Network and Host Administration

network and host administration overview when you install and initially set up the device, you use the serial port console to set basic network and host settings to get started, you must use the serial console to configure these settings for the internal interface you have the option to use the serial console to configure network and host settings for the external interface and the management interface the network and host settings you configure with the serial port console include once the internal interface has been configured, you can use the admin console network settings pages to modify settings for the internal interface, to enable and configure the external interface and the management interface, and to configure or manage advanced networking features, including hostname ipv6 addresses vlan ports virtual ports route table entries host mapping table entries arp cache entries neighbor discovery cache entries system date and time (manual configuration) or ntp configuring the internal port the internal port connects to the local area network (lan) the internal port settings are configured when you run the setup wizard from the serial console as part of the installation procedure you can use the system > network pages to make changes to the configuration to modify the internal port configuration select system > network > internal port > settings to display the configuration page the following figure shows the configuration page for ivanti connect secure complete the configuration as described in the following table save your changes the following figure depicts the ivanti connect secure internal port configuration page the following table lists the internal port configuration guidelines settings guidelines ipv4 settings ip address assign an ip address you must assign an ipv4 address to the internal interface an ip address is an identifier for a computer or device on a tcp/ip network networks using the tcp/ip protocol route messages based on the ip address of the destination the format of an ipv4 address is a 32 bit numeric address written as four numbers separated by periods each number can be 0 to 255 netmask assign a netmask a netmask indicates which part of an ip address indicates network identification and which part indicates the host identification for example, the ip address and netmask 10 20 30 1 255 255 255 0 (or 10 20 30 1/24) refer to all the hosts in the 10 20 30 0 subnet the ip address and netmask 10 20 30 1 255 255 255 255 (or 10 20 30 1/32) refer to a single host default gateway specify the ipv4 address for the default gateway for the routing domain to which the device belongs a gateway is the router that resides at the point of entry to the current routing domain, often called the default gateway ipv6 settings enable ipv6 / disable ipv6 disabled by default enable to support access from ipv6 endpoints when you enable ipv6, the system acquires a link local address if you switch from enabled to disabled, the system clears the link local address link local address display the autoconfigured link local address (after you have enabled and saved the ipv6 configuration) ipv6 address specify a routable ipv6 address, such as a global unicast address that your network plan has provisioned for this host and interface automatic configuration methods are not supported you must specify the appropriate address manually prefix length specify how many of the higher order contiguous bits of the ipv6 address comprise the prefix (the network portion of the ipv6 address) the default is 64 gateway specify the ipv6 address for the default gateway for the routing domain to which the device belongs a gateway is the router that resides at the point of entry to the current routing domain, often called the default gateway advanced settings mac address display the mac address for the interface link speed specify the speed and duplex combination for the interface if you run snmp get and then change the link speed value, you must wait at least 5 minutes after submitting the change before running snmp get again the internal port of the isa 6000 hardware must be connected to ports with auto negotiation enabled if a specific link speed is required, then configure it in the ics port isa 8000 link speed cannot be limited to 100mbps arp ping timeout (ipv4 only ) specify how long the system should wait for responses to address resolution protocol (arp) requests before timing out cluster nodes send arp requests to the gateways of other nodes to determine if they are properly communicating with one another if you have not deployed a cluster, the system does not use this setting if the node belongs to a cluster, the timeout interval that you specify is synchronized across the cluster in multisite clusters, you can override this setting for the individual nodes in the cluster using options in the system > clustering page use caution when changing this setting in active/passive clusters, however, because the system also uses the arp ping timeout setting on the internal tab as a failover timer for the vip mtu specify the maximum transmission unit if ipv6 is enabled, the valid range is 1280 to 1500 if ipv6 is not enabled, the valid range is 576 to 1500 we recommend you retain the default mtu setting (1500) unless you must change the setting for troubleshooting purposes if the administrator sets ignore tcp mss in advanced client configuration, then the tcp mss option is ignored during the virtual adapter mtu calculation on the client side for details, see using the advanced client configuration feature docid\ fca2 nllsvwvdtbtpizvf default vlan id (optional) specify the default vlan id for the traffic of this port when this parameter is set, all the traffic on this interface is subsequently tagged with the set vlan id and also accepts only incoming traffic with the same tag necessary changes are required on the connected switch port to handle bi directional tagged traffic if default vlan id is set incorrectly or the connected switch port is not configured accordingly, the interface can become unreachable from release 25 1 3 0 default vlan id can be set if ipv6 is enabled default vlan id is supported in the clustered environment in case of vmware esxi based virtual appliance(va), set the vswitch configuration to port 4095 to allow ics to tag the traffic the set default vlan id should be added as a member in the physical port of switch and the same vlan should be removed from native vlan id configuring the external port the external port connects to the internet you can use the system > network pages to configure the external port to configure the external port select system > network > external port > settings to display the configuration page the following figure shows the configuration page for ivanti connect secure complete the configuration as described in the following table save your changes the following figure depicts the ivanti connect secure external port configuration page the following table lists the external port configuration guidelines settings guidelines use port? use port? select enabled to use the port; otherwise, select disabled ipv4 settings ip address specify an ip address an ip address is an identifier for a computer or device on a tcp/ip network networks using the tcp/ip protocol route messages based on the ip address of the destination the format of an ipv4 address is a 32 bit numeric address written as four numbers separated by periods each number can be 0 to 255 netmask specify a netmask a netmask indicates which part of an ip address indicates network identification and which part indicates the host identification for example, the ip address and netmask 10 20 30 1 255 255 255 0 (or 10 20 30 1/24) refer to all the hosts in the 10 20 30 0 subnet the ip address and netmask 10 20 30 1 255 255 255 255 (or 10 20 30 1/32) refer to a single host default gateway specify the ipv4 address for the default gateway for the routing domain to which the device belongs a gateway is the router that resides at the point of entry to the current routing domain, often called the default gateway ipv6 settings enable ipv6 / disable ipv6 disabled by default enable to support access from ipv6 endpoints when you enable ipv6, the system acquires a link local address if you switch from enabled to disabled, the system clears the link local address link local address display the autoconfigured link local address (after you have enabled and saved the ipv6 configuration) ipv6 address specify a routable ipv6 address, such as a global unicast address that your network plan has provisioned for this host and interface automatic configuration methods are not supported you must specify the appropriate address manually prefix length specify how many of the higher order contiguous bits of the ipv6 address comprise the prefix (the network portion of the ipv6 address) the default is 64 gateway specify the ipv6 address for the default gateway for the routing domain to which the device belongs a gateway is the router that resides at the point of entry to the current routing domain, often called the default gateway advanced settings mac address display the mac address for the interface link speed specify the speed and duplex combination for the interface if you run snmp get and then change the link speed value, you must wait at least 5 minutes after submitting the change before running snmp get again the external port of the isa 6000 hardware must be connected to ports with auto negotiation enabled if a specific link speed is required, then configure it in the ics port isa 8000 link speed cannot be limited to 100mbps arp ping timeout (ipv4 only ) specify how long the system should wait for responses to address resolution protocol (arp) requests before timing out cluster nodes send arp requests to the gateways of other nodes to determine if they are properly communicating with one another if you have not deployed a cluster, the system does not use this setting if the node belongs to a cluster, the timeout interval that you specify is synchronized across the cluster in multisite clusters, you can override this setting for the individual nodes in the cluster using options in the system > clustering page use caution when changing this setting in active/passive clusters, however, because the system also uses the arp ping timeout setting on the internal tab as a failover timer for the vip mtu specify the maximum transmission unit if ipv6 is enabled, the valid range is 1280 to 1500 if ipv6 is not enabled, the valid range is 576 to 1500 we recommend you retain the default mtu setting (1500) unless you must change the setting for troubleshooting purposes if the administrator sets ignore tcp mss in advanced client configuration, then the tcp mss option is ignored during the virtual adapter mtu calculation on the client side for details, see using the advanced client configuration feature docid\ fca2 nllsvwvdtbtpizvf default vlan id (optional) specify the default vlan id for the traffic of this port when this parameter is set, all the traffic on this interface is subsequently tagged with the set vlan id and also accepts only incoming traffic with the same tag necessary changes are required on the connected switch port to handle bi directional tagged traffic if default vlan id is set incorrectly or the connected switch port is not configured accordingly, the interface can become unreachable from release 25 1 3 0 default vlan id can be set if ipv6 is enabled default vlan id is supported in a clustered environment in case of vmware esxi based virtual appliance(va), set the vswitch configuration to port 4095 to allow ics to tag the traffic the set default vlan id should be added as a member in the physical port of switch and the same vlan should be removed from native vlan id if default vlan id is set incorrectly or the connected switch port is not configured accordingly, the interface can become unreachable using the internal and external ports the internal port, also known as the internal interface, handles all lan requests to resources, listening for web browsing, file browsing, authentication, and outbound mail requests you configure the internal port by providing ip address, gateway, dns server and domain, and mtu settings during the initial setup of ivanti connect secure you can also change them on the system > network > internal port > settings tab alternatively, you can deploy the appliance in dualport mode to listen for incoming web and mail proxy ssl connections on an external port the external port, also known as the external interface, handles all requests from users signed into ivanti connect secure from outside the customer lan, for example, from the internet before sending a packet, ivanti connect secure determines if the packet is associated with a tcp connection that was initiated by a user through the external interface if that is the case, ivanti connect secure sends the packet to the external interface all other packets go to the internal interface the routes that you specify for each interface apply after ivanti connect secure has determined whether to use the internal or external interface no requests are initiated by ivanti connect secure from the external interface, and this interface does not accept any other connections (except ping and traceroute connections) all requests to any resource are issued from the internal interface if you enable the external port, then, by default, administrators may no longer sign in from an external location you can open the external port for administrators on the administrators > admin realms > realmname > authentication policy > source ip tab using the management port this topic describes how to configure the management port management port overview you connect the management port to an ethernet switch or router that is part of your internal local area network (lan) and that can connect to your network management infrastructure when the management port is enabled, the following traffic is directed out the management port archiving (ftp/scp), ntp, push config, snmp, syslog when the management port is not enabled, that traffic uses the internal port on policy secure systems, you cannot configure the user realm configuration, the radius client configuration, or the infranet enforcer configuration to use the management port supported platforms the following hardware platforms are equipped with a management port isa4500 v, isa6500 v, isa8500 v isa6500 and isa8500 configuring the management port to configure the management port select system > network > management port > settings to display the configuration page the following figure shows the configuration page for ivanti connect secure complete the configuration as described in the following table save your changes the following figure depicts the ivanti connect secure management port configuration page the following table lists the management port configuration guidelines settings guidelines use port? use port? select enabled to use the port; otherwise, select disabled ipv4 settings ip address specify an ip address an ip address is an identifier for a computer or device on a tcp/ip network networks using the tcp/ip protocol route messages based on the ip address of the destination the format of an ipv4 address is a 32 bit numeric address written as four numbers separated by periods each number can be 0 to 255 netmask a netmask indicates which part of an ip address indicates network identification and which part indicates the host identification for example, the ip address and netmask 10 20 30 1 255 255 255 0 (or 10 20 30 1/24) refer to all the hosts in the 10 20 30 0 subnet the ip address and netmask 10 20 30 1 255 255 255 255 (or 10 20 30 1/32) refer to a single host default gateway specify the ipv4 address for the default gateway for the routing domain to which the device belongs a gateway is the router that resides at the point of entry to the current routing domain, often called the default gateway ipv6 settings enable ipv6 / disable ipv6 disabled by default enable to support network management traffic over ipv6 networks when you enable ipv6, the system acquires a link local address if you switch from enabled to disabled, the system clears the link local address link local address display the autoconfigured link local address (after you have enabled and saved the ipv6 configuration) ipv6 address specify a routable ipv6 address, such as a global unicast address that your network plan has provisioned for this host and interface automatic configuration methods are not supported you must specify the appropriate address manually prefix length specify how many of the higher order contiguous bits of the ipv6 address comprise the prefix (the network portion of the ipv6 address) the default is 64 gateway specify the ipv6 address for the default gateway for the routing domain to which the device belongs a gateway is the router that resides at the point of entry to the current routing domain, often called the default gateway advanced settings mac address display the mac address for the interface link speed specify the speed and duplex combination for the interface if you run snmp get and then change the link speed value, you must wait at least 5 minutes after submitting the change before running snmp get again arp ping timeout (ipv4 only ) specify how long the system should wait for responses to address resolution protocol (arp) requests before timing out cluster nodes send arp requests to the gateways of other nodes to determine if they are properly communicating with one another if you have not deployed a cluster, the system does not use this setting if the node belongs to a cluster, the timeout interval that you specify is synchronized across the cluster in multisite clusters, you can override this setting for the individual nodes in the cluster using options in the system > clustering page use caution when changing this setting in active/passive clusters, however, because the system also uses the arp ping timeout setting on the internal tab as a failover timer for the vip mtu specify the maximum transmission unit if ipv6 is enabled, the valid range is 1280 to 1500 if ipv6 is not enabled, the valid range is 576 to 1500 we recommend you retain the default mtu setting (1500) unless you must change the setting for troubleshooting purposes default vlan id (optional) specify the default vlan id for the traffic of this port when this parameter is set, all the traffic on this interface is subsequently tagged with the set vlan id and also accepts only incoming traffic with the same tag necessary changes are required on the connected switch port to handle bi directional tagged traffic if default vlan id is set incorrectly or the connected switch port is not configured accordingly, the interface can become unreachable from release 25 1 3 0 default vlan id can be set if ipv6 is enabled default vlan id is supported in a clustered environment in case of vmware esxi based virtual appliance (va), set the vswitch configuration to port 4095 to allow ics to tag the traffic the set default vlan id should be added as a member in the physical port of switch and the same vlan should be removed from native vlan id using the serial console to configure the management port to configure management port network settings from the serial console start a serial console session select item 1, system settings and tools select item 10, configure management port the text indicates if the option is enabled or disabled enter the network settings for the management port, as prompted if you enable the management port but neglect to configure the ip address and netmask, the port reverts to a disabled state also, you cannot clear management port settings from the serial console when the port is disabled, though you can clear them from within the admin console when prompted to accept the changes, if they are correct, enter y otherwise, repeat the process to correct the settings close the serial console configuring administrator access you can configure the administrators > admin realm > authentication policy > source ip restrictions configuration to enable administrator sign in through the management port you can use administrator realms to control administrator access to system ports, including the management port to control administrator access to the management port enable the management port perform one of the following steps select administrators > admin realms > admin users to modify the default admin users realm select administrators > admin realms , then click new , to create a new administrator realm select the authentication policy > source ip select one of the following options allow users to sign in from any ip address and location allows users to sign in from any ip address and location to satisfy the access management requirement apply ip and/or location based restrictions allows or/and denies users access from all listed ip addresses or/and geo locations configure ip based restrictions specifies whether to allow or deny users access from all of the listed ip addresses, based on their settings to specify access from an ip address enter the ip address and netmask select either allow to allow users to sign in from the specified ip address, or deny to prevent users from signing in from the specified ip address and click add and/or configure location based restrictions specifies whether to allow or deny users access from all of the locations based on their settings to specify access from an location select the location select either allow to allow users to sign in from the specified location, or deny to prevent users from signing in from the specified location and click add source restriction rules evaluation is as follows if there is no source restrictions login is allowed if only ip based restrictions enabled first matches ip based rule default is denied, if no match found if only location based restrictions enabled first matches location based rules default is denied, if no match found if both ip and location rules enabled first ip based rules are matched no further matching done if there is no match found in ip rules, the location based rules are matched the first matching location rule applies no further matching done the default is denied if there is no match found in above two cases select the available options to allow administrators to sign in to all available ports, to the management port or the internal port only, or to restrict them from signing in to any of the ports in some cases, you may inadvertently limit administrative access completely if this occurs, you can reconfigure the ports by way of the serial console select from the following available options enable administrators to sign in on the management port enable administrators to sign in on the internal port enable administrators to sign in on the external port click save changes configuring vlan ports your network design might include vlans to provide network segmentation when connected to a trunk port on a vlan enabled switch, the system encounters traffic from all vlans this is useful for network designs with separate vlans for separate classes of users or endpoints, and for making the system accessible from all vlans you can use radius attributes to place different users in different network segments the system supports ieee 802 1q vlan tagging you must define a vlan port for each vlan the internal port must be assigned to the root system and must be marked as the default vlan routes to servers reachable from the vlan interfaces must have the next hop gateway set to the configured gateway for the vlan interface, and must have the output port defined as the vlan port when you save the configuration for a new vlan port, the system creates two static routes by default the default route for the vlan pointing to the default gateway the interface route to the directly connected network to configure an internal vlan port select system > network > vlans > internal port > new vlan port settings the following figure shows the configuration page for ivanti connect secure complete the configuration as described in the following table save your changes from 22 6r2 release, you can create multiple vlans on hyper v platform to use this feature it is recommended to freshly deploy hyper v using powershell and you cannot modify and use the existing vlan configurations after upgrade to 22 6r2 if has to configured again freshly to deploy the hyper v, see deploying a hyper v isa v through powershell cmdlets https //help ivanti com/ps/help/en us/ics/22 x/depg vm/ps ics ips virtualapp deploy/chp5 deploy ivanti on hyperv htm# toc67917098 use the set vmnetworkadaptervlan command to enable the vlan feature set vmnetworkadaptervlan vmnetworkadaptername int port vmname 22 6r2 trunk allowedvlanidlist 4 53 nativevlanid 3 vlans 4 53 and default vlan (native vlan) 3 on internal interface of ics which is mapped to network adapter “int port” set vmnetworkadaptervlan vmnetworkadaptername external port vmname 22 6r2 trunk allowedvlanidlist 10 80 nativevlanid 2 vlans 10 80 and default vlan (native vlan) 2 on external interface of ics which is mapped to network adapter “external port” for more information, refer configure virtual local area networks for hyper v https //learn microsoft com/en us/windows server/virtualization/hyper v/deploy/configure virtual local areal networks for hyper v and set vmnetworkadaptervlan https //learn microsoft com/en us/powershell/module/hyper v/set vmnetworkadaptervlan?view=windowsserver2022 ps the following figure depicts the ivanti connect secure vlan port configuration page the following table lists the vlan port configuration guidelines settings guidelines use port? use port? select enabled to use the port; otherwise, select disabled vlan settings port name specify a name that is unique across all vlan ports that you define on the system or cluster only alphanumeric characters, " ", or " " are allowed vlan id specify a number between 1 and 4094 the vlan id assignment must be unique on the system ipv4 settings ip address specify an ip address and netmask combination that is from the same network as the vlan vlan ip addresses must be unique you cannot configure a vlan to have the same network as the internal port for example, if the internal port is 10 64 4 30/16 and you configure a vlan as 10 64 3 30/16, you might get un predictable results and errors the format of an ipv4 address is a 32 bit numeric address written as four numbers separated by periods each number can be 0 to 255 netmask specify a netmask a netmask indicates which part of an ip address indicates network identification and which part indicates the host identification for example, the ip address and netmask 10 20 30 1 255 255 255 0 (or 10 20 30 1/24) refer to all the hosts in the 10 20 30 0 subnet the ip address and netmask 10 20 30 1 255 255 255 255 (or 10 20 30 1/32) refer to a single host default gateway specify the ipv4 address for the default gateway for the routing domain to which the device belongs a gateway is the router that resides at the point of entry to the current routing domain, often called the default gateway ipv6 settings ipv6 settings select enabled to use the port; otherwise, select disabled ipv6 address specify a routable ipv6 address, such as a global unicast address that your network plan has provisioned for this host and interface automatic configuration methods are not supported you must specify the appropriate address manually prefix length specify how many of the higher order contiguous bits of the ipv6 address comprise the prefix (the network portion of the ipv6 address) the default is 64 default gateway specify the ipv6 address for the default gateway for the routing domain to which the device belongs a gateway is the router that resides at the point of entry to the current routing domain, often called the default gateway link speed, arp ping timeout, and mtu settings are inherited from the internal port configuration to configure an external vlan port, select system > network > vlans > external port > new vlan port settings to configure a management port, select system > network > vlans > managment port > new vlan port settings then, complete the configuration as described in the vlan port configuration guidelines table in th enext section using virtual ports this topic describes virtual ports configuring virtual ports you can use virtual ports to provide different groups of users access to the same system using different ip aliases and domains virtual ports are associated with the physical internal port and physical external port the virtual port shares all of the network settings with the associated physical port, except for the ip address when you configure virtual ports, you in essence are creating name ip address pairs the names and ip addresses must be unique in your network an alias can include ipv4 addresses, ipv6 addresses, or both however, the corresponding ip protocol must be enabled on the physical port for the addresses to take effect to configure a virtual port select system > network > portname> virtual ports portname is internal port or external port click new port to display the configuration page the following figure shows the configuration page for ivanti connect secure complete the configuration as described in the following table save your changes the following figure depicts the ivanti connect secure virtual port configuration page the following table lists the virtual port configuration guidelines settings guidelines name specify a name for the virtual port the names and ip addresses in the virtual port configuration must be unique in your network physical port display the name of the physical port associated with the virtual port the virtual port inherits link speed, arp ping timeout, and mtu settings from the physical port configuration ipv4 address specify an ipv4 address an alias can include ipv4 addresses, ipv6 addresses, or both however, the corresponding ip protocol must be enabled on the physical port for the addresses to take effect ipv6 address specify an ipv6 address an alias can include ipv4 addresses, ipv6 addresses, or both however, the corresponding ip protocol must be enabled on the physical port for the addresses to take effect using device certificates with virtual ports virtual ports can be used to create multiple fully qualified domain names for user sign in when a user tries to sign in using the ip address defined in a virtual port, the system presents the certificate associated with the virtual port to initiate the ssl transaction you can approach the digital certificate security and virtual ports implementation in either of the following ways associate all hostnames with a single certificate with this approach, you use a single wildcard certificate to validate the identity of all system hostnames, regardless of which hostname is used to sign in a wildcard certificate includes a variable element in the domain name, making it possible for users who sign in from multiple hosts to map to the "same" domain for example, if you create a wild card certificate for yourcompany com, the system uses the same certificate to validate its identity to users who sign in to employees yourcompany com as it does to users who sign into partners yourcompany com associate each hostname with its own certificate with this approach, you associate different hostnames with different certificates create a virtual port for each hostname a virtual port activates an ip alias on a physical port for example, you can create two virtual ports on a single appliance, mapping the first virtual port to the ip address 10 10 10 1 (sales yourcompany com) and the second virtual port to the ip address 10 10 10 2 (partners yourcompany com) then you can associate each of these virtual ports with its own certificate, ensuring that users authenticate through different certificates to associate certificates with virtual ports create virtual ports import the device certificates associate the device certificates with the virtual ports select system > configuration > certificates > device certificates click the link of the device certificate you want to configure to display the configuration page the following figure shows the configuration page for ivanti connect secure use the controls in the "present certificate on these ports" section to associate ports with the certificate the following figure depicts the ivanti connect secure certificate details page configuring the system date and time you can use the admin console to set the system date and time manually or by configuring a network time protocol (ntp) server the system supports ntpv4, which is backwards compatible with ntpv3 and ntpv2 best practice we recommend you use ntp to synchronize the date and time clocks on all network systems using ntp obviates issues that might occur with cluster synchronization, network communication that uses time sensitive protocols, such as saml, and implementation of time based policies, such as local authentication server account expiration in addition, using ntp as a standard in your network rationalizes timestamps in logs, which facilitates reporting and troubleshooting on a vmware virtual appliance, the cockpit data may be erased each hour if the same ntp server is not defined here, on the connect secure license server, and on the esxi server to set the system date and time select system > status > overview to display the system status dashboard click the system date and time edit link to display the configuration page the following figure depicts the ntp for troubleshooting, navigate to maintenance > troubleshooting > tools > commands and then use ntpq command the following figure depicts the ntpq command complete the configuration as described in the following table save the configuration the following table lists the date and time configuration guidelines settings guidelines time zone select your time zone selecting the appropriate time zone enables the system to automatically adjust the time for daylight saving time changes time source use pool of ntp servers select this option to configure pool of ntp servers configuring one ntp server is mandatory and keys are optional ics vms deployed on vmware esx server will synchronize time with esxi host to use ntp/local time, turn off vmware tools time synchronization completely best practice it is not recommended to use only two ntp servers if more than one ntp server is required, four ntp servers is recommended minimum four servers protects against one incorrect timesource ntp server(s) specify the fully qualified domain name or ip address for the ntp server key(s) if you are using ntpv4, specify the symmetric key the key must be pre synchronized with the ntp server for example, if you want to configure nist's clock as the ntp server, you must request a key beforehand and have nist send that key to you the key for md5 is in the following format keynumber m keyvalue the key for sha1 is in the following format keynumber sha1keyvalue set time manually date specify the date you can click get from browser to automatically populate the date and time fields time specify the time and select am or pm configuring network services you configure dns and wins services when you initially configure the system with the serial console if necessary, you can use the system > network > overview page to modify the configuration you can also use this page to configure a hostname the network services overview page also displays the node name (if the node belongs to a cluster), and the status and interface statistics for the internal port, external port, and management port to configure network services select system > network > overview to display the configuration page the following figure shows the configuration page for ivanti connect secure complete the configuration as described in the following table save your changes the following figure depicts the ivanti connect secure network services configuration page the following table lists the network services configuration guidelines settings guidelines status status display node name, interface statistics for the internal port, external port, and management port network identity hostname specify a fully qualified hostname for example, domain company com the hostname cannot exceed 30 characters dns name resolution primary dns specify the ip address for the primary dns server secondary dns specify the ip address for the secondary dns server dns domain(s) specify a comma separated list of default domains the system searches the domains in the order they are listed preferred dns response this field determines what dns requests and responses will prefer to the configured dns server select 'ipv4' if ics is interested only in ipv4 hostname resolution requests and responses to/from the backend dns server select 'ipv6' if ics is interested only in ipv6 hostname resolution requests and responses to/from the backend dns server port for dns traffic dns traffic was sent over the internal interface an administrator can modify the dns setting to any physical interface namely internal port, external port or management port in case of a fresh installation or an upgrade, dns port will be set to internal port in case of a cluster, the setting can be made node specific as well as cluster wide windows networking wins specify the hostname or ip address of a local or remote windows internet naming service (wins) server that you use to associate workstation names and locations with ip addresses bandwidth management this feature is available only on connect secure total maximum bandwidth specify the maximum bandwidth for all traffic vpn tunnels maximum bandwidth specify the maximum bandwidth for vpn tunnel traffic the value of total maximum bandwidth must be greater than the value of vpn tunnels maximum bandwidth ipv6 settings disable icmpv6 echo response for multicast echo requests allows enabling or disabling of the ability to send an echo reply message in response to an echo request message sent to an ipv6 multicast or anycast address disable icmpv6 destination unreachable response allows enabling or disabling the destination unreachable message in response to a packet that cannot be delivered to its destination for reasons other than congestion dscp value specify the value for verifying by packet capture at client side tunnel settings tcp mss value set the value of the mss which can be <= 1460 configuring ntp and other services traffic over any physical interface the ntp, snmp, syslog, and log archiving services are set to send the traffic through management port by default in case the management port is not available, the traffic is routed through internal port now, an administrator can modify the settings of ntp and other services to any physical interface the following procedure describes the steps to configure the ports for the services before you proceed, ensure the external and management ports are enabled for use in the network settings to configure service traffic port options select system > configuration > advanced networking for the individual service, select the required port from the drop down list the following figure depicts the source port selection in a cluster environment, when a node joins the cluster, configuration of the node is replaced with the configuration of other nodes in the cluster managing the routes table the system populates the routes table with dynamic, auto discovered routes many networks will not require changes to this routing table if necessary, you can delete routes or add static routes to manage the routes table select system > network > routes to display the routes table shows the routes for ivanti connect secure use the controls described in the following table to manage the routes table the following figure depicts the ivanti connect secure routes table the following table lists the routes table controls controls description view route table for use the controls to change the display to show the route table for internal, external, or management interfaces; and for ipv4 or ipv6 routes delete select a row in the table and click delete to delete a route new route click new route and complete the configuration to add a route to the table you must specify a valid ip address, gateway, dns address, and metric the metric is a way of comparing multiple routes to establish precedence generally, the lower the number (from 0 to 15), the higher the precedence thus, a route with a metric of 2 is chosen over a route with a metric of 14 ipv6 static routing this feature is introduced in release 22 3r1 it provides static routing for ipv6 address static routes are useful for smaller networks with only one path to an outside network and to provide security for a larger network for certain types of traffic or links to other networks that need more control routes are manually configured and define an explicit path between two networking devices to configure ipv6 static routing select network > routes select ipv6 from the drop down click new route enter the destination network/ipv6 address, prefix , and gateway details enter the metric (1 15) the metric is a way of comparing multiple routes to establish precedence generally, the lower the number (from 1 to 15), the higher the precedence thus, a route with a metric of 2 is chosen over a route with a metric of 14 the metric value of zero (0) identifies the route as one that should not be used click add to internal route table managing the hosts table in general, the system uses the configured dns servers to resolve hostnames, but it also maintains a local hosts table that can be used for name resolution the system populates some entries from host ip address pair settings in your configuration you can add host ip address mappings for other hosts that might not be known to the dns servers used by the system, or in cases where dns is not reachable to manage the hosts table select system > network > hosts to display the hosts table the following figure shows the hosts table for ivanti connect secure use the controls described in the following table to manage the hosts table the following figure depicts the ivanti connect secure hosts table the following table lists hosts table controls controls description add specify an ip address, hostname, and comment (a description for the benefit of system administrators) and click add delete click the delete icon in the last column to delete the row from the table proxy server configuration this feature provides communication between isa vs with pulse cloud licensing server (pcls) and pulse one through a configured proxy server a new tab called proxy server has been added in the network settings to configure the same to configure the proxy server settings go to system >network >proxy server select the use proxy server for communicating with pulse cloud licensing service (pcls) check box once enabled, the proxy server settings which include host name and port must be set by the admin pcls using proxy server can be configured with ipv6 address or with hostname that resolves to an ipv6 address (optional) if your proxy server requires further authentication, enter a username and password to log in to the proxy server click on save the following figure depicts the proxy server if the global proxy server is configured and enabled for pulse one, the local proxy settings configured in pulse one is disabled similarly, if the global proxy server is configured and enabled for cls, the preferred network setting is disabled in the download licenses page the proxy server tab is a cluster wide setting for both active/active and active/passive clusters node specific setting is disabled only http proxy is supported managing the arp table arp stands for address resolution protocol in ipv4 networking, network nodes use arp to maintain information about peer network nodes arp is used to associate the layer 3 ip address with a layer 2 mac address of neighboring peer nodes the system maintains an arp table with dynamic, cached entries, and you can add static entries if necessary the system caches dynamic entries for up to 20 minutes dynamic entries are deleted during a reboot static entries are restored after a reboot to manage the arp table select system > network > port > arp cache port is the internal port, external port, or management port tab the following figure shows the arp table for the internal port for ivanti connect secure use the controls described in the following table to manage the arp table the following figure depicts the ivanti connect secure arp cache table the following table lists the arp table controls controls description delete select a row in the table and click delete to delete the entry delete dynamic entries delete all dynamically discovered entries add specify an ip address, a mac address, and click add to add an entry if you add an entry that has the same ip address as an existing entry, the system overwrites the existing entry with your new entry also note that the system does not verify the validity of mac addresses managing the neighbor discovery table in ipv6 networking, network nodes use the neighbor discovery protocol (ndp) to determine the layer 2 mac addresses for neighboring hosts and routers the system uses ndp to maintain a cache of neighboring routers that are reachable and can forward packets on its behalf you can view discovered neighbors or clear the entire cache, but you cannot add neighbors or delete individual entries to manage the neighbor discovery table select system > network > port > nd cache port is the internal port, external port, or management port tab the following figure shows the neighbor discovery table for the internal port for ivanti connect secure use the controls described in the following table to manage the neighbor discovery table the following figure depicts the ivanti connect secure neighbor discovery table the following table lists the neighbor discovery table controls controls description flush ndp entries delete all dynamically discovered entries using ipv6 this topic describes support for using ipv6 understanding ipv6 ip version 6 (ipv6) is an internet protocol designed to succeed ip version 4 (ipv4) this topic provides an overview of ipv6 about ipv6 the ongoing expansive growth of the internet and the need to provide ip addresses to accommodate it is escalating the emergent use of a new ip protocol ipv6 was designed to satisfy the current and anticipated near future requirements ipv4 is widely used throughout the world today for the internet, intranets, and private networks ipv6 builds upon the functionality and structure of ipv4 in many aspects, including larger address space ipv6 addresses are 128 bits long instead of 32 bits this expands the address space from 4 billion addresses to over 300 trillion trillion trillion addresses new datagram format the packet header is both simplified and enhanced to enable more secure and efficient routing improved fragmentation and reassembly the maximum transmission unit (mtu) has been increased to 1280 bytes, for example transition mechanisms various network address translation (nat) and tunneling mechanisms have been developed to support the transition to ipv6 on february 3, 2011 internet assigned numbers authority (iana) allotted the last block of ipv4 addresses to regional internet registries (rir), so the free pool of ipv4 addresses is now fully depleted it is expected that in the near future internet service providers (isps) will start issuing ipv6 addresses to their customers about ipv6 address types rfc 4291, ip version 6 addressing architecture https //tools ietf org/html/rfc4291 describes the following types of ipv6 addresses unicast an identifier for a single interface a packet sent to a unicast address is delivered to the interface identified by that address anycast an identifier for a set of interfaces a packet sent to an anycast address is delivered to one of the interfaces identified by that address the link local address is a special ipv6 unicast address that is used in self traffic and essential network communication, like neighbor discovery protocol (ndp) when you enable ipv6 on a connect secure interface, the system generates a link local address that is derived from the interface mac address when you configure ipv6 addresses for the system interfaces, you manually specify a routable address, such as global unicast address or an anycast address, depending on your routing implementation and your system deployment a global unicast address must be globally unique so that it can be specified globally without need for modification an anycast address represents a service rather than a specific device an anycast address is not unique, but instead might be configured on each device in a cluster you are not likely to use multicast addressing with connect secure about ipv6 address text representation all ipv6 addresses are 128 bits long, written as 8 sections of 16 bits each they are expressed in hexadecimal representation, so the sections range from 0 to ffff sections are delimited by colons, and leading zeroes in each section may be omitted if two or more consecutive sections have all zeroes, they can be collapsed to a double colon ipv6 addresses consist of 8 groups of 16 bit hexadecimal values separated by colons ( ) ipv6 addresses have the following format aaaa\ aaaa\ aaaa\ aaaa\ aaaa\ aaaa\ aaaa\ aaaa each aaaa is a 16 bit hexadecimal value, and each a is a 4 bit hexadecimal value the following is a sample ipv6 address 2001 0db8 0000 0000 0008 0800 200c 417a you can omit the leading zeros of each 16 bit group, as follows 2001\ db8 0 0 8 800 200c 417a you can compress 16 bit groups of zeros to double colons ( ) as shown in the following example, but only once per address 2001\ db8 8 800 200c 417a about the ipv6 unspecified address in the ipv6 address space, the special "unspecified address" is 0 0 0 0 0 0 0 0 the compressed representation of the unspecified address is the double colon ( ) the unspecified address must never be assigned to a physical or virtual interface about the ipv6 loopback address the special loopback address is the unicast address 0 0 0 0 0 0 0 1 the compressed representation of the loopback address is 1 the loopback address may be used by a node to send an ipv6 packet to itself it must not be assigned to a physical or virtual interface about ipv6 address prefixes an ipv6 address prefix is a combination of an ipv6 prefix address and a prefix length used to represent a block of address space (or a network), similar to the use of an ipv4 subnet address and netmask combination to specify a subnet an ipv6 address prefix takes the form ipv6 prefix/prefix length the ipv6 prefix variable follows general ipv6 addressing rules the /prefix length variable is a decimal value that indicates the number of contiguous, higher order bits of the address that make up the network portion of the address for example, 2001\ db8 /32 is an ipv6 address prefix, indicating that the first 32 bits make up the network portion of the address system normalization of ipv6 addresses the system validates and normalizes ipv6 addresses entered by administrators the normalized address is the address processed by the system, and it is the address that appears in logs the following table gives examples of how the system normalizes ipv6 address entries example entry normalized address explanation 2001\ db8 1🔢 3 2001\ db8 1🔢 3 an address specified in compressed format is validated; the system uses the compressed form as the normalized form 0 0 0 122 122 address is validated and normalized to compressed format ff01 0 0 0 0 0 0 101 ff01 101 address is validated and normalized to compressed format 2001\ db8 10 204 50 122 2001\ db8 acc 327a address is validated and normalized to hexadecimal representation ffff 10 204 50 122 ffff 10 204 50 122 an address specified in compressed format is validated; the system uses the compressed form as the normalized form about neighbor discovery protocol neighbor discovery protocol (ndp) https //tools ietf org/html/rfc4861 allows different nodes on the same link to advertise their existence to their neighbors, and to learn about the existence of their neighbors routers and hosts (nodes) use ndp messages to determine the linklayer addresses of neighbors that reside on attached links and to overwrite invalid cache entries hosts also use ndp to find neighboring routers that can forward packets on their behalf in addition, nodes use ndp to actively track the ability to reach neighbors when a router (or the path to a router) fails, nodes actively search for alternatives to reach the destination ipv6 ndp corresponds to a number of the ipv4 protocols arp, icmp router discovery, and icmp redirect however, ndp provides many improvements over the ipv4 set of protocols these improvements address the following router discovery how a host locates routers residing on an attached link prefix discovery how a host discovers address prefixes for destinations residing on an attached link nodes use prefixes to distinguish between destinations that reside on an attached link and those destinations that it can reach only through a router parameter discovery how a node learns various parameters (link parameters or internet parameters) that it places in outgoing packets address resolution how a node uses only a destination ipv6 address to determine a link layer address for destinations on an attached link next hop determination the algorithm that a node uses for mapping an ipv6 destination address into a neighbor ipv6 address (either the next router hop or the destination itself) to which it plans to send traffic for the destination neighbor unreachability detection how a node determines that it can no longer reach a neighbor duplicate address detection how a node determines whether an address is already in use by another node a router periodically multicasts a router advertisement from each of its multicast interfaces, announcing its availability hosts listen for these advertisements for address autoconfiguration and discovery of link local addresses of the neighboring routers when a host starts, it multicasts a router solicitation to ask for immediate advertisements the router discovery messages do not constitute a routing protocol they enable hosts to discover the existence of neighboring routers, but they are not used to determine which router is best to reach a particular destination ndp uses the following internet control message protocol version 6 (icmpv6) messages router solicitation, router advertisement, neighbor solicitation, neighbor advertisement, and redirect ndp for ipv6 replaces the following ipv4 protocols router discovery (rdisc), address resolution protocol (arp), and icmpv4 redirect ipv6 support overview this topic describes support for ip version 6 (ipv6) networks defining esp tunnel for mixed mode traffic to enable mixed mode traffic via esp tunnel in the admin console, choose system > configuration > vpn tunneling in the ipv6 esp settings section, select the use esp tunnel for 6in4 and 4in6 traffic check box click save changes to view the users connected via esp tunnel, navigate to system > status > active users client access summary ivanti connect secure supports use of vpn tunneling connection profile features to enable dual stack endpoints to connect the connect secure device and access corporate network ipv4 and ipv6 resources the following table summarizes supported access scenarios this is applicable to both ssl and esp modes the following table lists the ivanti connect secure client access scenarios endpoint connect secure interface tunnel resource description of the connection ipv4/ipv6 ipv4 ipv4 in ipv4 ipv4 all resource access policies are supported for access to ipv4 resources ipv6 in ipv4 ipv6 you must configure ipv4 and ipv6 address pools in the vpn tunneling connection profile configuration access to ipv6 resources using vpn tunneling connection profiles only ipv4/ipv6 ipv6 ipv4 in ipv6 ipv4 you must configure ipv4 and ipv6 address pools in the vpn tunneling connection profile configuration all resource access policies are supported for access to ipv4 resources ipv6 in ipv6 ipv6 access to ipv6 resources using vpn tunneling connection profiles only the following table provides a summary of ivanti secure access client and system software requirements for ipv6 deployment types connect secure ivanti secure access client ipv4 in ipv4 ipv4 in ipv6 ipv6 in ipv4 ipv6 in ipv6 25 xrx 22 xrx yes yes yes yes network topologies connect secure supports ivanti secure access client access to the ipv6 corporate network using vpn tunneling connection profile features the role based vpn tunneling connection profile determines the ip addresses assigned to the clientivanti secure access client virtual adapter in this configuration, you must configure an ipv4 address pool you configure an ipv6 address pool to enable access to ipv6 resources when a client connects and is mapped to a role that includes the vpn tunneling connection configuration, the ivanti secure access client virtual adapter is assigned all address from each pool both an ipv4 and ipv6 address and a single ssl tunnel is set up when a connection is made to the system ipv4 address, the ipv4 traffic is encapsulated in the ipv4 tunnel ("4 in 4" tunneling), and the ipv6 traffic is encapsulated in the ipv4 tunnel ("6 in 4") when a connection is made to the system ipv6 address, the ipv4 traffic is encapsulated in the ipv6 tunnel (“4 in 6"), and the ipv6 traffic is encapsulated in the ipv6 tunnel (“6 in 6") the dns server used by the system must be reachable by ipv4 and must be able to resolve both a and aaaa dns queries only the vpn tunneling connection profile is supported for access to ipv6 resources all other connection options and resource policies are not supported for access to ipv6 resources the following figure shows a deployment topology for dual stack enabled endpoints that access the system over an isp ipv4 network the following figure depicts the dual stack endpoint access over isp ipv4 network the following figure shows a deployment topology for dual stack enabled endpoints that access the system over an isp ipv6 network dual stack endpoint access over isp ipv6 network ipv6 support and limitations for connect secure features the following table summarizes ipv6 support and limitations for connect secure features the following table lists the summary of ipv6 support feature summary ivanti secure access client access only the ivanti secure access client supports ipv6 the following behavior is expected endpoints must have dual stack enabled in order to access ipv6 resources over ipv4 networks vpn tunneling connection profiles support ipv4 and ipv6 address pools vpn tunneling connection profiles do not support esp mode for ipv6 resource access if a connection is configured for esp mode, it automatically falls back to use ssl mode on dual stack endpoints, vpn tunneling split tunneling rules are supported for both ipv4 and ipv6 based routes the ipv4/ipv6 traffic allowed by a split tunneling policy is forwarded to the system in an ipv4/ipv6 tunnel legacy jsam does not support ipv6 ivanti secure access client on the following platforms support vpn tunneling connections for ipv6 resource access windows 8 (32 and 64 bit), windows 10 redstone mac os/x snow leopard, lion, mountain lion, high sierra, mojave, catalina host checker supports ipv6 third party host checker functionality is supported to the extent that it is ipv6 capable for example, the following third party components might require endpoints to connect over ipv4 downloading antivirus signature updates from third party vendors downloading windows patches from microsoft download servers authentication active directory (standard mode) ipv4 and ipv6 based backend servers are supported radius auth server ipv4 and ipv6 based backend servers are supported dns supports both ipv4 and ipv6 dns servers administrator and management access the internal interface and management interface can be configured with an ipv4 address or dual stack (ipv4 and ipv6) the internal interface and management interface cannot be configured with only an ipv6 address because the system uses ipv4 for the connections with network services, including aaa, dhcp, and dns typically, administrators access the administrator gui through the internal interface or management interface, but you may enable administrator access through the external interface on the authentication > admin realms > admin users > authentication policy > source ip page configuration through the serial console you cannot view or configure ipv6 network settings with the serial console external interface configuration ipv4, ipv6, or both is supported internal interface configuration ipv4 or both ipv4 and ipv6 is supported in other words, the internal interface must be configured for ipv4 connections; in addition, it may be configured for ipv6 connections it may not be configured for ipv6 only management interface configuration ipv4 or both ipv4 and ipv6 is supported in other words, the management interface must be configured for ipv4 connections; in addition, it may be configured for ipv6 connections it may not be configured for ipv6 only virtual interface configuration an interface alias may include ipv4 addresses, ipv6 addresses, or both however, the corresponding ip protocol must be enabled on the physical interface for the addresses to take effect vlan configuration ipv4, ipv6 or both is supported clustering supports ipv6 configuration for active/active and active/passive clusters the existing intra cluster communication mechanism is preserved the intra cluster communication occurs over the ipv4 corporate network through the internal interfaces license server ipv4/ipv6 must be enabled for the "preferred network" you select for licensing protocol communication web server the implementation for ipv6 does not require reconfiguration of the system after upgrade the web server can listen for and accept ipv4 or ipv6 clients, and it can differentiate between them for internal purposes and for logging purposes activesync the implementation for ipv6 does not require reconfiguration of the system after upgrade activesync functionality is available to users connecting from ipv4 or ipv6 endpoints to an ipv4 backend server connection to an ipv6 backend server is not supported connection profiles after upgrading, you can update your vpn tunneling connection profile configuration to enable ipv6 address assignments to ivanti secure access client you must configure a static ipv6 address pool dhcpv6 is not supported also note that the ip address server configuration on the system > network > vpn tunneling page does not support filtering for ipv6 address pools in active/active clusters, separate connection profiles need to be created with different ipv6 address pools for each node wins is not used in ipv6 networks; therefore, wins settings are not applicable for connection profiles used for ipv6 access the serverside proxy feature does not support ipv6 resource policies you can configure vpn tunneling connection profiles to enable access to all ipv6 resources in your corporate network; however, you cannot configure vpn tunneling access control policies to allow or deny access to particular ipv6 resources as a workaround, we recommend you deploy firewall security to restrict access to ipv6 resources to enable access to ipv6 resources, the dns server used by the system must be reachable by ipv4 and must be able to resolve aaaa dns queries core access rewriter the implementation for ipv6 does not require reconfiguration of the system after upgrade after upgrade, ipv6 endpoints can access internal ipv4 resources through the system this applies to all system content rewriters html, java script, applets, vb script, flash, css, xml, pdf you cannot configure web rewriting policies for ipv6 resources core access passthrough proxy the system passthrough proxy modes are based on hostnames or ports, not ip addresses therefore, the implementation for ipv6 does not require reconfiguration of the system after upgrade note, however, that in virtual hostname mode, your dns server must be configured to resolve the virtual hostname to the system ip address, which can be an ipv4 or ipv6 address update entries in your dns server accordingly you cannot configure passthrough proxy policies for ipv6 resources user role vpn tunneling options route precedence if tunnel route is selected, the client cannot access its local ipv6 network and ipv6 traffic is blocked, except dhcpv6, icmpv6, and loopback traffic going to the physical adapter if route monitoring is enabled, only ipv4 route monitoring is performed if endpoint route is selected, the \client can access its local ipv6 network route monitoring should be disabled the multicast option is not supported for ipv6 resources role/realm source ip restrictions you can specify ipv4 or ipv6 source ip restrictions at both the role and the realm level if the device is deployed behind a nat64 device, it sees traffic coming from an ipv4 address in this case, your source ip restrictions should be based on the nated ipv4 addresses session roaming you can manage session roaming across ipv6 subnets if you enable unlimited session roaming, a session is maintained within an ipv4 network, within an ipv6 network, or from ipv4 to ipv6 and vice versa if you configure limited session roaming, you can specify ipv4 or ipv6 subnets within which the session is maintained however, with limited session roaming, you cannot allow sessions to roam from ipv4 to ipv6 networks, or vice versa logging the logging system can process and parse logs containing ipv6 addresses ivanti connect secure supports communication with external log systems and utilities, such as syslog, snmp, and archiving that are reachable by ipv4 only network tools ping6 and traceroute6 were added to the admin graphical user interface console network tools page ipv6 feature configuration task summary ipv6 related features are not enabled by default after you upgrade the system software, perform the tasks summarized in the following table describes how to make the device ready for ipv6 traffic the following table lists the ipv6 feature configuration task summary action documentation enable ipv6 for the external port and configure an ipv6 address configuring the external port docid\ fca2 nllsvwvdtbtpizvf enable ipv6 for the internal port and configure an ipv6 address configuring the internal port docid\ fca2 nllsvwvdtbtpizvf enable ipv6 for the management port and configure an ipv6 address using the management port docid\ fca2 nllsvwvdtbtpizvf configure ip aliases and ipv6 addresses for virtual ports using virtual ports docid\ fca2 nllsvwvdtbtpizvf recreate a cluster deployment with ipv6 configuration for external interfaces clustering docid 4ocnpoybezm4wr4bxwoic if you use source ip policies, configure them so that source ip restrictions are based on ipv6 addresses specifying source ip access restrictions docid\ nlmek44 rtzxgrnbf7dv3 configure ipv6 address assignment for vpn tunneling connection profiles dhcpv6 is not supported also note that the ip address server configuration on the system > network > vpn tunneling page does not support filtering for ipv6 address pools vpn tunneling docid\ g lwlehbos1mtrjrkhgob if you permit roaming sessions but limit to roaming within the specified subnet, configure the role session option so that the subnet is defined by netmask for ipv4 and prefix length for ipv6 networks specifying role session options docid\ pdc8roxdxeioohbwlvrnq view and manage the neighbor discovery cache you can view discovered neighbors or clear the entire cache, but you cannot add neighbors or delete individual entries managing the neighbor discovery table docid\ fca2 nllsvwvdtbtpizvf view ipv6 routes in the ip route table you can view discovered ipv6 routes, but you cannot add or delete them from the route table managing the routes table docid\ fca2 nllsvwvdtbtpizvf review logs the logging infrastructure accommodates ipv6 addresses, and you can create custom filters based on ipv6 address patterns using log filters docid l4b156w5wogzec2josty become familiar with ipv6 network connectivity test tools, such as ping6 and traceroute6 using network troubleshooting commands docid e 11 dzbhgfjweit0nz configuring ssl options use the system > configuration > security > ssl options page to change the default security settings we recommend that you use the default security settings, which provide maximum security, but you may need to modify these settings if your users cannot use certain browsers or access certain web pages tls dhe rsa with aes 128 cbc sha tls dhe rsa with aes 256 cbc sha cipher suites are supported both these ciphers use rsa for server authentication and ephemeral diffie hellman (dhe) for key exchange rsa server certificate is required for these ciphers enabling granular cipher selection for setting the security options granular cipher selection provides an administrator the ability to select specific ciphers and the preferred ordering of the selected ciphers this feature also provides presets like suite b, cnsa1, and pfs there are two tabs, inbound openssl options and outbound openssl options with this feature admins can select the ciphers that tls/ssl connections will use the inbound openssl options apply to all incoming connections outbound openssl options apply to the following services rewriter activesync scep syslog ldaps fips mode settings is common for both inbound and outbound ssl options a common cipher library has been added which can be used by both, the inbound and outbound connections the outbound options are listed in a separate tab next to the inbound settings the out bound settings have presets for high and medium ciphers along with custom options there is no pfs or suiteb presets on the outbound side support for preset low has been removed and the same can be configured using custom ssl cipher selection option for the suiteb preset to work, ive should have ecc device certificate mapped to internal or external port suiteb preset does not work if the ecc device certificate is mapped only to virtual port similar to suiteb, cnsa1 requires a compliant rsa/ecc certificate to be mapped to internal, external and/or virtual ports post quantum cryptography (pqc) is being implemented to enhance network communication security using quantum resistant ciphers the initial focus is on tls 1 3, leveraging hybrid modes to ensure interoperability and backward compatibility with classical cryptographic systems ssl fips mode option enabling inbound ssl options only when fips mode is turned on, the fips compliant ciphers are available to be chosen from the supported ciphers panel fips mode is editable only on the inbound option page to set the security options with inbound ssl options in the admin console, select system > configuration > security > inbound ssl options under allowed encryption strength choose custom ssl cipher selection see the following figure the following figure depicts the setting custom ssl cipher selections cnsa1 0 requirements for cnsa1 you need to consider following requirements and click change allowed encryption strength the ciphers selected for cnsa1 0 are relatively stronger than suiteb due to restrictions on key sizes of ciphers/security algorithms p 384 for elliptic curves minimum of 3072 bits for dhe and rsa algorithms 256 bits for aes encryption 384 bits for sha (hashing/compression) cnsa1 0 complies the below ciphers tls aes 256 gcm sha384 (tlsv1 3 only) tls ecdhe ecdsa with aes 256 gcm sha384 tls rsa with aes 256 gcm sha384 tls dhe rsa with aes 256 gcm sha384 for using ec algorithms, the device certificate has to be generated with p 384 key and signed with sha 384 by the ca (certifying authority) for using rsa certs, the device certificate has to be generated with a key size of 3072 bits or higher and signed with sha 384 by the ca (certifying authority) usage of keys that are 3072 bits and higher is expected to increase the handshake duration however, the elliptic curve algorithms are preferable due to the smaller key size of 384 bits the two panels of supported ciphers and selected ciphers are displayed supported ciphers has the entire list of ciphers supported for the selected ssl or tls version selected ciphers list the currently selected ciphers list the following figure shows the two panels (supported ciphers and selected ciphers) note that the selected ciphers and supported ciphers list will also be displayed for all preset like pfs or suiteb or medium or high the following figure depicts the supported ciphers and selected ciphers panels to add a cipher to be used in order to secure a connection, click on the cipher string on the left panel and then click on the add > or double click on the cipher name in the left panel see the following figure to remove the cipher, click on the cipher name on the right panel and then click on the < remove button or double click on the cipher name on the right side see the following figure the selected ciphers on the right are listed in order of their priority from top to bottom to change the priority of the ciphers, click on the cipher name and then click on move up to increase priority or the move down button to decrease the priority see the following figure the following figure depicts the setting custom ssl cipher selections select key exchange to increase the key exchange strength, default is 2048 bit key, you can increase the strength till 8129 the selected key size is the minimum key size supported in ivanti connect secure this works if following ciphers are selected tls dhe rsa with aes 128 cbc sha tls dhe rsa with aes 256 cbc sha dhe rsa aes256 gcm sha384 (in openssl 3 0) select enable port redirection for tlsv1 3 certificate authentication to allow client certificate authentication over tlsv1 3 connections for browsers/clients that do not support post handshake authentication (pha) changes to network configuration might be required so that the specified port is accessible to the client when port redirection is enabled, the authentication process is handled on the configured port including secondary authentication, if any select allow legacy certificates for end to end communications to enable legacy certificates without certain attributes to be allowed with openssl 3 if you are using client certificate authentication (connect secure only) select enable client certificate on the external port under activesync client certificate configuration see the following figure move p ecdsa256 to the selected virtual ports column activesync client certificate configuration click save changes a list of the custom ciphers to be used on the device's port is displayed in the order the web server will select them note that suite b ciphers are listed on top see the following table that depicts end users who now log in to external virtual port p ecdsa256 must have at least one of the listed ciphers installed on their browser or else they cannot log in to the server the following figure depicts confirming custom ciphers click change allowed encryption strength when custom ciphers are selected, there is a possibility that some ciphers are not supported by the web browser also, if any of ecdh/ecdsa ciphers are selected, they require ecc certificate to be mapped to the internal/external interface if ecc certificate is not installed, admin may not be able to log in to the box the only way to recover from this situation is to connect to the system console and select option 8 to reset the ssl settings from the console menu option 8 resets the ssl settings to its default so, the previously set ssl settings are lost this is applicable only to inbound ssl settings ivanti secure access client does not connect to the device if the ciphers selected in inbound option are not supported by the mobile client enabling outbound ssl options only for outbound ssl settings, we can configure non fips ciphers when fips is enabled using custom cipher selection option now, there are options to change different ssl/tls versions and different encryptions in the outbound ssl settings the following figure shows the outbound ssl settings the following table lists the ssl options configuration guidelines settings guidelines ssl fips mode option enable fips mode see the connect secure fips level 1 feature guide allowed ssl and tls version specify encryption requirements for clients by default, the system requires ssl version 3 and tls1 3 or tls1 2 and later the system honors this setting for all web server traffic and all types of clients you can require users who have older browsers that use ssl version 2 to update their browsers, or you can change this setting to allow ssl version 2, ssl version 3, and tls1 3 or tls1 2 and later allowed encryption strength pfs perfect forward secrecy cryptographic protocols to ensure that session keys are not compromised even if the server's private key is compromised in the future this is achieved by using ephemeral key exchanges, such as diffie hellman ephemeral (dhe) or elliptic curve diffie hellman ephemeral (ecdhe) suiteb accept only suiteb ciphers (requires an ecc certificate) suiteb ciphers are a set of cryptographic algorithms approved by the nsa for securing classified and unclassified information to use suiteb ciphers, an ecc (elliptic curve cryptography) certificate is required these ciphers are designed to provide strong security and are typically used in environments where high security is necessary the suiteb ciphers include ecdhe ecdsa aes128 gcm sha256 ecdhe ecdsa aes256 gcm sha384 tls aes 256 gcm sha384 tls aes 128 gcm sha256 maximize security (high ciphers) ssl/tls cipher suites that offer strong encryption with combinations of tls 1 2, tls 1 3, ecdhe, rsa, aes, and sha348 maximize compatibility (medium ciphers) ssl/tls cipher suites that offer moderate encryption strength with combinations of tls 1 2, tls 1 3, ecdhe, rsa, aes, and sha348 custom ssl cipher selection specify a combination of cipher suites for the incoming connection from the user's browser if you select the aes/3des option, the system gives preference to 256 bit aes over 3des if you are using the ic6500 fips version, you can choose high, medium, or low security cipher suites aes/3des high and aes medium are recommended for fips deployment encryption strength option normally, the allowed encryption strength is enforced after an ssl session is established, so that a user connecting with a disallowed encryption strength receives a web page describing the problem enable this option to prevent a browser with a weak cipher from establishing a connection ssl handshake timeout option determines how many seconds elapse before the ssl handshake times out the default is 60 seconds ssl legacy renegotiation support option ssl and transport layer security (tls) renegotiations can be subjected to man in the middle (mitm) attacks that can lead to abuse a new tls extension (defined in rfc 5746) ties renegotiations to the tls connections they are being performed over to prevent these kinds of attacks the ssl legacy renegotiation support option is enabled by default and allows renegotiation between clients and servers even if they do not support the new tls extension disable this option to not allow renegotiations between clients and servers that do not support the new tls extension a web server restart is required when you change the value of this option activesync client certificate configuration use these controls to enforce client certificate requirement for activesync access on the selected ports, including virtual ports when enabled, all activesync clients must present a client authentication certificate to the system to be able to connect using activesync non activesync access (like web browser based access to the host, nc, jsam, psam, ivanti, wts, ikev2 and so forth) on the port/interface on which the activesync client certificate is required might not work properly we recommend you use a separate port or interface exclusively for activesync access and then enable client certificate requirement for the port intended for activesync access ssl ndcpp mode option ndcpp mode can be enabled in the inbound tab with a check box this status is also applied over to the outbound tab turning on ndcpp automatically turns on fips mode and disables ssl/tls version tls1 0 and below also, ndcpp mode allows to choose only 16 ciphers under custom encryption strength turning on the ndcpp check box selects all the ndcpp ciphers by default on both, the inbound and outbound sides when the ndcpp mode i s enabled, backend server like windows 2008 r2 which supports the ssl/tls version only till tls1 0 cannot be connected via rewriter syslog ng server connection to syslog ng server does not get established, since syslog ng does not support tlsv1 1 and tlsv1 2 rsyslog supports only till tlsv1 1 so, connection would not get established, if outbound ssl options is set to use tlsv1 2 to be ndcpp compliant, ntp update interval needs to be limited to 60 minutes this is to avoid the potential drift becoming too excessive for incoming client certificate during client certificate authentication and for incoming server certificate during backend syslog server connection 1024 bit key length is not allowed in both ndcpp and fips mode where as sha1 signature algorithm is not allowed only in fips mode and is allowed in ndcpp mode this restriction is not applicable for outgoing certificates from during ssl negotiation the following figure depicts the ssl ndcpp mode option admin password storage ndcpp mandates that admin passwords needs to be scrambled with sha2 algorithm so, current sha1 password scrambling is no longer supported password migration is done through double hashing existing scrambled passwords stored in the cache are scrambled again with sha 512 new passwords will be hashed twice first with sha1 and then with sha512 and then, stored in the cache inbound settings when the ndcpp mode is enabled, the following settings appear by default in the inbound ssl options page the accept only tls 1 2 is enabled by default in the allowed ssl and tls version settings when you enable tls 1 3 you can see accept only tls 1 3 see the following figure with regards to the allowed encryption strength settings the custom ssl cipher selection is enabled by default with ndcpp ciphers all other options are disabled the following figure depicts the ndcpp inbound settings page the following is a list of selected ciphers in the inbound settings with the ndcpp mode enabled tls aes 256 gcm sha384 tls chacha20 poly1305 sha256 tls aes 128 gcm sha256 tls aes 128 ccm sha256 ecdhe ecdsa aes128 gcm sha256 ecdhe ecdsa aes256 gcm sha384 ecdhe ecdsa aes128 sha256 ecdhe ecdsa aes256 sha384 ecdhe ecdsa aes128 sha ecdhe ecdsa aes256 sha ecdhe rsa aes128 gcm sha256 ecdhe rsa aes256 gcm sha384 ecdhe rsa aes128 sha ecdhe rsa aes256 sha aes128 sha256 aes256 sha256 aes128 sha aes256 sha dhe rsa aes128 sha dhe rsa aes256 sha dhe rsa aes256 gcm sha384 the following figure depicts the selected ciphers in the inbound settings with the ndcpp mode outbound settings when the ndcpp mode is enabled, the following settings appear by default in the outbound ssl options page only the accept only tls 1 3 and accept only tls 1 2 are editable with regards to the allowed encryption strength settings the custom ssl cipher selection is enabled by default all other options are disabled only the ndcpp ciphers configured in the outbound ssl options settings are sent in the outbound connections (pcs > backend ssl) the following figure depicts the ndcpp outbound settings page the following is a list of selected ciphers in the outbound settings with the ndcpp mode enabled tls aes 256 gcm sha384 tls chacha20 poly1305 sha256 tls aes 128 gcm sha256 tls aes 128 ccm sha256 ecdhe ecdsa aes128 gcm sha256 ecdhe ecdsa aes256 gcm sha384 ecdhe ecdsa aes128 sha256 ecdhe ecdsa aes256 sha384 ecdhe ecdsa aes128 sha ecdhe ecdsa aes256 sha ecdhe rsa aes128 gcm sha256 ecdhe rsa aes256 gcm sha384 ecdhe rsa aes128 sha ecdhe rsa aes256 sha aes128 sha256 aes256 sha256 aes128 sha aes256 sha dhe rsa aes128 sha dhe rsa aes256 sha dhe rsa aes256 gcm sha384 the following figure depicts the selected ciphers in the outbound settings with the ndcpp mode configuring health check options you can use the system > configuration > security > health check options page to configure the following security options enable additional information via healthcheck cgi this option is used by entities like load balancers to monitor the health status of the node to configure health check options select system > configuration > security > health check options to display the configuration page the following figure shows the configuration page select the enable additional information via healthcheck cgi checkbox and save changes an url parameter 'status' needs to be passed to get additional information to the health check url for more information about parameters such as cpu usage and number of active sessions use https //\<ivanti connect secure>/dana na/healthcheck/healthcheck cgi?status=all for more information about sbr statistics use https //\<ivanti connect secure>/dana na/healthcheck/healthcheck cgi?status=sbr add the relevant ipv4/v6 addresses for which additional information is required to be made available, and click add now click save changes configuring miscellaneous security options you can use the system > configuration > security > miscellaneous page to configure the following security options persistent cookie options you can choose whether to preserve or delete persistent cookies when a session is terminated lockout options you can configure lockout options to protect the system from denial of service (dos), distributed denial of service (ddos), and password guessing attacks last login you can choose whether to show users the time and ip address their user id was used to sign in x frame options protection you can choose to defend against click jacking attacks by adding x frame option header to all the ive generated pages if this is not enabled, then only welcome cgi will have this header connections limited per ip address you can configure number of active ip's per connection and limit number of requests an ip can make to server in given period of time slow post attack defense you can configure to protect against slow post dos attacks from non authenticated users booting options on integrity check failure you can configure to protect against integrity attacks integrity checking options you can configure scan the system to periodically check for any integrity anomalies if any anomaly found, information is displayed in the dashboard on low end machines, a reduction in through put may be seen to overcome such issues, opt for scheduled scan option in off peak hours to configure cookie and lockout options select system > configuration > security > miscellaneous to display the configuration page the following figure shows the configuration page complete the configuration as described in the following table save the configuration the following figure depicts the miscellaneous security options configuration page the following table lists the miscellaneous security options configuration guidelines settings guidelines delete all cookies at session termination delete / preserve for convenience, the system sets persistent cookies on the user's machine to support functions such as multiple sign in, last associated realm, and the last sign in url for additional security or privacy, you can choose not to set them include ivanti connect secure's session cookie in url include / not include mozilla 1 6 and safari may not pass cookies to the java virtual machine, preventing users from running jsam and java applets to support these browsers, the system can include the user session cookie in the url that launches jsam or a java applet by default, this option is enabled, but if you have concerns about exposing the cookie in the url, you can disable this feature lockout options rate specify the number of failed sign in attempts to allow per minute attempts specify the maximum number of failed sign in attempts to allow before triggering the initial lockout the system determines the maximum initial period of time (in minutes) to allow the failed sign in attempts to occur by dividing the specified number of attempts by the rate for example, 180 attempts divided by a rate of 3 results in an initial period of 60 minutes if 180 or more failed sign in attempts occur within 60 minutes or less, the system locks out the ip address being used for the failed sign in attempt lockout period specify the length of time (in minutes) the system must lock out the ip address last login options time / ip address display the day and time and ip address the user last logged in to the system for users, this information appears on their bookmark page for administrators, this information appears on the system status overview page these settings do not apply to the custom start page option on role ui options page x frame options protection enable x frame options protection by default, the enable x frame options is checked if the admin does not want to have this protection, they can uncheck this option the x frame options http response header can be used to indicate whether or not a browser should be allowed to render a page in a \<frame>, \<iframe> or \<object> syn flood,smurf,ssl replay attack audit logs syn flood,smurf,ssl replay attack audit logs turning this on can have performance and resource impact even when turned off, the device is always protected against these attacks this option controls only the logging for these attacks this option needs to be on when the device is in jitc mode kernel rate limiting limit syn requests per source ip to limit the number of syn requests per source ip to prevent dos attacks limit syn requests per system to limit the number of syn requests per system to prevent ddos attacks connections limited per ip address enable limiting number of active connections per ip address connection limiting limits the maximum number of simultaneous connections allowed from a single ip address to your server by default, it is disabled and can be configured enter the number of allowed request per ip address request limiting limit the number of requests an ip address may make to a server in a given period of time to certain endpoints its enabled and cannot be configured slow post attack defence timeout by default, the post body is received within 10 seconds if the browser is unable to send the post body within 10 seconds the connection is eventually dropped (configurable from 3 60sec) maximum request size by default, now a connection is directly rejected if it tries to post more than 4kb in post body (configurable from 256 bytes to 24 kb) hsts max age specify the maximum age for hsts it can be disabled by configuring max age as 0 enable includesub domain directive select the check box to enable/disable the includesubdomain directive by default, it is turned off enable preload directive select the check box to enable/disable the preload directive by default, it is turned off booting options on integrity check failure booting options on integrity check failure to stop booting if integrity validation fails for manifest file or any executable select the check box to enforce booting options on integrity validation by default, it is turned off the following integrity checks are performed checks the sha512 digital signature of the manifest file checks the sha256 digest of each individual file entries in the manifest if enabled and integrity check fails, admin gets an option to roll back to previous working package or perform factory reset or continue to boot host header validation enable host header validation to block open redirect attacks select the check box to enforce host header validation by default, it is turned off when host header validation is enabled, every http request will be validated against hostnames and ip v4/v6 addresses known to the ics server if match is not found, the request will be dropped and logs are recorded in admin access logs and user access logs, and a response will be sent back to client username validation enable username validation to block unauthorised access select the check box to enforce username validation for usage of unsupported characters max allowed length for username is 128 characters runtime integrity scanner interval periodic scan select the time interval to run the integrity scanner during run time for example select 2 hrs to run the integrity scanner every 2 hrs scheduled scan select to run integrity scanner at a specified time everyday for example when 13 hr 25 min is specified, the scanner runs at the same time everyday referer header validation enable referer header validation to block csrf attacks select the check box to enable referer header validation relay state validation enable relay state validation for saml authentication server relay state validation can be configured under system > configuration > miscellaneous it is enabled by default in 22 5r2 1 maximum saml response size maximum saml response size enable maximum saml response size saml response size configures the xml buffer size default is 1 mb and range is 1 20 mb enforce secondary session id verification enforce secondary session id verification this option enforces verification of secondary session id along with primary session id during user session restoration this verification will be disabled by default in present release required isac versions are desktop 22 8r5 mobile 22 8r6 scenario illustrating lockout settings workflow the following scenario illustrates how lockout settings work for example, assume the following settings rate = 3 failed sign in attempts per minute attempts = 180 maximum allowed in initial period of 60 minutes (180/3) lockout period = 2 minutes the following sequence illustrates the effect of these settings during a period of 3 minutes, 180 failed sign in attempts occur from the same ip address because the specified value for attempts occurs in less than the allowed initial period of 60 minutes (180/3), the system locks out the ip address for 2 minutes (fourth and fifth minutes) in the sixth minute, the system removes the lock on the ip address and begins maintaining the rate of 3 failed sign in attempts/minute in the sixth and seventh minutes, the number of failed sign in attempts is 2 per minute, so the system does not lock the ip address however, when the number of failed sign in attempts increases to 5 in the eighth minute, which is a total of 9 failed sign in attempts within 3 minutes, the system locks out the ip address for 2 minutes again (ninth and tenth minutes) in the eleventh minute, the system removes the lock on the ip address and begins maintaining the rate of 3 failed sign in attempts per minute again when the rate remains below an average of 3 per minute for 60 minutes, the system returns to its initial monitoring state configuring custom http headers ivanti connect secure supports several http headers, which are sent in response to the client request there are several more headers built to improve security and prevent attacks like xss the custom http headers configuration enables the administrator to add new headers that they want to enforce to configure custom http header select system > configuration > security > advanced the following figure shows the configuration page in the custom http headers section, enter the http header name and the directives along with the values click add multiple headers can be added or removed after adding the headers, click save change s administrator should ensure the correctness of the values that they enter, as the system validation on the input values is limited if the administrator configured http header seems to affect the way the page is rendered or is locked out, use the console option to reset the custom http header values the following figure depicts the custom http headers page the following table lists the owasp recommended headers header supported browsers hpkp firefox, chrome, opera x xss protection chrome and ie x content type options firefox, chrome, opera and ie content security policy all major browsers x permitted cross domain policies not supported referrer policy chrome, firefox and opera expect ct chrome and opera feature policy not supported hsts x frame options configuring ncp and jcp the following types of internal protocols are used to communicate between connect secure and client applications network communications protocol (ncp) standard ncp has been replaced with oncp windows client applications, including the psam and terminal services fallback to ncp if oncp fails optimized ncp (oncp) optimized ncp (oncp) significantly improves the throughput performance of the client applications over ncp because it contains improvements to protocol efficiency, connection handling, and data compression windows client applications, including the psam and terminal services use oncp by default java communications protocol (jcp) jcp is the java implementation of standard ncp the system uses jcp to communicate with java client applications, including the jsam and the java content intermediation engine to set ncp options in the admin console, choose system > configuration > ncp (windows clients) under ncp auto select, select auto select enabled (recommended) use the oncp by default if you select this option, the system uses oncp for most client/server communications and then switches to standard ncp when necessary the system reverts to ncp if the user is running an unsupported operating system, browser type, or combination thereof, or if the client application fails to open a direct tcp connection to the device for any reason (for instance, the presence of a proxy, timeout, disconnect) auto select disabled always use standard ncp this option is primarily provided for backwards compatibility if you are using network connect to provide client access, we recommend that you exercise caution when employing the auto select disabled option, as mac and linux clients cannot connect using the traditional ncp protocol if you disable the oncp/ncp auto selection feature and a udp to oncp/ncp fail over occurs, the system disconnects macintosh and linux clients because it fails over from udp to ncp (instead of oncp), which does not support these users (java clients) under read connection timeout, set the timeout interval for java clients (15 120 seconds) if client side secure access methods do not receive data from the system for the specified interval, they try to reestablish a connection note that this value does not apply to user inactivity in client applications (windows clients) under idle connection timeout, set the idle connection interval this timeout interval determines how long the system maintains idle connections for client side windows secure access methods click save changes using the user record synchronization feature this topic describes the user record synchronization feature user record synchronization overview the user record synchronization feature promotes a more consistent user experience by allowing users to retain their bookmarks and individual preferences regardless of which device they log in to user record synchronization relies on client server pairings the client is the connect secure device that users log in to start their remote access each client is associated with one primary server and one backup server to store user record data clients can be individual appliances or a node within a cluster a server in this instance is the connect secure device that stores the user data records each server can be configured to replicate its user record data to one or more peer servers servers are identified by a user defined logical name the same logical name can be assigned to more than one authentication server to let you associate authentication servers of different types to the same user for example, sa1 is an ace authentication server with user1 who creates a bookmark to www ivanti com sa2 is an active directory authentication server with the same user1 for the www ivanti com bookmark to be transferred from sa1/ace/user1 to sa2/ad/user1 you would assign the logical name "logical1" to both the ace server on sa1 and the active directory server on sa2 cluster vips cannot be used as the ip for synchronizing between clients and peers servers as long as the logical name is the same, the authentication servers can be different types and different server names and still be associated with a common user the username must be the same for user record data to be synchronized across the servers the logical authentication server (las) and username combination is what uniquely identifies a user record the following user records are synchronized between the client and server bookmarks web file terminal services jsam preferences persistent cookies cached passwords user session data is not synchronized persistent cookies, if changed, are synchronized when the user session terminates all other modifications to the user records are synchronized immediately user records are stored in cache on the client node prior to being pushed to the servers when a user logs in to a client, their data is pulled from the associated server the pull is performed in the background and does not delay the login process users using browsers that do not support javascript must manually refresh the index page for updated bookmarks and preferences to appear for browsers that support javascript, users may see a spinning progress indicator and their home page will refresh automatically with updated bookmarks and preferences clients and servers need not be installed with the same system software version user record synchronization uses port 17425 this port number is not configurable if you are deploying across a firewall, configure your firewall to allow traffic on this port to set up user record synchronization, you perform the following tasks enable user record synchronization for each participating client and server, identify which ones are the client and which ones are the server and assign a node name to each client and server create a shared secret that is used to authenticate the client with the server and the server to its peer servers on each server, define which clients and peers are allowed to communicate with the server on each client, define the servers that handle records for each las server when enabling this feature, you have several options to initialize the user record database you can populate the database using user records located in the cache of the client systems populate the database use user records located in the cache of the server systems don't pre populate the database but populate it as users log in and out of the client system if you choose the last option, users may not be able to view their saved bookmarks and preferences until the next time they log in, depending on which client they log in to user records may not synchronize if the time clocks on the devices are not in sync we recommend that you use the same ntp server for each node participating in user record synchronization to keep times accurately adjusted the user record synchronization feature will not start automatically after importing a system configuration that has this feature enabled the workaround is to disable user record synchronization and then enable user record synchronization from the user interface after the configuration import configuring the user record synchronization authentication server to set up the authentication server you must define its logical name select authentication > auth servers click the name of the authentication server you want assign a las name by assigning the authentication server a las name, all users that authenticate using the authentication server are associated with this las in this instance, we are referring to the client nodes, not the user record synchronization server nodes select the user record synchronization check box enter a logical name to identify this server this allows you to share user record data across authentication servers on different connect secure devices by assigning a las name to an authentication server, you are implicitly assigning it to all users that authenticate with that auth server the combination of the user's login name and their las name uniquely identifies the user's user record across all user record synchronization servers click save changes configuring the user record synchronization server to set up the user record synchronization server you must define its peer nodes (optional) and the clients that can access this server select system > configuration > user record synchronization > this server enter the peer server's node name and ip address, then click add to specify more than one peer server, enter each server's node name and ip address individually and click add there is no limit on the number of peer servers you can add data is replicated from the primary or backup server to its peer servers if the primary is not available, user data is sent to the backup user data is then replicated to the peer servers for each client you want synchronized with this server, enter the client's name and ip address and click add once added, peer servers will have a colored icon next to their name indicating their connection status node status is provided to client nodes and las mapping servers as well color description green connected yellow connecting gray not connected configuring the user record synchronization client to set up the client, you select the primary and backup server you want this client to synchronize with select system > configuration > user record synchronization > this client select the las name you want to synchronize and enter the primary ip of the user record server that will serve the user records if you prefer to synchronize with any available server, select any las enter the primary and optionally a backup server's ip address and then click add even if you select any las, you must enter a primary server ip address once added, the primary and backup servers have a colored icon next to their name indicating their connection status configuring the user record synchronization database with the database tab, you can delete inactive records from the client cache, retrieve statistics about the database, export and import the data and remove user data from the server's database to configure the database select system > configuration > user record synchronization > database select auto delete inactive synchronized user records from the cache to remove inactive user records from the cache this option does not remove user records from the user record database when this option is selected, the system performs a check every 15 minutes and deletes user records that meet all of the following criteria there are no active user sessions associated with the user record the user record does not have any custom settings, or the latest version of the user record has been synchronized with the user record database the authentication server associated with the user record database does not have type "local" for example, the "system local" auth server that is part of the default configuration has a "local" type, so any user records associated with that auth server will not be auto deleted however, user records associated with external authentication servers like radius or ldap may be deleted, depend ing on the two prior criteria select auto delete user records from the local synchronization database that have been idle for x days to permanently remove user records from the database located on the server enter the number of days user records must be inactive before being deleted in this instance, "inactive" means that no client as pulled the user record or pushed any modifications to the user record in x days click retrieve statistics to display the number of records in the database you cannot edit or view records in the database under export, you export user records to a file the user records can be exported from the user record database, or from the cache the exported file can be used to pre populate the user record database on another node enter the las name of the user records you want to export if you leave this field blank, all user records are exported if you enter a las name, only user records with the entered las name are exported to encrypt the exported data, select the encrypt the exported data with passwor d check box and enter the password click export to export the user records from the specified source (cache or database) you will be prompted where to save the file under import, you import user records into the synchronization database the user records can be imported from a file or from the cache use the import operation to prepopulate the user record database with user records exported from another node, or with user records from the cache click browse to locate the exported file and enter the password if the exported file was encrypted with a password select the override logical auth servers in imported user records with check box to replace the las name in each imported user record with the las name entered for example, you change the las name, use this option to update the user records with the new name click import under delete, specify which user records to permanently remove from the user record database the options you select apply only to the user record database associated with this server select user record with login name and logical auth server to remove a specific record the login name and las name together uniquely identify a user record select this option to remove that record (if it exists) select user records with logical auth server to delete all user records with the specified las name select all user records to permanently remove user records from the database on this node click delete enabling user record synchronization the first step in enabling user record synchronizing is to define the node name and the shared secret used to authenticate between the clients and the servers select system > configuration > user record synchronization > general see the figure underneath in this section select the enable user record synchronization check box enter a unique node name this name is used when associating a client with a server and is different from the logical name assigned to a server this node name is also not the same as the cluster node name enter the shared secret and confirm it the shared secret is the password used to authenticate the client with its servers and the primary server with its peer servers use the same shared secret for all clients and servers participating in user record synchronization select whether this node is client only or if this node acts as both a client and server click save changes if you need to make any changes in this window at a later time, you must clear the enable user record synchronization check box and click save changes make your edits, select the enable user record synchronization check box and save your changes once you enter a name and shared secret, you cannot clear these fields the following figure depicts the user record synchronization general settings configuration page scheduling user record synchronization backup you can configure periodic backups of the user record database user record synchronization backup can be enabled only on a user record synchronization server to back up the user record database ensure the system is set up as a user record synchronization server see system > configuration > user record synchronization select maintenance > archiving > archiving servers select the archive user record synchronization database check box specify an archive schedule through the options, schedule archives on any combination of weekdays including weekends if you schedule an archival operation to occur during the hour that your system switches to daylight savings time (dst) the operation may not occur as scheduled for example, if your system is set to change to dst at 1 00 a m and you have scheduled an archival operation to occur at any time between 1 01 a m and 1 59 a m , the operation is not accomplished, because at 1 00 a m the system clock is moved forward to 2 00 a m and the system never reaches your archival time for that date define a specific time when you want the system to archive data or elect to archive data every hour, which produces twenty four files with unique timestamps we recommend you schedule an archival operation during hours when traffic is light in order to minimize its impact to your users the automatic archiving process compresses files and, if the system is busy, can degrade performance for users also, a cluster node may appear unresponsive if the system is busy with traffic and performing archiving simultaneously provide a password if you want to encrypt system configuration or user account archives with a password (optional) click save changes using ikev2 security this topic describes how to implement ikev2 security ikev2 support overview this topic gives an overview of support for ikev2 security understanding ikev2 ike or ikev2 (internet key exchange) is the protocol used to set up a security association in the ipsec protocol suite microsoft windows 7 fully supports the ikev2 standard through microsoft's agile vpn functionality and can operate with a vpn gateway using these protocols information on ike and ikev2 is widely available on the internet it is not the intent of this guide to describe details about ike and ikev2 the system supports ikev2, enabling interoperability with clients or devices, such as smartphones, that have a standards based ipsec vpn client ikev2 clients count toward the total number of sessions thus, the total number of sessions = number of ikev2 sessions + number of ncp sessions the system supports the following methods for authenticating ikev2 clients machine certificate based authentication authentication using eap methods ikev2 uses port 500 exclusively do not configure port 500 in your vpn tunneling profiles extensible authentication protocol eap (extensible authentication protocol) is an authentication framework frequently used in wireless communication it provides functions and negotiation of authentication methods called eap methods connect secure supports the following eap methods eap mschap v2 (microsoft challenge handshake authentication protocol version 2) a mutual authentication method that supports password based user or computer authentication during the eap ms chap v2 authentication process, both the client and the authentication server must prove that they have knowledge of the user's password for authentication to succeed mutual authentication is provided by including an authenticator packet returned to the client after a successful server authentication in connect secure, the local authentication server and the active directory server support eap mschap v2 eap md5 challenge described in rfc 2284, enables an authentication server to authenticate a connection request by verifying an md5 hash of a user's password the server sends the client a random challenge value, and the client proves its identity by hashing the challenge and its password with md5 eap md5 challenge is typically used on trusted networks where risk of packet sniffing or active attack are fairly low because of significant security vulnerabilities, eap md5 challenge is not usually used on public networks or wireless networks, because third parties can capture packets and apply dictionary attacks to identify password hashes because eap md5 challenge does not provide server authentication, it is vulnerable to spoofing (a third party advertising itself as an access point) only the local authentication server is supported with eap md5 challenge it is recommended not to use eap md5 challenge protocol set as it is considered insecure ikev2 provides a tunnel mechanism for eap authentication; it does not perform authentication itself instead it proxies eap messages from a client to the eap server and back eap tls (transport layer security) a mutual authentication method that supports certificate based authentication eap transport layer security uses the handshake protocol in tls during the eap tls authentication process, both client and the authentication server authenticate each other using digital certificates client generates a pre master secret key by encrypting a random number with the authentication server's public key and sends it to the authentication server both client and authentication server use the pre master secret key to generate the same master secret key eap tls is considered to be one of the most secure eap standards available the requirement for a client side certificate is what gives eap tls its authentication strength machine certificate based authentication the system supports ikev2 authentication using machine certificates note that only certificate authentication server on connect secure supports machine certificate authentication of ikev2 clients when using machine certificates for authentication, it is not necessary to configure the realm/protocol set mapping section under system > configuration > ikev2 client requirements your ikev2 client should support the following requirements to work with connect secure ability to establish ipsec security associations in tunnel mode (rfc 4301) ability to utilize the aes 128 bit encryption function (rfc 3602) ability to utilize diffie hellman perfect forward secrecy in "group 2" mode (rfc 2409) ability to utilize ipsec dead peer detection (rfc 3706) ability to utilize the md5 hashing function (rfc 1321) ability to handle internal address on a remote network utilizing cfg request cfg reply exchange optional but recommended requirements include ability to adjust the maximum segment size of tcp packets entering the vpn tunnel (rfc 4459) ability to reset the "don't fragment" flag on packets (rfc 791) ability to fragment ip packets prior to encryption (rfc 4459) in addition, your client must support certificate authentication and esp/sha1 supported features the following features are unavailable to the end user since you are using a third party client that are neither controlled nor configured by ivanti host checker idle timeout notifications upload logs route monitoring feature of split tunnel windows interactive user logon options session startup scripts ncp tunnel mode dns search order proxy server settings the following table outlines the behavior of the network connect client and the ikev2 client for certain split tunnel options the table lists the split tunnel operations with ikev2 and network connect clients option ikev2 client network connect client disable split tunnel mode resource through tunnel internet through tunnel local subnet (client) through physical adapter internet through tunnel local subnet (client) through tunnel resource through tunnel enable split tunnel mode resource—through tunnel internet—through tunnel but fails because the resource is not in split tunnel configuration local subnet (client)—through physical adapt internet—through physical adapter local subnet (client)—through physical adapter allow local access subnet resource through tunnel internet through tunnel local subnet (client) through physical adapter (same as disable split tunnel mode) internet & other traffic—through tunnel local subnet (client)—through physical adapter enable split tunnel mode with route monitor (nc proprietary) resource—through tunnel internet—through tunnel but fails because the resource is not in split tunnel configuration local subnet (client)— through physical adapter note route table delete is not monitored resource—through tunnel internet—through physical adapter local subnet (client)—through physical adapter route table delete is monitored enable st with allow local access subnet resource—through tunnel internet —through tunnel but fails because the resource is not in split tunnel configuration local subnet (client)— through physical adapter resource—through tunnel internet—through physical adapter local subnet (client)—through physical adapter the table below explains the limitations and supported configurations for different ikev2 clients to work with ics configured for different ikev2 authentication the following table lists the limitations and supported configurations for different ikev2 clients comparison parameter windows desktop/laptop windows mobile phone linux client ios client mac os client client version windows10 native client windows8 1 native client windows7 native client windows10 mobile windows8 1 mobile strong swan5 4 0 ios 9 x and above macos sierra version 10 12 aes128/sha1 data encryption configuration supports only optional encryption (connect even if no encryption) configuration supports only optional encryption (connect even if no encryption) configuration supports only optional encryption (connect even if no encryption) configuration supported not supported supported supported (this can be configured in the child sa params in the profile) supported aes256/sha1 data encryption configuration supports all 3 data encryption configuration optional encryption (connect even if no encryption require encryption (disconnect if server declines) • maximum strength encryption (disconnect if server declines) supports all 3 data encryption configuration optional encryption (connect even if no encryption require encryption (disconnect if server declines maximum strength encryption (disconnect if server declines) supports 2 data encryption configuration optional encryption (connect even if no encryption • maximum strength encryption (disconnect if server declines) here optional encryption (connect even if no encryption) is not supported supported supported supported supported (this can be configured in the child sa params in the profile) not supported aes256/sha256 data encryption configuration not supported not supported not supported not supported not supported supported supported supported ca or ca chain need to import ics device certificate ca in trusted root certificate authorities under computer account certificate store ics device certificatesub ca(s) should be imported in intermediate certificate authorities under computer account certificate store need to import ics device certificate ca in trusted root certificate authorities under computer account certificate store ics device certificatesub ca(s) should be imported in intermediate certificate authorities under computer account certificate store need to import • ics device certificate ca in trusted root certificate authorities under computer account certificate store • ics device certificatesub ca(s) should be imported in intermediate certificate authorities under computer account certificate store need to import • ics device certificate ca in trusted root certificate authorities under computer account certificate store • ics device certificatesub ca(s) should be imported in intermediate certificate authorities under computer account certificate store need to import • ics device certificate ca in trusted root certificate authorities under computer account certificate store • ics device certificatesub ca(s) should be imported in intermediate certificate authorities under computer account certificate store need to import device certificate ca and subca(s) should be place in cacert directory in pem or cer format need to import device certificate ca / sub ca(s) should be installed through a profile need to import device certificate ca and subca(s) should be placed in system > certificates key chain client version windows10 native client windows8 1 native client windows7 native client windows10 mobile windows8 1 mobile strongswan5 4 0 ios 9 x and above macos sierra version 10 12 certificate eku extension for eap tls client certificate should have clientauth(1 3 6 1 5 5 7 3 2)eku extension mandatorily op tionally certificates can have secure email (1 3 6 1 5 5 7 3 4) or encrypting file system (1 3 6 1 4 1 311 10 3 4) or serverauth(1 3 6 1 5 5 7 3 1) client certificate should have clientauth(1 3 6 1 5 5 7 3 2)eku extension mandatorily optionally certificates can have secure email (1 3 6 1 5 5 7 3 4) or encrypting file system (1 3 6 1 4 1 311 10 3 4) or serverauth(1 3 6 1 5 5 7 3 1) client certificate should have clientauth(1 3 6 1 5 5 7 3 2)eku extension mandatorily optionally certificates can have secure email (1 3 6 1 5 5 7 3 4) or encrypting file system (1 3 6 1 4 1 311 10 3 4) or serverauth(1 3 6 1 5 5 7 3 1) client certificate should have clientauth(1 3 6 1 5 5 7 3 2)eku extension mandatorily optionally certificates can have secure email (1 3 6 1 5 5 7 3 4) or encrypting file system (1 3 6 1 4 1 311 10 3 4) or serverauth(1 3 6 1 5 5 7 3 1) client certificate should have clientauth(1 3 6 1 5 5 7 3 2)eku extension mandatorily optionally certificates can have secure email (1 3 6 1 5 5 7 3 4) or encrypting file system (1 3 6 1 4 1 311 10 3 4) or serverauth(1 3 6 1 5 5 7 3 1) certificate should have clientauth(1 3 6 1 5 5 7 3 2)eku extension mandatorily optionally certificates can have secure email (1 3 6 1 5 5 7 3 4) or serverauth(1 3 6 1 5 5 7 3 1) note microsoft encrypting file system (1 3 6 1 4 1 311 10 3 4) eku extension is not supported client certificate should haveclientauth(1 3 6 1 5 5 7 3 2)eku extension mandatorily optionally certificates can have secure email (1 3 6 1 5 5 7 3 4) or encrypting file system (1 3 6 1 4 1 311 10 3 4) or serverauth(1 3 6 1 5 5 7 3 1 client certificate should have clientauth(1 3 6 1 5 5 7 3 2) eku extension mandatorily optionally certificates can have secure email (1 3 6 1 5 5 7 3 4) or encrypting file system (1 3 6 1 4 1 311 10 3 4) or serverauth(1 3 6 1 5 5 7 3 1) ndcpp mode supported not supported not supported supported not supported supported supported not supported tls version supports sslv3, tls1 0, tls1 1 and tls1 2 supports only sslv3 and tls1 0 supports only sslv3 and tls1 0 supports sslv3, tls1 0, tls1 1 and tls1 2 supports only sslv3 and tls1 0 supports sslv3, tls1 0, tls1 1 and tls1 2 supports sslv3, tls1 0, tls1 1 and tls1 2 supports only tls1 0 suiteb encryption not supported not supported not supported not supported not supported not supported not supported not supported configured for ecc device certificate not supported not supported not supported not supported not supported not supported not supported not supported aes256/md5 and aes128/md5 esp encryption not supported not supported not supported not supported not supported not supported not supported not supported client proxy not working working working not working working not tested not tested not tested configured for rsa sha2 device certificate supported supported not supported supported supported supported supported supported split tunnel configuration not supported supported supported not supported supported not tested supported supported configured for secondary authentication not supported not supported not supported not supported not supported not supported not supported not supported configured for two or more role mapping roles with "user must select from among assigned roles" option not supported not supported not supported not supported not supported not supported not supported not supported ikev2 eap tls configuration supports both machine certificate authentication and eap tls authentication supports both machine certificate authentication and eap tls authentication supports both machine certificate authentication and eap tls authentication supports both machine certificate authentication and eap tls authentication supports both machine certificate authentication and eap tls authentication supports both machine certificate authentication and eap tls authentication supports both machine certificate authentication and eap tls authentication (profile configuration can be customized to use certificate or eap tls ) supports only eap tls authentication machine certificate authentication certificate eku extenstion client certificate should have clientauth(1 3 6 1 5 5 7 3 2) and serverauth(1 3 6 1 5 5 7 3 1) eku extension mandatorily optionally certificates can have secure email (1 3 6 1 5 5 7 3 4) or encrypting file system (1 3 6 1 4 1 311 10 3 4) client certificate should have clientauth(1 3 6 1 5 5 7 3 2) and serverauth(1 3 6 1 5 5 7 3 1) eku extension mandatorily optionally certificates can have secure email (1 3 6 1 5 5 7 3 4) or encrypting file system (1 3 6 1 4 1 311 10 3 4) client certificate should have clientauth(1 3 6 1 5 5 7 3 2) and serverauth(1 3 6 1 5 5 7 3 1) eku extension mandatorily optionally certificates can have secure email (1 3 6 1 5 5 7 3 4) or encrypting file system (1 3 6 1 4 1 311 10 3 4) not applicable not applicable client certificate should have clientauth(1 3 6 1 5 5 7 3 2) and serverauth(1 3 6 1 5 5 7 3 1) eku extension mandatorily optionally certificates can have secure email (1 3 6 1 5 5 7 3 4) or encrypting file system (1 3 6 1 4 1 311 10 3 4) client certificate should have clientauth(1 3 6 1 5 5 7 3 2) and serverauth(1 3 6 1 5 5 7 3 1) eku extension mandatorily optionally certificates can have secure email (1 3 6 1 5 5 7 3 4) or encrypting file system (1 3 6 1 4 1 311 10 3 4) not applicable dh 2048 bit or dh 3072 bit for phase 1 key negotiation not supported not supported not supported not supported not supported supported supported supported dh support for phase1 key negotiation dh1024 dh1024 dh1024 dh1024 dh1024 dh1024 dh2048 dh3072 dh1024 dh2048 dh3072 dh2048 sa(security association) preference order ics chooses matching sas based on the preference order sent by ikev2 client note ics doesn't maintain any default sa preference order ics chooses matching sas based on the preference order sent by ikev2 client note ics doesn't maintain any default sa preference order sas based on the preference order sent by ikev2 client ics doesn't maintain any default sa preference order ics chooses matching sas based on the preference order sent by ikev2 client note ics doesn't maintain any default sa preference order ics chooses matching sas based on the preference order sent by ikev2 client ics doesn't maintain any default sa preference order ics chooses matching sas based on the preference order sent by ikev2 client ics doesn't maintain any default sa preference order ics chooses matching sas based on the preference order sent by ikev2 client ics doesn't maintain any default sa preference order ics chooses matching sas based on the preference order sent by ikev2 client ics doesn't maintain any default sa preference order windows ikev2 native client doesn't support dh2048 and above, so on enabling 'allow only dh 2048 bit and higher for phase 1 key negotiation' checkbox ikev2 negotiation will fail dh1536, dh768, dh4096 and higher diffie hellman algorithms are not supported currently ics supports only following diffie hellman algorithms dh1024 dh2048 dh3072 ics doesn't enforce sa (security association) preference order in ikev2 phase1 negotiation, ics only honors the sa preference order what ikev2 client sends ikev2 configuration doesn't support port/realm mapping for the virtual ports having same name under internal and external ports ikev2 client doesn't support host checker validation both at realm and role level ikev2 in ics doesn't support ipv6 address ikev2 client doesn't honor roaming session settings under roles session options due to design limitation following system operation is not supported for ikev2 configuration pulse one doesn't support pushing ikev2 configuration ikev2 does not support automatic cluster failover after cluster failover, ikev2 users must reconnect ikev2 clients do not support ipsec negotiation with ecc device certificate configured in ics aes256/md5 and aes128/md5 esp encryption is not supported by windows native client and mobile phone vpn tunneling connection profile proxy server settings under users > resource policies > vpn tunneling connection profiles is not supported by ikev2 clients windows 10 vpn client proxy does not work with ics windows 10 native client or windows 10 mobile does not use or support split tunnel configuration of ics for routing traffic deny/exclude access in split tunnel network profile configuration doesn't work with ikev2 clients ikev2 native clients won't honor "key lifetime (time based)" and "key lifetime (bytes transferred)" connection profile configuration in ics for ipsec sa rekeying mac os 10 12 ikev2 client will automatically disconnects after 8 minutes configuring ikev2 ports to configure the ikev2 ports and eap protocol select system > configuration > ikev2 to display the configuration page see figure 191 enter the dpd timeout value in seconds valid values are 400 3600 dpd is a form of keepalive when a tunnel is established but idle, one or both sides may send a "hello" message and the other replies with an acknowledgment if no response is received, this continues until the dpd time value has elapsed if there still isn't any traffic or acknowledgment, the peer is determined to be dead and the tunnel is closed under port/realm mapping , select the port and the realm to use that port to add additional port/realm mapping sets, click add to delete a port/realm mapping set, select the check box next to the set to remove and click delete under realm / protocol set mapping, select the realm and the eap protocol set to use for that realm the three protocol set options include eap mschap v2, eap md5 challenge, and eap tls it is recommended not to use eap md5 challenge protocol set as it is considered insecure to add additional realm/protocol mapping sets, click add to delete a realm/protocol mapping set, select the check box next to the set to remove and click delete click save changes changing ikev2 configuration (system > configuration > ikev2) disconnects connections from ikev2 clients, vpn tunneling and ivanti vpn tunneling and ivanti will reconnect automatically the following figure depicts the ikev2 configuration for eap tls to enable ikev2 user access logs select system>logging/monitoring>user access>log settings under select events to log, make sure to enable the ivanti secure access client messages checkbox click save changes ikev2 configuration overview ikev2 eap supports the following authentication server types local authentication active directory certificate server (applicable only for eap tls) if you are using ikev2 eap authentication on a local authentication server, you must select the password stored as clear text check box in the auth server page of the admin console note that you cannot edit an existing local authentication server instance to select this option if you require ikev2 eap authentication on a local authentication server, you must create a new local authentication server instance ikev2 eap does not work with any preexisting local authentication servers since they do not store passwords in clear text to configure support for ikev2 configure your client for using ike for more information, see your mobile device's documentation install client and device certificates you need a certificate authority (ca) that can issue client certificates on the client side, install this client certificate along with the ca certificate on the connect secure server side, install the ca certificate under configuration/certificates/trusted client cas on the client side, install the connect secure certificate corresponding to the port to which the client connects, found under configuration/certificates/device certificates define an ikev2 rule under the users > user realms > user > role mapping page of the admin console select the ikev2 access feature under the users > user roles > user > general > overview page of the admin console enable network connect for the role and configure an nc connection profile (ip pool) to use for that role when a client uses ikev2 to connect to the host, the agent type column of the active users page displays ikev2 enabling the ikev2 phase 1 key settings ikev2 has a two phase negotiation process the first phase is known as ike sa init and the second phase is known as ike auth ike sa init phase exchanges the security association (sa) proposals, which comprises encryption and integrity algorithms, diffie hellman group, to derive keys for ike auth phase these security association proposals preference can be controlled by different configurations in ics to configure phase 1 key settings select system > configuration > ikev2 > phase 1 key settings three new ui options are available to enforce encryption algorithm (aes256), integrity algorithm (sha256, sha384 and sha512) diffie hellman group (dh 2048 and dh3072) enabling these options mean more secured phase 2 negotiations when aes256 is enabled, aes256 encryption algorithm is preferred over aes128 or 3des when sha2 is enabled, sha2 integrity algorithm is preferred over sha1 when dh is enabled, dh2048 or dh3072 diffie hellman group is preferred over dh1024 see figure below for phase 1 key settings before upgrading to 25 1 3 0, users should be aware that all ikev2 phase 1 key settings are enabled by default as part of secure by default changes introduced in this release as a result, ikev2 tunnel negotiation may fail and vpn connections may not be established if the peer configuration is not compatible with the enabled settings configuring ikev2 phase 2 key settings the phase 2 key exchange is also known as ike auth the ike auth exchange is used to authenticate the remote endpoint and to securely establish ipsec security association or child sa the following encryption and integrity combinations are supported aes128 + sha1/md5 aes256 + sha1/md5/sha256 aes128 + sha1/md5 to configure ikev2 phase 2 parameters select resource policies > vpn tunneling > connection profile under encryption , select the suitable encryption and integrity combination the image below, indicates the options available for encryption enabling the ikev2 initial contact when an endpoint either crashes or reinitializes its state, the other endpoint should detect those conditions and stop sending any data the initial contact notification asserts that ike security association (sa) is the only ike sa currently active between the authenticated identities it may be sent when an ike sa is established after a crash, and the recipient may use this information to delete any other ike sas it has to the same authenticated identity without waiting for a timeout enabling initial contact deletes all existing sessions for that user if request contains initial contact payload when multi user session is enabled when multiuser session is disabled, the server will always delete the existing session for that user before creating a new session to configure ikev2 initial contact select system > configuration > ikev2 in the initial contact section, select the enable pcs to process initial contact request check box enabling the ikev2 access feature roles specify the session properties, including enabled access features, for users who are mapped to the role to enable the ikev2 access feature select user > user roles > role name > general > overview under access features , check the vpn tunneling check box click save changes enabling the ikev2 eap tls user access logs select system>logging/monitoring>user access>log settings under select events to log, make sure to enable the ivanti secure access client messages check box click save changes defining the ikev2 role mapping rule role mapping rules are conditions a user must meet for the system to map the user to one or more user roles the procedure described in this topic is required only if you want to create a separate role mapping rule specific for ikev2 users if you use regular username, group or custom expression based role mapping rules (typically used for general access to a device), the following procedure is not required select user > user realms > user > role mapping click new rule select custom expressions as the type of condition on which to base the rule click update to display the expressions list click the expressions button to display the expressions tab of the server catalog create a rule useragent = "ikev2" click add expression and then close select the rule you just created from the available expressions list and click add to move it to the selected expressions list specify the roles to assign to the authenticated user by adding roles to the selected roles list (optional) check the stop processing rules when this rule matches check box if you want the system to stop evaluating role mapping rules when the user meets the conditions specified for this role click save changes using the mobile options this topic describes the mobile options that are available on ivanti connect secure to configure the mobile option, go to system > configuration > mobile it includes the following information the following table lists the configuring the mobile options option description server certificate trust enforcement enables you to block connections if the ivanti connect secure server certificate is untrusted or invalid when enabled, it automatically blocks the ivanti secure access client app from connecting to untrusted ivanti connect secure when disabled, it prompts when a ivanti secure access client app connects to untrusted ivanti connect secure reconnect vpn on wakeup enables you to reconnect a vpn session with ics on device wakeup touch id / face id support for ios devices enables you to authenticate using fingerprint / face recognition client ui mode for mobile users enables you to switch between classic and neux communication protocol preference for mobile isac enables you to choose the type of authentication to use either if t/tls or ncp enable play integrity check for rooting detection on android devices enabling this option would allow android devices to perform play integrity check it helps to check if interactions and server requests are coming from the genuine app binary running on a genuine android device to enable the play integrity check perform the following enter the google cloud account's project number only numeric characters are allowed browser to upload json key file downloaded from google cloud service account for more info on play integrity on android https //help ivanti com/ps/help/en us/isac/vnow/22 x feature guide pdf fido2 support for mobile isac fast identity online is a set of open, standardized authentication protocols intended to eliminate the use of passwords for authentication when enabled, ics sets enable fido2=1 in sign in responses for realms configured with saml or oidc default is disabled http protocol configuration this feature introduces http/2 support for the ingress interface with this enhancement, ics can accept incoming http/2 requests from supported end user browsers or clients, while continuing to use the existing http/1 1 based communication for egress and internal backend requests unless otherwise specified http/2 support on the ingress interface helps improve client side connection efficiency by enabling features such as multiplexing, header compression, and reduced connection overhead to configure http protocol select system > configuration > http protocol configuration to display the configuration page click enable http/2 support for gateway to use http/2 on ics http/2 limitations and compatibility considerations certificate authentication certificate based authentication requires port redirection for both tls 1 2 and tls 1 3, as rfc 9113 prohibits ssl/tls renegotiation blacklisted cipher suites (rfc 9113 appendix a) the cipher suites tls rsa with aes 128 gcm sha256 and tls rsa with aes 256 gcm sha384 are not recommended for http/2 because they do not provide perfect forward secrecy (pfs) isac desktop client support the isac desktop client does not support http/2 existing workflows continue to function through automatic fallback to http/1 1 isac mobile client support http/2 is supported for selected mobile client workflows workflows that do not support http/2 continue to operate using automatic fallback to http/1 1 using the advanced client configuration feature this topic describes the xml advanced client configuration that can be used by the ics administrator to configure the custom settings, which are meant to solve a specific customer scenario without changing the ics admin console admin can set these custom settings in the form of xml input through the advanced client configuration ui feature ivanti secure access client supporting these custom settings will consume them when connecting to this ics, and the same would be applied on the client machines this feature will minimize the number of changes going into the ics admin console, in order to fulfill a custom requirement of a specific customer the virtual adapter mtu was calculated based on the physical adapter mtu (of the host machine) and the mtu sent by the ics basically, the formula used to calculate the virtual adapter mtu is min (physical adapter mtu, mtu from pcs, tcp mss value + 40) following is one of the scenarios where firewall on the data path is stripping the tcp mss options being advertised by ics to theivanti secure access client in this scenario, the tcp mss value on the ivanti secure access client will default to a minimum value of 536, and as a result the client side mtu calculation will result in a minimum mtu value of 576 here, customer wants to ignore the tcp mss options while calculating the virtual adapter mtu calculation if the administrator configures the ivanti connect secure sever with the following xml input in "advanced client configuration for ivanti secure access client" option, it will ignore tcp mss options while calculating the virtual adapter mtu on client side select system > configuration > client configuration to display the configuration page figure shows the client configuration page for ivanti connect secure select client ui mode for desktop users to switch between classic and neux enter the following xml input in "advanced configuration for ivanti secure access client" \<advanced config> \<version> \</version> \<desktop client config> \<layer3 connection config> \<adapter config> \<ignore tcp mss>true\</ignore tcp mss> \</adapter config> \</layer3 connection config> \</desktop client config> \</advanced config> click save changes the advanced configuration setting "ignore tcp mss" is layer3 adapter configuration setting and this will be consumed by the ivanti secure access client as part of the ipsecconfig this "ignore tcp mss" setting is applicable for the virtual adapter mtu calculation only for ipv4 by default, the setting is always false, and therefore the tcp mss options are always consid ered for mtu by default admin has to explicitly set the ignore tcp mss setting to true (case insensitive), to ignore tcp mss using the traffic segregation feature this topic describes the traffic segregation feature that is available on the connect secure virtual appliance (service provider edition) traffic segregation feature overview service providers often need a way to cleanly segregate the system generated network traffic across interfaces (such as internal, management and vlan ports), to differentiate aaa traffic from others traffic segregation is supported for the following scenarios\ radius certificate auth including any crl/ocsp verification saml aaa dns traffic system logging (syslog) ad domain join ad server catalog ad user auth ad authrz ad pmi ldap test connection ldap user auth ldap user auth referal user ldap searchcatalog ldap grplookup userlogin ldap pmi unsupported features include the following ace auth two typical service provider deployment models are authentication server of the customer is hosted by the customer authentication server for the customer is hosted and managed by the service provider in both models, the service provider's authentication server is always hosted in the service provider's network and is reachable either through the internal or management port in the first model, the customer's authentication servers are reachable through the internal port of the virtual appliance in the second model, the customer's authentication server must be routed either through the internal or management port, depending on where the service provider has hosted the customer's authentication server a traffic segregation menu is available only on virtual appliances to allow system providers to configure the interface and traffic the "default network" is used as the primary logical network for the service provider and customer configuration if traffic segregation across different logical networks is needed, the "administrative network" can be used you can differentiate aaa traffic from other traffic and route it through the management port this is useful when the only the authentication servers are hosted on the network reachable through the management port and all other resources uses a different port this option is available on both the default network and the administrative network traffic segregation tested behaviors no traffic segregation enabled, so all dc traffic goes as expected from internal port only enabled traffic segregation, let it be on still default internal port, traffic as expected goes from internal port only changed port to management port as global traffic segregation settings checked that dc traffic still goes via internal port while doing troubleshooting tests, user auth etc then, reset join on auth server after that it is found dc traffic is going via management port as expected the configurations to do on the virtual appliance depend on the logical network setup around the virtual appliance and the type of service provider deployment model if both the service provider's and customer's authentication server are reachable through the same interface, the entire configuration for the service provider and customer is done under the default network it is not necessary to enable the administrative network if the service provider's and customer's authentication servers are located on two different networks, the administrative network must be created the following table shows where the administrator configures the options in the system gui if the user is tagged to read only administrators role, then access to administrative network is not allowed the following table describes the configuring traffic segregation options options description network settings and tools enables you to change standard network settings; print a routing table; print or clear an arp cache; run the ping and traceroute commands, remove static routes, add an arp entry, view cluster status, configure management port, and change traffic control settings (note for change traffic control settings, the goal of the change is to change the priority of traffic in ive depending on its criticality) create admin username and password enables you to create a new super administrator account display log enables you to display system configuration, user access logs, or administrator access logs through the serial console note that must enter q to return to serial console options after viewing the logs system operations enables you to reboot, shut down, restart, roll back, or factory reset the system without using the admin console toggle password protection for the console enables you to password protect the serial console when you toggle this option to "on," only super administrators are allowed access create a super admin session enables you to create a recovery session to the admin console, even if you have configured the system to block access to all administrators when you select this option, the system generates a temporary token that is valid for 3 minutes enter the following url into a browser window then, enter the temporary token when prompted to sign in to the admin console when you select this option, the system blocks any additional administrators from signing in to the admin console until you sign in to the specified url and initiate a session using your token the appliance blocks additional sign in attempts so that you can fix any configuration problems that the system may have encountered without conflicting with another session system snapshot enables you to take a system snapshot without using the admin console when you select this option, the system takes the snapshot immediately you can then send the snapshot file, by way of scp, to a remote system the system prompts you for the destination server port, user id, password, and the destination path to the remote directory if you choose not to send the snapshot file to a remote system, the system saves the file locally the next time you log in to the admin console, the system snapshot tab contains a link to the snapshot file using the serial port this topic describes use of the serial port and serial port console connecting to the serial port console in cases where the admin console is unavailable, you can perform network and host configuration tasks and troubleshooting using the serial port console to connect to the serial console plug a null modem crossover cable from a console terminal or laptop into the device serial port this cable is provided in the product box do not use a straight serial cable configure a terminal emulation utility, such as hyperterminal, with the following serial connection parameters 9600 bits per second 8 bit no parity (8n1) 1 stop bit no flow control press enter until the serial console is displayed the following figure depicts the serial console menu options the following table lists the serial console menu options description network settings and tools enables you to change standard network settings; print a routing table; print or clear an arp cache; run the ping and traceroute commands, remove static routes, add an arp entry, view cluster status, configure management port, and change traffic control settings (note for change traffic control settings, the goal of the change is to change the priority of traffic in ive depending on its criticality) create admin username and password enables you to create a new super administrator account display log enables you to display system configuration, user access logs, or administrator access logs through the serial console note that must enter q to return to serial console options after viewing the logs system operations enables you to reboot, shut down, restart, roll back, or factory reset the system without using the admin console toggle password protection for the console enables you to password protect the serial console when you toggle this option to "on," only super administrators are allowed access create a super admin session enables you to create a recovery session to the admin console, even if you have configured the system to block access to all administrators when you select this option, the system generates a temporary token that is valid for 3 minutes enter the following url into a browser window then, enter the temporary token when prompted to sign in to the admin console when you select this option, the system blocks any additional administrators from signing in to the admin console until you sign in to the specified url and initiate a session using your token the appliance blocks additional sign in attempts so that you can fix any configuration problems that the system may have encountered without conflicting with another session system snapshot enables you to take a system snapshot without using the admin console when you select this option, the system takes the snapshot immediately you can then send the snapshot file, by way of scp, to a remote system the system prompts you for the destination server port, user id, password, and the destination path to the remote directory if you choose not to send the snapshot file to a remote system, the system saves the file locally the next time you log in to the admin console, the system snapshot tab contains a link to the snapshot file using the serial console to roll back to a previous os version you can use the admin console to roll back the configuration to a previous state if the rollback option is not available in the admin console, you can use the procedure described in this section to perform the system rollback if you have not yet performed an os service package upgrade, there is no previous state to roll back to, and the rollback option is not available if you have performed an os service package upgrade, any system and user configuration data created after the upgrade is lost unless you export the most current configuration files before rolling back the system and then import them afterwards to roll back to the previous os service package connect to the serial console in a browser window, sign in to the admin console select maintenance > system > platform click reboot now and then return to the console utility window the window displays a message that the system is restarting after several moments, you are prompted to use the tab key to select options press tab, and when prompted for the configuration to load, type rollback and then press enter after you click reboot now , the rollback status is output to the screen, and when complete, you are prompted to press return (enter) to modify system settings, which returns you to the initial setup options when you are finished entering data, simply close the serial console window if you wait more than 5 seconds to enter your choice, the current system configuration is automatically loaded, and you must go back to the admin console and click reboot now to start the process again if you have already performed a system rollback, the rollback option is not available again until you upgrade the os service package again using the serial console to reset the system to the factory image in rare cases, you might need to reset the system to its original factory settings before performing this advanced system recovery option, contact support center (https //forums ivanti com/s/contactsupport) if possible, export the most current system and user configuration data before performing a factory reset to perform a factory reset connect to the serial console in a browser window, sign in to the admin console select maintenance > system > platform click reboot and then go back to the console utility window the window displays a message that the system is restarting after several moments, you are prompted to use the tab key to select options press tab, and when prompted for the configuration to load, type factory reset and then press enter if you wait more than 5 seconds to enter your choice, the current system configuration is automatically loaded, and you must go back to the admin console and click reboot now to start the process again when you are prompted to confirm performing a factory reset, type proceed and then press enter the system begins the process of resetting the machine to its original settings and outputs several screens of data after several minutes, you are prompted to use the tab key to select configuration choices when prompted to press the tab key, do one of the following wait for the default selection (current) to start automatically press tab , type current, and then press enter you are then prompted to enter the initial configuration settings for details on how to proceed, see the installation guide provided in the product packaging or on the support site after you complete the initialization process, you can upgrade to the latest os service package and import saved system and user configuration files to return to the last good working state of your system you might receive errors from the system during the initial setup or on a factory reset before the system starts services, it monitors the network port for a maximum of 120 seconds the system checks the link status and sends arp requests to the default gateway if there is a problem, after 5 seconds, the system displays a message on the serial console that starts with nic if the link recovers within 120 seconds, the startup process continues if the link does not recover, the following message is displayed internal nic \[down code=0x1] two codes can appear 0x1 means that the interface link status reported by the nic remains off (for example, a disconnected cable or a cable is in the wrong port) 0x2 means that the gateway is unreachable the system boots but is not reachable from ip addresses bound to that network port