UAG - Activating your configuration

The first few times I used UAG, I wondered why it took so long to activate the configuration.  Even though the finish screen came up, the configuration would not always be live.

There is an easy way to check this by using the messages.  On the main UAG screen, click on "Messages" and select "Filter Messages...", then select "Informational messages".

So the before the finish button would appear after activation:

But if you have a look at the following screen, you can see it takes a bit longer before the activation is completed.

UAG - RDP set up

I've been struggling with publishing RDP on my test UAG appliance, as it was not the same as IAG.

First of all, publish the application which is located on the "Terminal Services (TS)/Remote Desktop Services (RDS)", where you have "RemoteApp" for use with Windows 2008 Terminal Services, Remote Desktop (Predefined and User defined), as well as the two options available from IAG.

I can't use the two options from IAG, as they do not support 64-bit clients (and I use Windows 7 64-bit).

Publish the application as Remote Desktop, either predefined so no user interaction, or user defined where the user will need to specify the desktop to connect to.

Give the application a name, set up the appropriate access policy, define the server to connect to, configure the client settings, ensure the portal link information is correct and ensure the authorisation is correct.

As I found out, this alone will not work and your will receive an error, which points to certificate issues.

As the UAG appliance is the Remote Desktop Gateway, a certificate will need to be applied to it.  Go to the Start menu, and select "Administrative Tools/Remote Desktop Services/Remote Desktop Gateway Manager".  From there expand the server, and you will see an option to apply a certificate to the gateway.

Apply the appropriate certificate and enjoy remote access!

Microsoft UAG Update 1

Microsoft released UAG Update 1 last month, which updates the following areas:

• Remote Desktop access from Windows Vista and Windows XP: Client endpoints running Windows Vista and Windows XP can now access RemoteApps and Remote Desktops published through Forefront UAG.
• Support for Microsoft SharePoint Server 2010: Forefront UAG now supports SharePoint Server 2010.
• Support for MSOFBA: Forefront UAG now supports the Office Forms Based Authentication protocol to allow rich clients to directly access applications published through Forefront UAG.
• Support for site cookies: Forefront UAG now supports the use of site cookies for non-alternate access mapping applications, in addition to domain cookies.
• Support for large CustomUpdate files: Forefront UAG now supports CustomUpdate files up to 1.5 GB in size.
• Changes in Group Policy Object (GPO) provisioning for DirectAccess clients: Update 1 fixes an issue that caused the export script that creates GPO objects to fail, and an issue that caused the GPO to be applied to all authenticated users in the domain (including computer accounts), instead of to DirectAccess clients only.

More information regarding this update can be downloaded from here

Cyberoam Version X is here!

Cyberoam, the identity based UTM manufacturer, has revamped their multi award winning product, which can now run the new version of the firmware, Version X.

The older graphical user interface was criticised with being a little cluttered and not intuitive.  Version X is a visual treat, with a very crisp and modern.  The interface and components are well laid out and very intuitive within Version X.

More information regarding this major update can be found here: http://cyberoam.com/versionx/

Contact e92plus, if you would like to see or evaluate the Cyberoam product range.

VMWare View on Microsoft IAG

VMWare View has been a bit of a pain to a number of people, but here what I have done in the past to get it to work.  (Thanks to Andrew Button for helping to remind me of some of these bits!!)

Let me be clear, I am not a VMWare expert in any fashion, and I have little knowledge of VMWare View!

1. Ensure VMWare View works internally first
2. Ensure a VMWare Security Server has been deployed (this tip was thanks to my  friend, Google)
3. On IAG, publish a "Enchanced Generic Client App (hosts optional)"
4. Give the application a name and the right access policy
5. Give the server name that is hosting the VMWare View server, with the correct port (probably 443, if you are using HTTPS), iexplore as the executable, and the argument is the full URL for the service
6. Finish the wizard
7. Go into the properies and ensure that the Socket Forwarding Mode is set to VPN
8. Publish and test

I have been struggling with making this SSO, but no joy.  If this changes, I will update this post!

Show season is here: Infosec 2010 at Earls Court

The biggest information security show in Europe is upon us and Infosec 2010 will be hosted Earls Court from Tuesday 27th to Thursday 29th April.

A number of our vendors will have stands there, including:

Barracuda - Stand J65
Celestix - Stand J72
Lumension - Stand H50
VASCO - Stand G40
Websense - H10
WinMagic - F82

If you want a chat or a catch up, drop me a mail.

See you there and enjoy the show!

- Posted using BlogPress from my iPhone

ASP Error when configuring File Access within IAG

I was on site when I encountered an odd issue.  When configuring the File Access component within IAG, we got teh following ASP error:

Request object error 'ASP 0104:80004005'

Operation not allowed /whalefilesharingadmin/computers.asp, line 47

Thanks for Senthil from Celestix who found the answer to this.

The error was being caused due to the size limit in IIS for the maximum number of bytes allowed in the entity body of an ASP request.

The answer is to locate this file:

C:\Windows\System32\Inetsrv\metabase.xml

and modify the following value:

AspMaxRequestEntityAllowed to 1073741824

This changes the excepted size limit to 1GB.