Configuring SSL VPN-Plus in vCloud Director

by | Jan 30, 2020 | NSX, vCloud Director | 2 comments

This article shows how configuring SSL VPN-Plus on an NSX Edge in vCloud Director is done.

Below you can find the specifics of my lab setup:

  • Organization: vBlog.nl
  • Org VDC: Org-VDC-vBlog.nl-01
  • NSX Edge: Edge-Org-VDC-vBlog.nl-01
  • Public IP: 5.39.172.xxx
  • LAN / Local network: 192.168.100.254/24
  • VPN network: 10.10.10.0/24

The steps we need to take to configure SSL VPN-Plus are:

  1. Configure an authentication server
  2. Setup the VPN server
  3. Define the LAN / Local network
  4. Configure an installation package
  5. Setup an IP pool to assign IP addresses to the VPN users
  6. Add VPN user(s)
  7. Configure the firewall
  8. Test the SSL VPN connection

Let’s start configuring the NSX Edge!

Open the Org VDC with the NSX Edge you want to configure for SSL VPN-Plus
Open the Org VDC with the NSX Edge you want to configure for SSL VPN-Plus
Navigate to Edges > Select the Edge and choose Services
Navigate to Edges > Select the NSX Edge and choose Services

Configure an authentication server

Navigate to SSL VPN-Plus > Authentication and choose Local
Navigate to SSL VPN-Plus > Authentication and choose Local
  • Enable the Password Policy > Adjust the Password Length, Characters, etc.
  • Toggle Password should not contain user ID and define the Password Expiry policy
  • Define the Retry Count, Duration and toggle Enabled
Configure the Password Policy matching your needs

Setup the SSL VPN server

Navigate to SSL VPN-Plus > Server settings > Toggle Enabled > Select the Public IP and Port for SSL VPN > Choose AES-256-SHA and choose Save Settings in the yellow bar.
Navigate to SSL VPN-Plus > Server settings > Toggle Enabled > Select the Public IP and Port for SSL VPN > Choose AES-256-SHA and choose Save Settings in the yellow bar.

Define the LAN / Local network

Navigate to Private Networks and choose the Plus sign to define your local networks
Navigate to Private Networks and choose the Plus sign to define your local networks
  • Configure your LAN / Local network
  • Toggle Status and choose Keep
Add the local network(s) you want to be able to reach when connected to the VPN Server.
Choose Save settings in the yellow bar before we continue to the next steps.
Choose Save settings in the yellow bar before we continue to the next steps.

Configure an installation package

Head over to the Installation Packages section and choose the Plus sign.
Head over to the Installation Packages section and choose the Plus sign.
  • Give a name to the package and define the Gateway IP and Port
  • Add a description > Toggle Enabled > define Installation Parameters and choose Keep
Add a new installation package

Setup an IP pool

Navigate to IP Pools and choose the Plus sign
Navigate to IP Pools and choose the Plus sign
  • Enter your IP range, Netmask and Gateway
  • Toggle Status and configure your DNS settings
Configure the IP Pool with an IP range, Subnet, Gateway, etc and choose Keep

Add VPN users

Navigate to Users and choose the Plus sign
Navigate to Users and choose the Plus sign
Add your user(s) and choose Keep
Add your user(s) and choose Keep
A new firewall rule will be automatically
A new firewall rule for the public portal will be automatically created

Configure the firewall

Navigate to Grouping Objects and choose the Plus sign
  • IP Set for LAN
  • IP Set for SSL VPN
Add a new IP Set for the LAN and SSL VPN subnet
Add a new firewall rule to allow traffic coming from the SSL VPN subnet to the LAN subnet using the IP sets we just created.

Test the SSL VPN connection

Use your browser to navigate to your new SSL VPN-Plus portal and login
Use your browser to navigate to your new SSL VPN-Plus portal and login
Download and install the VPN client
Download and install the VPN client
Open the VMware SSL VPN-Plus client and choose Connect

And we’re done configuring SSL VPN-Plus in vCloud Director.
Now you can browse, ping, RDP, SSH, etc. to the machines in your LAN subnet!

Check out our vCloud Director related articles here.
Check out our NSX related articles here.
Check out official VMware NSX documentation here.

 4,728 total views,  4 views today

2 Comments

  1. Radek
    Radek on April 11, 2020 at 1:21 pm

    Great article, thanks for that. But I have a question:
    What do one needs to do if he wants to allow full internet access of ssl vpn-plus clients via edge gateway?
    How to configure firewall/NAT in full tunnel mode?
    Is it possible to route all client traffic to internet via edge gateway?

    Thanks

    Reply
  2. Lawrence
    Lawrence on September 2, 2021 at 4:04 pm

    Have you ever seen issues with accounts with expired passwords not being able to reset the password through the client. Using AD Authentication Service.

    Thanks.

    Reply

Submit a Comment

Your email address will not be published.

*

code