Administrator's Guide - Kerio Software Archive

Chapter 24
Kerio Clientless SSL-VPN (Windows)
Kerio Clientless SSL-VPN (thereinafter “SSL-VPN ”) is a special interface used for secured remote
access to shared items (files and folders) in the network protected by Kerio Control via a web
browser. This interface is available only in Kerio Control on Windows.
To a certain extent, the SSL-VPN interface is an alternative to Kerio VPN Client (see chapter 23).
Its main benefit is that it enables an immediate access to a remote network from any location
without any special application having been installed and any configuration having been
performed (that’s the reason for calling it clientless). The main disadvantage of this alternative
is that network connections are not transparent. SSL-VPN is, in a manner, an alternative to the
My Network Places system tool ) — it does not enable access to web servers or other services
in a—remote network.
SSL-VPN is suitable for an immediate access to shared files in remote networks in such
environments where it is not possible or useful to use Kerio VPN Client.
This chapter addresses configuration details needed for proper functionality of the SSL-VPN
interface. The SSL-VPN interface is described thoroughly in the Kerio Control — User’s Guide.
24.1 Kerio Control SSL-VPN configuration
SSL-VPN interface requirements
For proper functionality of the SSL-VPN interface, the following conditions must be met:
1. The Kerio Control host must be a member of the corresponding domain (Windows NT or
Active Directory domain).
2. User accounts that will be used for connections to SSL-VPN must be authenticated at the
domain (it is not possible to use local authentication). This implies that the SSL-VPN
interface cannot be used for accessing shared items in multiple domains or to items at
hosts which are not members of any domain.
3. Users who are supposed to be allowed to access the SSL-VPN interface needs the right to
use Clientless SSL-VPN in Kerio Control (see chapter 16.2).
4. If Kerio Control is installed on the domain server, the corresponding users need to be
allowed to log on to the server locally. Local logon can be allowed under Domain Controller
Security Policy. For details, refer to our Knowledge Base.
360