Configure the Access Portal

1. Select Subscription Services > Access Portal.
2. Select Add > Application Group.
   The Add Application Group dialog box appears.
3. In the Name text box, type a name for the application group.

4. Click OK.
5. To add an application to the application group, select the application.

6. To move the application into an application group, click Move Up or Move Down to move the application into an application group.

1. Select Add.
   The Web Application or Application Group dialog box appears.
2. From the Type drop-down list, select Application Group.
3. In the Name text box, type a name for the application group.
4. Select applications to move into this application group.

1. Select Add > Web Application.
2. In the Name text box, type a name for the web application.
3. In the Description text box, type a description of the web application.
4. To select a custom icon for the application, select Custom Icon > Choose File.
5. To remove a custom image that you added, select Reset Image.
6. In the URL text box, type the URL for the web application. This URL must be publicly resolvable.

1. Click Add.
   The Web Application or Application Group dialog box appears.
2. In the Name text box, type a name for the web application.
3. In the Description text box, type a description of the web application.
4. To select a custom icon for the application, select Custom Icon > Upload Custom Icon.
5. In the URL text box, type the URL for the web application. This URL must be publicly resolvable.

1. Click Add.
   The Web Application or Application Group page appears.
2. From the Type drop-down list, select Host Desktop Access (RDP).
3. In the Name text box, type a name for the RDP connection.
4. In the Description text box, type a description of the RDP connection.
5. To select a custom icon for the application, select Custom Icon > Choose File.
6. To remove a custom image that you added, select Reset Image.
7. In the Host text box, type the IP address or domain name of the host to connect to.
8. To use a port other than 3389, type the number in the Port text box.
9. From the Security drop-down list, select Any, NLA, RDP, or TLS as the security protocol for the connection. Tip! When Any is selected, the Firebox negotiates the security protocol with the remote host.
   
10. If you select RDP or TLS:
    • To require users to specify a user name and password on the RDP login page, select Require users to specify credentials.
    • To specify and save a user name and password for the RDP connection, select Use these credentials.
11. If the RDP host has a self-signed certificate, and you trust the connection and the RDP host, select Trust certificate.
    For RDP connections to a computer with Windows 10 Enterprise, you must select Trust certificate.

12. To require the Firebox to verify the certificate, clear the Trust Certificate check box. You must import the CA chain of the RDP server into the Firebox. For information about how to import CA certificates, go to Import and Install a Third-Party Web Server Certificate.
13. Click the Session tab.

14. (Optional) Specify the name for the RDP host to use to identify the RDP client.
15. (Optional) To automatically launch a program when Windows starts, type the file path in the Initial Program text box. The operating system you connect to must support the Initial Program feature for this to work.
16. To connect to the console session, select Console Session. You must log in with an account that is a member of the Administrators group.Tip! When you connect to a console session, you see what would appear on a physical monitor attached to the server. In most cases, a console session is not required.

Windows Server 2003

The Console Session option connects you to the physical console session (session 0) on the Windows server. This option is the same as the /console switch in Windows. You can only connect to one console session at a time.

For more information about console connections in Windows Server 2003, go to How to Connect to and Shadow the Console Session with Windows Server 2003 Terminal Services.

Windows Server 2008 and higher

The Console Session option connects you to the physical console session on the server. This option is the same as the /admin switch in Windows which replaced the deprecated /console switch. A maximum of two console sessions are allowed at the same time unless you have a Terminal Service license that allows additional concurrent console sessions.

• If Terminal Server is installed on your Windows server, but you do not have a valid Client Access license, you must select Console Session to remotely administer the server.
• If Terminal Server is not installed, you do not need to select this option to remotely administer the server.

For more information about console connections in Windows Server 2008 and higher, go to Changes to remote administration in Windows Server 2008.

17. To change the keyboard language, select an option from the Keyboard Language drop-down list.
18. Click the Display tab.

19. To change the color depth settings, select an option from the Color Depth drop-down list.
20. To change the Resize Method, from the drop-down list, select Automatic or Disabled. If you keep the default setting of Automatic, the session automatically resizes the RDP window smoothly.
    

Automatic resizing is only supported for Windows versions that support RDP 8.1. You must select Disabled if your operating system is a version prior to Windows 8.1 or Windows Server 2012 R2 without an RDP 8.1 update.

In Fireware v12.3.x or lower, to change the Resize Method, from the drop-down list, select Reconnect or Disabled. If you keep the default setting of Reconnect, the session automatically disconnects if the client display size changes and reconnects with the new display size.

1. Click Add.
   The Web Application or Application Group page appears.
2. From the Type drop-down list, select Host Desktop Access (RDP).
3. In the Name text box, type a name for the RDP connection.
4. In the Description text box, type a description of the RDP connection.
5. To select a custom icon for the application, select Custom Icon > Upload Custom Icon.
6. In the Host text box, type the IP address or domain name for the host to connect to.
7. To use a port other than 3389, type the number in the Port text box.

8. Click the User Authentication tab.

9. From the Security drop-down list, select Any, RDP, TLS, or NLA as the security protocol for the connection. Tip! When Any is selected, the Firebox negotiates the security protocol with the remote host.
10. To require users to specify a user name and password on the RDP login page, select Require users to specify credentials.
11. To specify and save a user name and password for the RDP connection, select Use these credentials.
12. If the RDP host has a self-signed certificate, and you trust the connection and the RDP host, you can select Trust Certificate.
13. Select View > Certificates > Import Certificate and select General Use.
14. Click the Session tab.

15. (Optional) In the Client Name text box, specify the name for the RDP host to use to identify the RDP client.
16. (Optional) To automatically launch a program when Windows starts, type the file path in the Initial Program text box. The operating system you connect to must support the Initial Program feature for this to work.
17. To connect to the console session, select Console Session. You must log in with an account that is a member of the Administrators group.Tip! When you connect to a console session, you see what would appear on a physical monitor attached to the server. In most cases, a console session is not required.

Windows Server 2003

The Console Session option connects you to the physical console session (session 0) on the Windows server. This option is the same as the /console switch in Windows. You can only connect to one console session at a time.

For more information about console connections in Windows Server 2003, go to How to Connect to and Shadow the Console Session with Windows Server 2003 Terminal Services.

Windows Server 2008 and higher

The Console Session option connects you to the physical console session on the server. This option is the same as the /admin switch in Windows that replaced the deprecated /console switch. A maximum of two console sessions are allowed at the same time unless you have a Terminal Service license that allows additional concurrent console sessions.

• If Terminal Server is installed on your Windows server, but you do not have a valid Client Access license, you must select Console Session to remotely administer the server.
• If Terminal Server is not installed, you do not need to select this option to remotely administer the server.

For more information about console connections in Windows Server 2008 and higher, go to Changes to remote administration in Windows Server 2008.

18. To change the keyboard language, select an option from the Keyboard Language drop-down list.
19. Click the Display tab.

20. To change the color depth settings, select an option from the Color Depth drop-down list.
21. To change the Resize Method, from the drop-down list, select Automatic, Reconnect, or Disabled. If you keep the default setting of Automatic, the session automatically resizes the RDP window smoothly.

Automatic resizing is only supported for Windows versions that support RDP 8.1. You must select Disabled if your operating system is a version prior to Windows 8.1 or Windows Server 2012 R2 without an RDP 8.1 update.

In Fireware v12.3.x or lower, to change the Resize Method, from the drop-down list, select Reconnect or Disabled. If you keep the default setting of Reconnect, the session automatically disconnects if the client display size changes and reconnects with the new display size.

• You must select the Any, NLA, or TLS security types.
• If you select TLS, you must change the Remote Settings in Windows so Allow connections only from computers running Remote Desktop with Network Level Authentication is not selected.
• We do not support the RDP security type because it requires a registry edit to change the security layer value. In Windows 10 and Windows Server 2016 or higher, the default security layer value is TLS.

• You can select the Any, NLA, TLS, or RDP security types.
• If you select the RDP security type, you must change the security layer value. When the Terminal Server role is installed, you can change the security layer value in the Windows GUI.

To change the security layer value, from Windows Server 2016, Windows Server 2019, and Windows Server 2022:

1. Open Server Manager.
2. Select Roles > Remote Desktop Services > RD Session Host Configuration > RDP-Tcp Properties.
3. Select the General tab.
4. From the Security layer drop-down list, select Negotiate.

You can select the Any, NLA, TLS, or RDP security types.

1. Click Add and select Host Shell Access (SSH).
   The Add SSH Application page appears.
2. In the Name text box, type a name for the SSH connection.
3. In the Description text box, type a description of the SSH connection.
4. To select a custom icon for the application, select Custom Icon > Choose File.
5. To remove a custom image that you added, select Reset Image.
6. In the Host text box, type the IP address or domain name for the host you connect to.
7. To use a port other than 22, type the number in the Port text box.
8. To require users to specify a user name and password on the RDP login page, select Require users to specify credentials.

9. To specify and save user credentials for the RDP connection, select Use these credentials.
   1. In the User Name text box, type a user name.
   2. To specify a passphrase, select Use this passphrase.

   

   3. To specify a private key, select Use this private key.
   4. If you specified a private key, in the Decryption Passphrase text box, type a decryption passphrase for the private key.

   

10. To change the display settings, select the Display tab.
11. From the Color Scheme drop-down list, select Black and white, Gray and black, Green and black, or White and black.
12. To change the font size, type a number in the Font Size text box.

1. Click Add.

2. From the Type drop-down list, select Host Shell Access (SSH).
3. In the Name text box, type a name for the SSH connection.
4. In the Description text box, type a description of the SSH connection.
5. To select a custom icon for the application, select Custom Icon > Upload Custom Icon.
6. In the Host text box, type the IP address or domain name for the host to connect to.
7. To use a port other than 22, type the number in the Port text box.
8. Click the User Authentication tab.
9. To require users to specify a user name and password on the RDP login page, select Require users to specify credentials.

10. To specify and save user credentials for the RDP connection, select Use these credentials.
    1. In the User Name text box, type a user name. 
    2. To specify a passphrase, select Use this passphrase. 
    3. To specify a private key, select Use this private key.  
    4. If you specified a private key, in the Decryption Passphrase text box, type a decryption passphrase for the private key. 
11. To change the display settings, click the Display tab.
12. From the Color Scheme drop-down list, select Black and white, Gray and black, Green and black, or White and black.
13. To change the font size, type a number in the Font Size text box.

1. On the Firebox, install a custom web server certificate.
2. Send the certificate file to the iOS device.
3. To install the certificate, open the file on the iOS device.
4. Select Settings > General > About > Certificate Trust Settings to make sure the certificate was installed.
5. Enable the certificate as a trusted root certificate.

1. On the Access Portal page, click the User Connection Settings tab.
2. To give all users and groups permission to connect to all applications, keep the default option selected, All applications are available to all users and groups authenticated with Access Portal.

To specify which users and groups can access which applications:

1. Select Specify the applications available to each user and group.
2. Click Add.
   The Add User or Group page appears.
3. From the Authentication Server drop-down list, select the authentication server where the user or group exists. Tip! You can specify a user defined in the local Firebox-DB authentication server on the Firebox. Or, you can specify a user that already exists on your third-party authentication server.
4. In the Type drop-down list, specify User or Group.
5. To specify a user or group that already exists on the authentication server, type the user name or group name in the Name text box.
6. To add a new user or group, type the user name or group name and click New User or New Group.
   If you specified the Firebox-DB authentication server, a Firebox User or Firebox Group dialog box appears.
   If you specified a third-party authentication server, the Add User or Group dialog box appears.
7. To configure the new user or group, follow the instructions in the Use Users and Groups in Policies topic.
8. In the Access Portal settings, on the Add User or Group page, select one or more application groups or applications.

9. Click OK.

1. In the Access Portal settings, click the User Connection Settings tab.
2. To give all users and groups permission to connect to all applications, keep the default option selected, All applications are available to all users and groups authenticated with the Access Portal.

To specify which users and groups can access which applications:

1. Select Specify the applications available to each user and group.
2. Click Add.
   The Add User or Group dialog box appears.
3. To add a user or group, click Add and follow the instructions in the Use Users and Groups in Policies topic.
4. In the Access Portal settings, on the Add a User or Group page, select a user or group name from the Name drop-down list.
5. Select one or more application groups or applications.

6. Click OK.

1. In the Access Portal settings, click the User Connection Settings tab.
2. In the Authentication Servers section, select a server from the drop-down list.
3. Click Add.



4. Repeat these steps to add more authentication servers.
5. Click Move Up or Move Down to reorder the list. The first authentication server in the list is the default server for users.

In Fireware v12.4 or higher, users only need to type their user name to log in with the default authentication server. To log in with a different authentication server, users must type the domain name and the user name in this format: <domain name>\<user name>.

1. Select Subscription Services > Access Portal.
2. Click the User Connection Settings tab.
3. In the Authentication Servers section, select a server from the drop-down list.



4. Click Add.
5. Repeat these steps to add more authentication servers.
6. Click Up or Down to reorder the list. The first authentication server in the list is the default server for users.

In Fireware v12.4 or higher, users only need to type their user name to log in with the default authentication server. To log in with a different authentication server, users must type the domain name and the user name in this format: <domain name>\<user name>.

1. Select Subscription Services > Access Portal.
2. Click the User Connection Settings tab.
3. In the Access Portal Port text box, type a port number.
   If Mobile VPN with SSL is enabled, and you change the Access Portal Port, the Configuration Channel in the Mobile VPN with SSL configuration is changed to the same port.

If you cannot edit the Access Portal port, another SSL/TLS Firebox feature is enabled that shares this port setting. For more information, go to SSL/TLS Settings Precedence and Inheritance.

1. Select Subscription Services > Access Portal.
2. Click the User Connection Settings tab.
3. In the Access Portal Port text box, type a port number.
   If Mobile VPN with SSL is enabled, and you change the Access Portal Port, the Configuration Channel in the Mobile VPN with SSL configuration is changed to the same port.

If you cannot edit the Access Portal port, another SSL/TLS Firebox feature is enabled that shares this port setting. For more information, go to SSL/TLS Settings Precedence and Inheritance.