Configure and Manage SSL VPN in NSX

By | 08/06/2018

SSL VPN on NSX Edge Gateway allows end-user to connect to a private network through a SSL-VPN tunnel so that the end-user can access the application/services which are hosted on remote site, on their local network. Application/services can be accessed via Web-based SSL client or a regular client. 

Below image taken from NSX Administration Guide demonstrates the process of connecting to private network via SSL-VPN

ssl

                                           Graphic Thanks to VMware

To configure SSL VPN, double click on the Edge Gateway and navigate to Manage > SSL VPN-Plus tab. 

ssl-vpn1

Go to Server Settings and click on Change button.

ssl-vpn2

Select the ESG IP to which end user will connect via SSL VPN and select the appropriate encryption algo. make sure port 443 is populated. Hit OK to save settings.

ssl-vpn3

Go to IP Pool page and click on + button to add a pool of IP. 

ssl-vpn4

This is the local IP which end user gets when they connect to SSL VPN. 

Provide the IP range and subnet mast and gateway etc and hit OK. 

ssl-vpn5

Go to Private Networks and click on + button.

ssl-vpn6

Select the private network to which end user will get access post connecting to SSL VPN. 

Specify whether you want to send private network and internet traffic over the SSL VPN-enabled NSX Edge or directly to the private server by bypassing the NSX Edge. If you selected Send traffic over the tunnel, select Enable TCP Optimization to optimize the internet speed.

ssl-vpn7

Go to Authentication tab and click on + button.

ssl-vpn8

You can use following authentication methods:

  • AD
  • LDAP
  • Local
  • Radius
  • RSA-ACE

In my lab, I am using local authentication. If you select this then you can specify  following:

  • Password length and password complexity etc.
  • Password expiration (in days) and when end user will be notified when password is about to expire. 
  • Account lockout policy.

Once you are done with your selection, make sure status is set to Enabled before clicking OK.

To know about configuring other authentication mechanism, please see this article from VMware NSX Administration Guide.

ssl-vpn9

Next is to create installation package. Click on + button to create new package.

ssl-vpn10

Provide a name for the profile and for the gateway IP type the IP address or FQDN of the public interface of NSX Edge and port 443.

Select the platform for which you want to create installation package. Windows is selected by default. In my lab I created package only for windows os.

Select the installation parameters and make sure status is set to enabled before your hit ok.

ssl-vpn11

You can configure following installation parameters 

Go to users page and click on + button to add users.

ssl-vpn12

Specify username/password and first name/last name for the user (optional)

Specify password details and set status to Enabled and hit OK.

ssl-vpn13

From the dashboard tab, enable the SSL VPN service.

ssl-vpn14

To download the SSL installation package, connect to the NSX edge public IP address (specified during package installation task) and punch in the user details created in previous step.

ssl-vpn15

Click on Download Phat Client.

ssl-vpn16

Once the installation is completed, launch the Phat Client and select the network to which you want to connect.

ssl-vpn17

You will be presented with a certificate alert as we are not using signed certificates. Click yes to continue.

Punch in your username/password (created during user creation task) and hit OK.

and you will be connected to the SSL VPN.

You can verify the local IP which you got and verify it matches with what you configured on edge. Also you can see the private subnets which will be now directly accessible from local machine.

Now let’s test the configuration. From my local desktop I RDP’ed into one of my windows server using its private ip.

and I can see a certificate warning (usually we get while doing mstsc) and I was connected to my server.

I  hope you enjoyed reading this post. Feel free to share this on social media if it is worth sharing. Be sociable :)

Category: NSX

About Alex Hunt

Hi All I am Manish Jha. I am currently working in OVH US as Operations Support Engineer (vCloud Air Operations). I have around 7 Years of IT experience and have exposure on VMware vSphere, vCloud Director,vSphere Replication, vRealize Automation, NSX and RHEL. If you find any post informational to you please press like and share it across social media and leave your comments if you want to discuss further on any post. Disclaimer: All the information on this website is published in good faith and for general information purpose only. I don’t make any warranties about the completeness, reliability and accuracy of this information. Any action you take upon the information you find on this blog is strictly at your own risk. The Views and opinions published on this blog are my own and not the opinions of my employer or any of the vendors of the product discussed.