PSEG SSL VPN USER GUIDE - docshare03.docshare.tipsdocshare03.docshare.tips/files/23708/237080779.pdf · Electronic Forms ProRad (NBU only) Information Central PSEG Applications Online

PSEG SSL VPN USER GUIDEFOR NON-CORPORATE PCs (Windows 7, Vista, XP, and MAC OS X)

TABLE OF CONTENTS

QUICK CONNECT TO SSL VPN.............................................................................................................................. 1Connect to SSL VPN......................................................................................................................................... 1Disconnect from SSL VPN................................................................................................................................ 1

FIRST TIME USER SETUP...................................................................................................................................... 2Connect to SSL VPN......................................................................................................................................... 2Disconnect from SSL VPN Workplace Portal....................................................................................................6

PSEG TERMINAL SERVER..................................................................................................................................... 7Saving Your Work on Terminal Server...............................................................................................................7Printing.............................................................................................................................................................. 9Disconnecting and Reconnecting...................................................................................................................... 9Terminal Server Availability................................................................................................................................ 9

SETUP YOUR RSA SECURID TOKEN..................................................................................................................10

MOBILE ACCESS SUPPORT................................................................................................................................ 12Who to Call About Technical Problems............................................................................................................12Troubleshooting Common SSL VPN Errors.....................................................................................................12Internet Usage During VPN Sessions.............................................................................................................14Mobile Access Website.................................................................................................................................... 14

ENTERPRISE SECURITY POLICIES....................................................................................................................15Access Security............................................................................................................................................... 15Monitoring........................................................................................................................................................ 15Security Hardware / Software.......................................................................................................................... 15Individual Responsibilities............................................................................................................................... 16

SSL VPN GUIDE – Non-Corporate PC -PSEG Internal Use Only- Page 0 of 17

QUICK CONNECT TO SSL VPN

If this is your first time using SSL VPN or if you are using SSL VPN on a new computer, go to the First Time User Setup section of this document.

Connect to SSL VPN

1. Open Internet Explorer (Recommended for Windows) or Safari (Mac OS).

2. Go to https://ra.pseg.com.

3. Type your LAN ID and Passcode (PIN + token code) in the appropriate boxes.

4. Click the Log In button.

5. When successfully logged in, the SSL VPN Workplace portal screen will appear.

6. Click on the PSEG Enterprise Terminal Server or PSEG NBU Terminal Server link.

7. Logon to the PSEG Enterprise Terminal Server or PSEG NBU Terminal Server with your LAN ID and password.

Do not close this window -PSEG SSL VPN Workplace

If you close this browser window, yourVPN connection will be disconnected.

Disconnect from SSL VPN

1. Log off PSEG Enterprise Terminal Server or PSEG NBU Terminal Server.

2. Click Log Off link on SSL VPN Workplace portal screen.

3. Close Browser.


https://ra.pseg.com/

FIRST TIME USER SETUP

If this is your first time using SSL VPN or if you are using SSL VPN on a new computer, follow these instructions

Note for Windows XP Users only:

Required: If you have previously used the PSEG Extranet Access client on your PC, you will need to remove the Citrix Terminal Server client software. Using Add/Remove Programs in your Control Panel locate PSEG Enterprise Terminal Server Client or PSEG ICA Client and select Remove.

Optional: Although it will not affect your ability to use SSL VPN and it is no longer required, you can remove the PSEG Extranet Access Client using the Add/Remove Programs in your Control Panel. Locate PSEG Extranet Access client and choose Remove.

Connect to SSL VPN

1. Connect to the Internet. (You can connect using Cable, DSL, Dial-up or Wireless Hot Spots.)

2. Open Internet Explorer (Recommended for Windows) or Safari (Mac OS).

3. Go to https://ra.pseg.com.

4. Type your LAN ID and Passcode (PIN + token code) in the corresponding text boxes.

New RSA SecurID Tokens:If you have a new RSA SecurID Token and have not yet setup a PIN number for it, go to the RSA SecurID Token Setup section of this document first. Then, return to this step.


6. When prompted, click Install to install the Aventail Access Manager. (Shown on next page)


https://ra.pseg.com/

7. Click Open/Run on Security Warning screen(s) to allow Aventail Access Manager to install completely.

Windows 7 / Vista Users: Click the “More options” button on the 2nd Security Warning screen and select “Always run software from SonicWall Inc” and click Run.

Allow access for Aventail programs (epMSIBootstrapper.exe):If you have security software such as Norton, ZoneAlarm or MacAfee installed on your computer, you may be prompted to allow access to the Internet for some Aventail files such as epMsiBootstrapper.exe. This is expected and you should allow these programs to access the Internet. Tip: If you have an option to “Remember this Setting” or “Always Allow,” choose this option so you will not be prompted in the future for this program.

8. Windows 7 / Vista Users:a. If prompted, click Close on the Information Bar message dialog box.b. Click the Information Bar at the top of browser screenc. Select Run Active X Control or Run Add-On on All Websitesd. Click Run on Security Warning screen to allow End-Point Interrogator to Rune. If prompted, check the “Do not show me the warning for this program again” checkbox

and Click Allow button on each warning message.

9. If the Aventail Access Manager installation hangs or fails to install, Enable User Account Control (recommended practice, see Mobile Access support section for steps) or upgrade Java to version 1.6 or higher.

10. Click on the Home User Install link. (Shown on next page)


11. Click Open/Run or Yes on the Security Warning screen(s) to allow the Home User Install to complete.

12. Windows 7 / Vista Users: Click Allow/Yes on the User Access Control screen and minimize SSL VPN Workplace screen.

13. Click OK on the PSEG VPN Home Installation screen.

14. Windows 7 / Vista Users: If prompted, click “This program installed correctly”

15. Close Internet Explorer.

16. Log back into the SSL VPN Workplace portal. (Perform Steps 2-5 above.)

17. Aventail’s Cache Control applet will now attempt to launch.

18. Windows 7 / Vista Users:a. If prompted, click Close on the Information Bar message dialog box.b. Click the Information Bar at the top of browser screenc. Select Run Active X Control or Run Add-On on All Websitesd. Click Run on Security Warning screen to allow SodaAgent Module to Rune. Check the “Do not show me the warning for this program again” checkbox and Click

Allow button on each warning messagef. If prompted, click Close on the Information Bar message dialog box.g. Click the Information Bar at the top of browser screenh. Select Run Active X Control or Run Add-On on All Websitesi. Click Run on Security Warning screen to allow Extraweb Proxy Client Agent to Runj. If prompted, check the “Do not show me the warning for this program again” checkbox

and Click Allow button on each warning message

Allow access for Aventail programs (ewpca.exe):If you have security software such as Norton, ZoneAlarm or MacAfee installed on your computer, you may be prompted to allow access to the Internet for some Aventail files such as ewpca.exe. This is expected and you should allow these programs to access the Internet. Tip: If you have an option to Remember Setting or Always Allow choose this option so you will not be prompted in the future for this program.


19. Once logged in, you will see the SSL VPN Workplace portal screen (See below).

Do not close this window -PSEG SSL VPN Workplace

If you close this browser window, yourVPN connection will be disconnected.

20. Click on the PSEG Enterprise Terminal Server or PSEG NBU Terminal Server link.

21. If the terminal server links are not active or if the SSL VPN Workplace hangs on the Loading screen, your software firewall is blocking a necessary Aventail file (ewpca.exe). Close the Loading screen andlogout of the SSL VPN Workplace and go back to Step 15.

22. Windows 7 / Vista Users:

a. If prompted, click Close on the Information Bar message dialog box.b. Click the Information Bar at the top of browser screenc. If presented, select Install This Add-on for All Users of this Computer d. Highlight Add-on Disabled then Select Run Active X Control or Run Add-on on All

Websitese. Click Run on Security Warning screen to allow Aventail Citrix Adapter to Runf. Click the Information Bar at the top of browser screeng. When prompted for Intranet Settings, select Do not Show this Message Again.h. Within 5-10 seconds, Installing Citrix ICA Client window will be displayed.i. If prompted, click Close on the Information Bar message dialog box.j. Click the Information Bar at the top of browser screenk. Wait until Information Bar starts to blink then Click Information Bar again.l. Select Install Active X Control or Install This Add-on for All Users of this Computerm. Installing Citrix ICA Client window will displayed again.n. If prompted, click Yes to allow install of Citrix Web Client.o. If prompted, click Close on the Information Bar message dialog box.p. Click the Information Bar at the top of browser screenq. Select Run Active X Control or Run Add-on on All Websitesr. Click Run on Security Warning screen to allow Citrix ICA Client Object to Runs. Click Yes to license agreement. Note: This prompt maybe hidden behind the Internet

Explorer window. Minimize Internet Explorer if necessary to click Yes then maximize Internet Explorer window.

t. Check the “Do not show me the warning for this program again” checkbox and Click Allow button on each warning message


23. Non-Windows 7 / Vista Users: If a previous version of the Citrix ICA Client is not detected, it will begin to install. After completion of the Citrix ICA Client, Click Yes to the license agreement.

Allow access for Citrix programs (wfica32.exe):If you have security software such as Norton, ZoneAlarm or MacAfee installed on your computer, you may be prompted to allow access to the Internet for some Citrix files such as wfica32.3xe. Thisis expected and you should allow these programs to access the Internet. Tip: If you have an option to Remember Setting or Always Allow choose this option so you will not be prompted in the future for this program.

Allow access for Aventail programs (ewpca.exe):If you have security software such as Norton, ZoneAlarm or MacAfee installed on your computer, you may be prompted to allow access to the Internet for some Aventail files such as ewpca.exe. This is expected and you should allow these programs to access the Internet. Tip: If you have an option to Remember Setting or Always Allow choose this option so you will not be prompted in the future for this program.

24. Click OK to the Public Service Enterprise Group security message.

25. Type your PSEG LAN ID and password in the corresponding text boxes and click OK.

26. Work within the Terminal Server window to access your network drives, PSEG applications, and e-mail.

Be Careful Saving Documents in PSEG Terminal Server:If you have not used terminal server before, read through the PSEG Terminal Server section below. There is important information about how to save work, print, and disconnect from terminal server.

Disconnect from SSL VPN Workplace Portal

1. When you are finished working, logoff Enterprise Terminal Server.

2. Click Log Off link on SSL VPN Workplace portal screen.

3. Close Browser.


PSEG TERMINAL SERVER

Terminal Server allows PSEG mobile users to access corporate applications. The following applications are available through Terminal Server:

PSEG TERMINAL SERVER APPLICATIONS

Microsoft Outlook IWMSMicrosoft Word RemedyMicrosoft PowerPoint DM-Net (NBU only)Microsoft Excel INSS (NBU only)Lotus Notes ITTS (NBU only)Electronic Forms ProRad (NBU only)Information CentralPSEG Applications Online (SAP, IDS,etc)

The Terminal Server is described in the following sections:

Saving Your Work Printing Disconnecting and Reconnecting Terminal Server Availability

Saving Your Work on Terminal ServerPSEG Terminal Server connects your local computer’s C and D drives to the U and V drives within the Terminal Server screen. It is important to remember this when saving a document or other work within theTerminal Server screen to avoid saving sensitive information to the terminal server’s C and D drives, which other users can view, instead of your personal C and D drives.

Location of Local DrivesOn Terminal Server, your computer’s local drives will be the following:

The drive labeled C$ on ‘Client’ (V:) is your local C: drive. The drive labeled D$ on ‘Client’ (U:) is your local D: drive. The drive labeled E$ on ‘Client’ (T:) is your local E: drive.

Be aware of the following when saving on Terminal Server: For sensitive or personal information, save it to your P drive so others cannot access it.

Double-check that your work saved to where you intended it to be saved. Call IT Help Desk if it did not, so that IT can recover it for you.

By default, the save location on a Terminal Server is your P drive. However, if your P drive is full or unavailable, the terminal server will not default to your P drive.

Below is an example of the Save As window that appears when you attempt to save a file. To see this window on a Terminal Server:

1. Open a Word or Excel document.2. Click on the File menu and select Save As… 3. Click on the Save in: box dropdown arrow to select the location to save your file.

Save documents to the U and V drive that you can access from your home computer when


not connected to VPN. Be aware that these documents are not backed up.

Example of which local drives are safe to save to and which are not in Terminal Server.

When you logon to Terminal Server, your P drive will be checked to verify that it is connected and is not full. If it is not connected, you will receive the following message soon after logon:

If your P drive is full, you will receive this message soon after logon:


PrintingTerminal Server will attempt to connect your local printer when you logon. If it is unable to connect to a compatible printer, Microsoft Office products may not work properly. For example, Outlook may freeze when opening an attachment or Word may quit when printing. Follow the instructions below to designate a valid default printer.

Using Your Home Computer to PrintYou may be able to print to your home printer if you designate it as the default printer prior to connecting to TS as follows:

1. Click on the Start button on your desktop.2. Click on Settings, then Printers.3. Click on your home printer. 4. Click on the File menu Set as Default Printer.

Problems Using Your Home Computer to PrintDue to printer driver compatibility issues, TS does not support all printers. If your home printer does not appear you will not be able to print from home.

Disconnecting and ReconnectingIf you are disconnected from Terminal Server for any reason and have not logged off:

You will have 30 minutes to log back on and continue where you left off. This is called a “disconnect”.

All open applications and data will remain in stasis until you log back on or the time limit expires.

Once 30 minutes has passed, the session will be closed and any unsaved data will be lost.

Your session is active when you type or move the mouse. After 45 minutes of inactivity, the session will be disconnected. This is called the “idle time disconnect”.

Terminal Server AvailabilityPSEG Terminal Server is available:

23 ½ hours a day, 7 days a week.

Every morning between 2:30 a.m. and 4:00 a.m. Eastern Time, the Terminal servers will be backed up and taken offline for routine maintenance.

The servers are taken offline one-at-a-time so that users can continue to access Terminal Server. If you are on the system during that time and receive an outage message, simply log off of your Terminal Server session and log back on. The system will log you onto a server that is still online. If you do not log off upon receiving the outage message, your opensessions will be closed and any unsaved data will be lost.


SETUP YOUR RSA SECURID TOKEN

If you have a new RSA SecurID token, you must first create a PIN number to be used in conjunction with the token. Follow these instructions to create a PIN.

1. Type your LAN ID in the Username box.

2. Type the token code that is currently displayed on your RSA SecurID Token in the Enter PASSCODE box.


4. Think of a PIN number that is between 4–8 characters, numbers and/or letters only, no special characters.Type your PIN in the box and click OK.

5. You will now be prompted to confirm your PIN. Re-enter the PIN you created in the previous step and click OK.


6. Wait for the token code on your token to change to a new number. Type your PIN followed by the newtoken number (no spaces) in the box. Click OK.

7. If the logon is successful, you will see the screen below. Go to step 6 in the “First Time User Setup” section of this document and continue with the SSL VPN setup.


MOBILE ACCESS SUPPORT

Mobile Access information is described in the following sections:

Who to call about Technical Problems Troubleshooting Internet Usage during VPN sessions Mobile Access Website

Who to Call About Technical ProblemsIf you are having technical problems with any application after connecting to VPN, call:

PSEG IT Client Services at 1-877-430-7500, Option 1

PSEG IT Client Services cannot support the mobile access user’s connection to the Internet. If you are not able to browse the Internet, you have not successfully connected to your Internet Service Provider (ISP). You will need to call your ISP for help. Please do not call the PSEG help desk until you have resolved the problem with your ISP.

Troubleshooting Common SSL VPN ErrorsListed below are common VPN errors with descriptions of the problem:

ERROR MESSAGE SOLUTION

Link for PSEG Enterprise or NBU Terminal Serverdoes not function and you are directed back to the

SSL VPN Workplace login screen.

Internet Explorer 81. Start Internet Explorer2. Click Tools3. Select Internet Options4. Click Advanced tab5. Click Reset Internet Explorer

Settings6. Click Reset7. Do Not Check Delete Personal

Settings8. Click Reset button9. Close Internet Explorer10. Login to SSL VPN Workplace11. Follow 1st Time User Setup Steps

No Java FoundInstall latest version of Java http://www.java.com/en/download/manual.jsp


http://www.java.com/en/download/manual.jsp


“Error - Cannot run applet successfully.”

Old Version of JavaUpgrade to newer version of Java. http://www.java.com/en/download/manual.jsp

Link for PSEG Enterprise or NBU Terminal Serverdoes not function or you are directed to the Citrix

website to upgrade your Citrix client.

Old Citrix clientUninstall previous version of Citrix client. Client will be listed as PSEG Enterprise Terminal Server Client or PSEG ICA Client in Add/Remove Programs. Once the client has been uninstalled reconnect to PSEG SSL VPN. A new client will be installed on your Home PC via the SSL VPN website.

Aventail Installation Manager hangs or fails toinstall

Enable User Access ControlClick Start->Control Panel->User Accounts->User Accounts->Turn User Account Control on or off. Select On and reboot as instructed.

Or

Upgrade Java to version 1.6 or higherhttp://www.java.com/en/download/manual.jsp

“Unable to contact the Metaframe server browser.”No VPN Connection when Connecting to Terminal ServerThe PSEG VPN Client must be connected before attempting to start the PSEG Enterprise Terminal Server. Connect to the PSEG VPN Client. Then click on the Terminal Server icon.

“The connection to the Citrix server was interrupted.” Terminal Server Session Disconnected unexpectedlyThis error is caused by a lost Internet connection, a lost VPN connection, or a system logoff due to inactivity (30 minutesor more). Check the Internet and VPN connections. If this error appears frequently within an hour, call IT Client Services for support.






Terminal Server Connection Screen HangsSome firewalls will prevent access from your PC to PSEG’s network and not notify you that it is blocking access. This problemreadily occurs on PCs that have CA Security Suite installed. Below are the instructions necessary to get CA Security Suite to work with Aventail SSL VPN. Other firewalls have similar interfaces so you may be able to perform similar steps as below with your firewall.

1. Open CA Security Center2. Click on Advanced Settings in the

SA Firewall section3. Click on Safeguard4. Click on the Program Control tab5. Click Add6. Browse to c:\program

files\citrix\icaweb32\wfica32.exe7. Click OK8. Select wfica32.exe in list of

programs and choose Edit9. Check the box called Trusted in the

Program Group Assignment section at the bottom

10. Click OK11. Close CA Firewall screen12. Close CA Security Center13. Login to SSL VPN as usual14. Try PSEG Enterprise Terminal Server

link

Internet Usage During VPN SessionsOnce remote users have made the VPN connection, they will not be allowed to surf the Internet. This is to prevent viruses and hackers from getting into the PSEG Network. While the VPN connection is active, PSEG will be able to monitor any network and Internet activity on your machine. Internet surfing is strictly prohibited while the VPN connection is active .

Mobile Access WebsiteGo to the Mobile Access website, at any time for more detailed information about VPN: http://infocentral.pseg.com/mobile_access


http://infocentral.pseg.com/mobile_access

ENTERPRISE SECURITY POLICIES

Enterprise Security Policies are described in the following sections:

Access Security Monitoring Security Hardware/Software Individual Responsibilities

Access SecurityPSEG Terminal Server is designed to provide easy access to Enterprise applications and network services. However, although this service provides transparent access to network-based information and services, PSEG information security practices still need to be adhered to while using this service.This mobile access service is a corporate resource and is restricted to business use only.

Maintaining the integrity of PSEG’s Network, systems and data is extremely important. IT has implemented multiple levels of security associated with this mobile access service. Use the following guidelines:

Remember your User Identification Code and Password to access this service is the same as your LAN ID and Password.

Do not share this information or write it down in an obvious location (e.g., post-it note attached to the computer or monitor). Your LAN ID and Password, if compromised, will allowan unauthorized individual to obtain access to those resources to which you have access and potentially to additional corporate resources.

Should an unauthorized individual gain access to the Enterprise Network, Enterprise data and systems can be compromised.

If you suspect that someone may have compromised your id and password, notify the Client Service Center immediately so appropriate action can be taken.


MonitoringUse of this service is subject to monitoring to ensure compliance with Enterprise security practices as detailed in Manuals Connection on Information Central. The security associated with this service will allow IT to trace what machine gained entry, what data was accessed, and even the originating telephone number for the call or ISP network address initiating the VPN connection.

Security Hardware / SoftwareTo protect your computer and PSEG information from viruses and hacking, PSEG recommends security hardware for laptop users with a cable or DSL modem connected to their docking station. Any security hardware device may be used as long as it is IPSec-compatible and has a built-in firewall. The following security hardware devices are recommended (but not supported by PSEG IT as they are intended for home networks):

SMC Barricade 4-Port Cable/DSL Router (SMC7004ABR)


This hardware device is used with Cable and DSL modems. It acts as a home network router and firewall. It is best if used in conjunction with a software firewall.

Linksys Wireless G Broadband Router (WRT54G)This hardware device is used with Cable and DSL modems. It acts as a wireless home network router and firewall. It is best if used in conjunction with a software firewall.

For more information about ordering and installing these products, go to the Mobile Access Website, http://www.informationcentral.pseg.com/corporate/it/service_center/it_client_services/mobile_access/mobile_access.jsp.

Individual ResponsibilitiesUser identification codes and passwords are for the exclusive use of designated users and are not to be shared. In particular, users of the TS need to follow the security practices detailed in the following Enterprise Practices1:

Enterprise Practice Number

Enterprise Practice Name

282-1 Internet Usage

282-2 Electronic Mail Usage

282-3 Password Use

282-4 Understanding Information Security

282-5 Information Security Classification, Labeling and Handling

282-6 Information Sharing Practice – External Third Parties

282-7 Personal Computer Protection Practice

282-8 Personal Computer Backup Practice

282-9 Anti-Virus Practice and Responsibilities

If you experience password difficulties, call the Client Service Center for assistance.


These practices are to be adhered to even if the device being used to access the TS is a home PC. In particular, logon passwords must not be saved or scripted into the logon process. Doing this can enable any user of that device, including unauthorized users, direct access to the Enterprise Network.

Keep in mind that information security is everyone’s responsibility!

1 Standards are documented on Information Central in Manuals Connection


http://www.informationcentral.pseg.com/corporate/it/service_center/it_client_services/mobile_access/mobile_access.jsp

http://www.informationcentral.pseg.com/corporate/it/service_center/it_client_services/mobile_access/mobile_access.jsp