookmarks panel

5.4 Files

The Files panel on the secure gateway home page provides a centralized location for links to files thatreside on an internal corporate network. If your system administrator enables the option for personalbookmarks, you can create your own links in the Files panel by clicking the + (plus sign) icon.


19/26




Figure 5.4(1) Files panel

5.5 Terminal Sessions

Terminal services enable you to use Windows-based or Citrix applications that are running directly on yourcompanys terminal server. When you run an application on the terminal server, most actions areperformed on the server itself rather than your workstation. The terminal server only transmits keyboard,mouse, and display information over the network.

Figure 5.4(1) Terminal Sessions panel

If your workstation is connected to the Shaw network, is powered on and has remote desktop servicesenabled you can configure a session to connect to it remotely. Use the following settings as a guide:

Figure 5.4(2) Example settings for remote desktop connection

Using a smaller screen size or a smaller color depth may improve performance over slow internetconnections.

5.5.1 Telnet and SSH Sessions

If enabled by your administrator, you can use the Telnet and SSH protocols in the Browse field of thesecure gateway home page or the terminal sessions panel to browse to UNIX servers, networking devices,and other legacy applications that utilize terminal services.


20/26




The secure terminal application is Java based and may not include functionality or emulation for allterminal types. If you are having issues using a text terminal application or console please contact the ITService Centre (4944) to explore alternative access methods.

5.6 Client Appl ication Sessions

The secure gateway secures traffic to applications that reside on your corporate servers (such as MicrosoftOutlook) through the Secure Application Manager.

To access an application through the Secure Application Manager, you must first start a SecureApplication Manager session through the secure gateway. You can then access your application. Onceyou start the application, the Secure Application Manager secures the traffic between your computer andthe applications server. Access to applications using this method is determined by your profile and accesslevel granted to you when your account was activated.

The secure gateway includes two versions of the Secure Application Manager. You can determine whichversion your administrator has enabled for you by viewing options in the Client Application Sessions panel

on the secure gateway home page:- WSAM- If you see the Windows Secure Application Manager option in the Client Application

Sessions panel, the secure gateway secures application connections using the Windows SecureApplications Manager (WSAM).

- JSAM- If you see the Java Secure Applications Manager in the Client Application Sessions panelor page, the secure gateway secures application connections using the Java Secure ApplicationsManager (JSAM). (To use JSAM, you or your administrator must install the Java Virtual Machineon your computer, see section 3.3.3.)

Secure application access is configured by the IT Security and Compliance group on a per user or pergroup basis based on the requirements to run applications remotely. SAM and JSAM sessions should onlybe used if no basic access can be used.

Figure 5.6(1) Client Application Sessions panel

5.6.1 Network Connect

Network Connect is a client application that the secure gateway installs on your computer. Once started,this application provides a secure tunnel through the secure gateway to your corporate network from aremote location, such as a customer site, conference kiosk, or home office. Using this secure tunnel, youcan access applications, servers, and files on Shaws internal network.

The network connect client provides the same functionality as a direct connection to the network would.

Network connect requires that a browser session be open to the secure gateway. If you close your activebrowser window while network connect is connected your connection will be terminated and you will needto login again

NOTE:You must have root privileges or the root password to install the network connect client on a Macor UNIX system and Administrator privileges on a Windows system.

Network connect will appear as a tray icon similar to host checker. You can disconnect your session outcompletely by tight clicking this icon. You can click on Basic View or Advanced View to see networkconnect status and network statistics.


21/26




Figure 5.6.1(1) Network Connect

5.6.1.1 Network Connect and Internet Explorer

An important condition exists where the network connect client may fail to connect if Internet Explorer isconfigured to automatically detect its proxy settings. If you receive any errors trying to launch the networkconnect client please ensure that Internet Explorers Connection settings are correct.

To disable the automatic proxy detection:

1. choose Internet Options from the tools menu in Internet Explorer

2. click the Connections tab

3. click LAN Settings and ensure that the checkbox beside Automatically Detect Settings isunchecked


22/26




Figure 5.6.1.1(1) Internet Explorer LAN Settings Window

6 Secure Meetings

Secure Meeting allows secure gateway users to securely schedule and hold online meetings between bothin-network and out-of-network users. In meetings, users can share their desktops and applications withone another over a secure connection, allowing everyone in the meeting to instantaneously shareelectronic data on-screen. Meeting attendees can also securely collaborate online by remote-controllingone another's desktops and through text chatting using a separate application window that does notinterfere with the presentation.

NOTE:Secure Meeting grants invitees different levels of access based on the compatibility of theircomputer configurations. To determine the level of accessibility allowed by your configuration, click theCheck Meeting Compatibility link in the meeting sign in page or invitation email.

NOTE:Before you begin using Secure Meeting, we recommend that navigate to the Preferences >

General tab and use the Daylight Savings Time option to adjust meeting times based on daylight savingsfor your area. By default, Secure Meeting uses the daylight savings time rules set on the server by youradministrator. However, you can override the server setting by specifying the country whose daylightsavings time rules your local client should observe instead. Secure Meeting adjusts your individual meetingtimes as necessary based the specified DST option and your browser settings.

6.1 Scheduling Meetings

Each Secure Meeting online meeting must be scheduled by a secure gateway user. Through the securegateway interface, the meeting creator specifies meeting details, including the meeting name, description,start time, start date, recurrence pattern, duration, password, a list of invitees, and the email addresses ofthe invitees.

Meeting creators can use either of the following applications to schedule meetings:- Secure Meeting end user consoleWhen the meeting creator uses the secure gateway end

user console to schedule a meeting, Secure Meeting displays it in the Meetings page of meeting-enabled secure gateway invitees. Secure Meeting also sends a notification email to each inviteewith a known email address.

- Microsoft OutlookWhen the meeting creator uses Microsoft Outlook to schedule a meeting,Outlook displays it in the Calendar page of other Outlook-enabled invitees and sends a notificationemail to each invitee through the Outlook email server. Secure Meeting also displays the meetingin the meeting creators Meetings page in the secure gateway end user console.

When specifying a list of invitees, the meeting creator must group them into one of two categories:

- In-network inviteesAn in-network invitee is a secure gateway user who signs into the same

secure gateway server as the meeting creator. An in-network invitee can access meetings throughthe secure gateway and can attend meetings without presenting a meeting password. Wheninviting an in-network user to a meeting, the meeting creator must specify the users securegateway username and authentication server.

- Out-of-network inviteesAn out-of-network invitee is a non-secure gateway user or a securegateway user who signs into a different secure gateway server as the meeting creator. Out-of-network invitees can only attend meetings if the Secure Meeting administrator enables it. Whenallowed to attend, out-of-network invitees must access meetings through a special URL that allowsthem to join the meeting without allowing them access to other resources on the secure gateway. Ifrequired by the meeting creator or administrator, out-of-network invitees must supply the meetingpassword for access. When inviting an out-of-network user to a meeting, the meeting creator mustspecify the users email address.


23/26




NOTE:If an in-network invitee uses the meeting URL instead of the Meetings page in the secure gatewayend user console to join a meeting, Secure Meeting classifies the user as an out-of-network invitee.

When the meeting creator uses Microsoft Outlook to schedule a meeting, all invitees except the meeting

creator are classified as out-of-network invitees.

6.2 Conduct ing Meetings

The meeting conductor is an in-network user who is responsible for starting the meeting. Secure Meetinggrants the conductor the following responsibilities and capabilities in order to help him effectively run hismeeting:

- Starting the meeting presentationBefore the conductor joins, the other attendees can onlychat. They cannot view or make a presentation because the conductor is also the default meetingpresenter. The meeting presenter starts the meeting presentation by sharing his desktop orapplications with other attendees.

- Passing conductor and presenter rightsThe meeting conductor can choose to pass some orall of his responsibilities to another meeting attendee. For instance, after joining the meeting, theconductor can specify that another attendee should start the meeting presentation by passing thatattendee presenter rights. The conductor can pass his conductor rights to any other in-networkuser and pass his presenter rights to any other in-network or out-of-network user.

- Monitoring the meeting The meeting conductor is responsible for expelling meeting attendeesif necessary. The meeting conductor can also see the names of all meeting attendees so that hecan determine who is attending (even if the meeting creator or administrator chooses to hidenames)

- Ending the meetingThe meeting conductor is responsible for extending the meeting if it runsover the scheduled duration and closing the meeting when it is done.

For more information about conducting a meeting, access the Secure Meeting help from the Help menu in

the Secure Meeting Client window.

7 Logging Out

Once your internet browser is closed all of your VPN connections will be terminated. Shaw advises thatyou use the Sign Out button on the browser bar in the top right of the home page. By signing out the VPNwill cleanly shutdown all of the host checker and cache cleaner processes running on your system.

Not cleanly logging out can cause internet connection issues after disconnecting. If you are experiencingany strange behaviour after logging out, try logging in again and, once logged in, use the Sign Out buttoninstead of closing the browser.

8 Frequently Asked Questions (FAQ)

Q:Why are we using our e-mail address to login?A: Since duplicate usernames exist in both the SJRB and STARCHOICE domains it is necessary to usean identifier that is unique across both domains. Everyone has a unique e-mail address because two of thesame addresses cannot exist on the internet.

Q:What does SSL VPN mean?A: SSL stands for Secure Sockets Layer; it is a set of encryption protocols that standard web browsers useto secure communications. Your bank uses an SSL web connection, just like the secure gateway to makesure your information is safe as it travels across the internet. VPN Stands for Virtual Private Network, anextension of the corporate network to remote locations.

Q:Why doesnt everyone get VPN access by default?A: To minimize our risk of exposure and loss of confidential information Shaw must approve all VPN

requests and track which employees and vendors have remote access.


24/26




Q:Do we use Citrix?A: Shaw does not currently have a Citrix remote access solution deployed. If you wish to access specificcorporate applications you can:

a) connect via remote desktop to your workstation

b) use Shaw equipment with the required applications are pre-installed

Q:Can I use my home computer to connect?A: Yes, if approved, you can access basic functionality and a limited set of internal websites and fileservers using your home computer as long as it passes the security checks when logging in. In order touse most advanced features or Network Connect you must be using a Shaw system.

Q:Can I connect from behind a router or firewall?A: Yes, an SSL VPN overcomes firewall and router issues that traditional VPNs cause because it uses astandard web browsing connection to pass secure traffic.

Q:Can I use the VPN for large quantity of users or critical third-party-access?A: In most cases we recommend working with IT to provision a point-to-point VPN rather than an SSL

VPN, however in special circumstances we can use the SSL VPN for third-party-access. Please see ITSecurity and Compliance for more information as a special agreement is required for third parties.

9 Troubleshooting

The following are common problems experienced by users when connecting to the secure gateway. If youare having trouble connecting or problems accessing a resource please look through these troubleshootingsteps before calling the IT Service Centre (4944)

Before attempting troubleshooting please ensure that you install all available updates, according to youroperating system vendors recommendations and check your operating system, browser and Javaversions to ensure they are supported (see section 3.2)


25/26




Symptom Cause(s) Possible Resolution

I receive an error pagecannot be displayed when

trying to browse tohttps://ive.sjrb.ca

No internet connection

Service is unavailable

Check your internet connection, can youbrowse to other web sites?

The secure gateway could beundergoing maintenance. Please tryagain soon or contact 4944.

I receive the error you do nothave permission to loginwhen trying to browse tohttp://ive.sjrb.ca

Your internet browser is notsupported

Your browser is sending anunrecognized browser string

Please check the user guide (section3.2) to see if you browser is supported

You may be infected with a virus, if youdo not know how to change yourbrowser string please check for viruses.

I receive the errornc.windows.app.23791 whenlaunching Network Connect

You are running an un-patchedversion of Windows XP SP2

Internet Explorer is configured toAutomatically detect proxy

Run windows update and install thelatest patches or download a hot fix athttp://support.microsoft.com/?kbid=884020

Disable automatic proxy detection. Seesection 5.6.1.1

I receive an error Access tothe Web site is blocked byyour administrator whentrying to access an internalweb site

You do not have access to viewthat web site using VPN

Contact 4944 and request that youraccess be changed or reviewed

While loading the hostchecker or cache cleaner, thebrowser stops responding fora long period of time

An activex install is trying toinstall to the same location as aJava install

Close or terminate your internet browserand restart your computer. Tryconnecting again

I receive the error Yourcomputer's security isunsatisfactory when trying tobrowse to http://ive.sjrb.ca

You do not have the rights toinstall applications

You have malicious softwarerunning that the secure gatewaycannot terminate

Java is not installed properly

Anti-virus is not installed or out-of-date

You must have access to installapplications on your system. Lockeddown computers or kiosks may notfunction correctly for use with the securegateway.

Have your computer scanned for virusesand malicious software

See section 3.3.3 for instructions oninstalling or upgrading your Java versionIf you are using a Shaw system youshould connect it to the network and

perform an update to your anti-virussoftware or contact IT Desktop Services

I cannot connect to myworkstation with terminalservices

Your desktop is turned off

Remote Desktop is not enabledon your workstation

Make sure you leave your workstationon when you leave the office

Contact the IT Service Centre forinformation on enabling RemoteDesktop on your workstation

Outlook web access does notwork

You may not be authorized touse outlook web access or itmay be misconfigured onShaws server

Contact the IT Service Centre

Invalid username orpassword. Please re-enteryour user information.

Your account is locked out ordisabled

Contact the IT Service Centre


26/26




Symptom Cause(s) Possible Resolution

You may be entering the wronge-mail address

Check to make sure you are enteringyour PRIMARY e-mail. See section 4.2

You receive the error Theserver had an internal Error

The content mediation enginemay be restarting

The secure gateway could beundergoing maintenance. Please tryagain soon or contact 4944.

Network connect is notlaunching when using Firefoxon my Mac OSX system

Certain version conflicts on aMac system prevent this fromfunctioning properly

Install the latest version of the Safaribrowser (see section 3.3.5.1) and tryrunning network connect again.

10 Document Information

10.1 People

Role Person / PeopleContributors IT Security and Compliance

Reviewers IT Security and Compliance, IT Account Administration, IT Service Centre, IT BusinessRelations

Distribution See Reviewers

10.2 Document History

Date Version Status Description

16-Jan-07 0.1 Draft Initial document.

19-Jan-07 0.2 Final Draft First review and revision

22-Jan-07 0.5 Final Draft Spelling, format changes, >PDF

23-Jan-07 1.0 Final Updated status

secure gateway user guide v1

Documents