Limitations and Precautions for SSL VPN

Hardware Requirements

USG6510E/6510E-POE/6530E do not support web proxy, file sharing, and port forwarding.

The SSL VPN function is supported by all models.

License Requirements

Concurrent SSL VPN users is license-controlled.

SSL VPN Gateway

• The SecoClient that supports this version has no longer evolved and cannot be downloaded from the Huawei Support website. The downloaded SecoClient can still be used. SecoClient configuration examples and common configuration problems are retained in the document. When users need to use the SSL VPN function through client access, see : VPN Client Download Description.
• SSL VPN does not support IPv6.
• After loading or changing the license, configuration of the maximum number of concurrent users is deleted from the device, and the administrator must configure the number again.
• When a remote user uses the Windows 7, Windows 8.1, or Windows 2012 operating systems to access the SSL VPN virtual gateway, the system prompts the user to restart the computer. This is normal, and the user needs to save the operations and then restart the computer.
• When SSL VPN uses RADIUS server authentication, the user name configured on the RADIUS server can not contain an at sign (@).
• SSL VPN users do not support if-authenticated authorization.
• If certificate-anonymous or certificate-challenge authentication is implemented for users, the client certificate needs to be installed on the client browser. The client certificate must be in .p12, .pem (including a key), or .pfx format.
• SSL VPN supports only TLS 1.0, TLS 1.1, and TLS 1.2. To use the Internet Explorer to log in to a virtual gateway, ensure that the SSL protocol set in the Internet Explorer is supported by SSL VPN. Otherwise, an exception may occur. For example, if SSL2.0 is set in the Internet Explorer and certificate-anonymous authentication is used for login to the virtual gateway, the virtual gateway will display "Your certificate is invalid. Provide a valid certificate".
• You are advised to upload the local certificate of the FW on the Network > SSL VPN > Public Configuration page in advance. The Internal name and commonName fields of the local certificate are the VPN gateway IP address that provides VPN services externally. When configuring the virtual gateway, select the client CA certificate that can be used to verify the local certificate. Otherwise, when a user logs in to the virtual gateway, the system displays a message indicating that the host name in the security certificate of the website is different from that of the website that the user is attempting to access. For details about how to create a certificate, see How Can I Clear the Alarm "Your certificate of calibration is illegal, continue to log in?".
• SSL VPN is not supported in the load-balancing networking.
• When the FW is deployed on the intranet and a NAT device is deployed externally to the FW, and if the SSL VPN network extension service is used, the SSL VPN tunnel can be established only in reliable transmission mode. To establish an SSL VPN tunnel in fast transmission mode, perform the following operations:
  • On the NAT device, configure NAT Server mapping for the TCP and UDP ports of the SSL VPN virtual gateway. When NAT mapping is performed for UDP ports, the Global port must be the same as the Inside port.
  • On the FW, configure a security policy to permit data traffic destined for the TCP and UDP ports of the virtual gateway.
• When the virtual gateway and DNS server reside in different virtual systems and if you configure the DNS resolution function, also configure the source NAT policy in Easy IP mode to translate the source IP address of the DNS request packet into the IP address of the Virtual-if interface on the virtual system where the virtual gateway resides. In this way, the DNS resolution function across virtual systems is implemented.
• The FW is configured with both the SSL VPN network extension and AD SSO functions. After an SSL VPN user logs in, network extension is enabled. Then another account is used to remotely log in to the AD server through network extension. In this case, two online user entries are generated on the FW, one for the SSL VPN user and the other for the AD SSO user. The two users have the same IP address, which is the virtual IP address delivered by the network extension function. As a result, the online SSL VPN user who goes online first is logged out.

Third-Party Server Authorization

If a third-party server is used to authorize an SSL VPN user, the user group is matched as follows:

1. If the user already exists locally, the local user group takes effect on authorization.
2. If the user does not exist locally, check whether New User Authentication Options is configured.
   1. New User Authentication Options is not configured.

      The user group configured on the authorization server takes effect on authorization.

   2. New User Authentication Options is configured.
      • If Prohibit new user login is selected, the user login request is rejected, and the authorization process is terminated.
      • If Add new users to a user group or security groupis selected, the specified user group takes effect on authorization.
      • If Consider new users as temporary users and do not add them to the local user list is selected, the specified user group takes effect on authorization.

Supported Operating Systems and Browsers

Table 1 lists the operating systems and browsers supported by the SSL VPN feature.

When you log in to the SSL VPN gateway using a browser for the first time, you need to install the ActiveX control as prompted. The ActiveX control is integrated in the patch file of the SSL VPN client, except the USG6610E/6620E, USG6630E/6650E, USG6680E and USG6712E/6716E. The administrator needs to obtain the patch file and load it to the device through the SSL VPN client patch upgrade function. For details, see Installing the ActiveX Control.