PSEG SSL VPN USER GUIDE FOR NON-CORPORATE PCs (Windows 7, Vista, XP, and MAC OS X) TABLE OF CONTENTS QUICK CONNECT TO SSL VPN... 1 Connect to SSL VPN... 1 Disconnect from SSL VPN... 1 FIRST TIME USER SETUP... 2 Connect to SSL VPN... 2 Disconnect from SSL VPN Workplace Portal... 6 PSEG TERMINAL SERVER... 7 Saving Your Work on Terminal Server... 7 Printing... 9 Disconnecting and Reconnecting... 9 Terminal Server Availability... 9 SETUP YOUR RSA SECURID TOKEN... 10 MOBILE ACCESS SUPPORT... 12 Who to Call About Technical Problems... 12 Troubleshooting Common SSL VPN Errors... 12 Internet Usage During VPN Sessions... 14 Mobile Access Website... 14 ENTERPRISE SECURITY POLICIES... 15 Access Security... 15 Monitoring... 15 Security Hardware / Software... 15 Individual Responsibilities... 16 Page 0 of 17
QUICK CONNECT TO SSL VPN If this is your first time using SSL VPN or if you are using SSL VPN on a new computer, go to the First Time User Setup section of this document. Connect to SSL VPN 1. Open Internet Explorer (Recommended for Windows) or Safari (Mac OS). 2. Go to https://ra.pseg.com. 3. Type your LAN ID and Passcode (PIN + token code) in the appropriate boxes. 4. Click the Log In button. 5. When successfully logged in, the SSL VPN Workplace portal screen will appear. 6. Click on the PSEG Enterprise Terminal Server or PSEG NBU Terminal Server link. 7. Logon to the PSEG Enterprise Terminal Server or PSEG NBU Terminal Server with your LAN ID and password. Do not close this window PSEG SSL VPN Workplace If you close this browser window, your VPN connection will be disconnected. Disconnect from SSL VPN 1. Log off PSEG Enterprise Terminal Server or PSEG NBU Terminal Server. 2. Click Log Off link on SSL VPN Workplace portal screen. 3. Close Browser. Page 1 of 17
FIRST TIME USER SETUP If this is your first time using SSL VPN or if you are using SSL VPN on a new computer, follow these instructions Note for Windows XP Users only: Required: If you have previously used the PSEG Extranet Access client on your PC, you will need to remove the Citrix Terminal Server client software. Using Add/Remove Programs in your Control Panel locate PSEG Enterprise Terminal Server Client or PSEG ICA Client and select Remove. Optional: Although it will not affect your ability to use SSL VPN and it is no longer required, you can remove the PSEG Extranet Access Client using the Add/Remove Programs in your Control Panel. Locate PSEG Extranet Access client and choose Remove. Connect to SSL VPN 1. Connect to the Internet. (You can connect using Cable, DSL, Dial-up or Wireless Hot Spots.) 2. Open Internet Explorer (Recommended for Windows) or Safari (Mac OS). 3. Go to https://ra.pseg.com. 4. Type your LAN ID and Passcode (PIN + token code) in the corresponding text boxes. New RSA SecurID Tokens: If you have a new RSA SecurID Token and have not yet setup a PIN number for it, go to the RSA SecurID Token Setup section of this document first. Then, return to this step. 5. Click the Log In button. 6. When prompted, click Install to install the Aventail Access Manager. (Shown on next page) Page 2 of 17
7. Click Open/Run on Security Warning screen(s) to allow Aventail Access Manager to install completely. Windows 7 / Vista Users: Click the More options button on the 2nd Security Warning screen and select Always run software from SonicWall Inc and click Run. Allow access for Aventail programs (epmsibootstrapper.exe): If you have security software such as Norton, ZoneAlarm or MacAfee installed on your computer, you may be prompted to allow access to the Internet for some Aventail files such as epmsibootstrapper.exe. This is expected and you should allow these programs to access the Internet. Tip: If you have an option to Remember this Setting or Always Allow, choose this option so you will not be prompted in the future for this program. 8. Windows 7 / Vista Users: a. If prompted, click Close on the Information Bar message dialog box. b. Click the Information Bar at the top of browser screen c. Select Run Active X Control or Run Add-On on All Websites d. Click Run on Security Warning screen to allow End-Point Interrogator to Run e. If prompted, check the Do not show me the warning for this program again checkbox and Click Allow button on each warning message. 9. If the Aventail Access Manager installation hangs or fails to install, Enable User Account Control (recommended practice, see Mobile Access support section for steps) or upgrade Java to version 1.6 or higher. 10. Click on the Home User Install link. (Shown on next page) Page 3 of 17
11. Click Open/Run or Yes on the Security Warning screen(s) to allow the Home User Install to complete. 12. Windows 7 / Vista Users: Click Allow/Yes on the User Access Control screen and minimize SSL VPN Workplace screen. 13. Click OK on the PSEG VPN Home Installation screen. 14. Windows 7 / Vista Users: If prompted, click This program installed correctly 15. Close Internet Explorer. 16. Log back into the SSL VPN Workplace portal. (Perform Steps 2-5 above.) 17. Aventail s Cache Control applet will now attempt to launch. 18. Windows 7 / Vista Users: a. If prompted, click Close on the Information Bar message dialog box. b. Click the Information Bar at the top of browser screen c. Select Run Active X Control or Run Add-On on All Websites d. Click Run on Security Warning screen to allow SodaAgent Module to Run e. Check the Do not show me the warning for this program again checkbox and Click Allow button on each warning message f. If prompted, click Close on the Information Bar message dialog box. g. Click the Information Bar at the top of browser screen h. Select Run Active X Control or Run Add-On on All Websites i. Click Run on Security Warning screen to allow Extraweb Proxy Client Agent to Run j. If prompted, check the Do not show me the warning for this program again checkbox and Click Allow button on each warning message Allow access for Aventail programs (ewpca.exe): If you have security software such as Norton, ZoneAlarm or MacAfee installed on your computer, you may be prompted to allow access to the Internet for some Aventail files such as ewpca.exe. This is expected and you should allow these programs to access the Internet. Tip: If you have an option to Remember Setting or Always Allow choose this option so you will not be prompted in the future for this program. Page 4 of 17
19. Once logged in, you will see the SSL VPN Workplace portal screen (See below). Do not close this window PSEG SSL VPN Workplace If you close this browser window, your VPN connection will be disconnected. 20. Click on the PSEG Enterprise Terminal Server or PSEG NBU Terminal Server link. 21. If the terminal server links are not active or if the SSL VPN Workplace hangs on the Loading screen, your software firewall is blocking a necessary Aventail file (ewpca.exe). Close the Loading screen and logout of the SSL VPN Workplace and go back to Step 15. 22. Windows 7 / Vista Users: a. b. c. d. e. f. g. h. i. j. k. l. m. n. o. p. q. r. s. t. If prompted, click Close on the Information Bar message dialog box. Click the Information Bar at the top of browser screen If presented, select Install This Add-on for All Users of this Computer Highlight Add-on Disabled then Select Run Active X Control or Run Add-on on All Websites Click Run on Security Warning screen to allow Aventail Citrix Adapter to Run Click the Information Bar at the top of browser screen When prompted for Intranet Settings, select Do not Show this Message Again. Within 5-10 seconds, Installing Citrix ICA Client window will be displayed. If prompted, click Close on the Information Bar message dialog box. Click the Information Bar at the top of browser screen Wait until Information Bar starts to blink then Click Information Bar again. Select Install Active X Control or Install This Add-on for All Users of this Computer Installing Citrix ICA Client window will displayed again. If prompted, click Yes to allow install of Citrix Web Client. If prompted, click Close on the Information Bar message dialog box. Click the Information Bar at the top of browser screen Select Run Active X Control or Run Add-on on All Websites Click Run on Security Warning screen to allow Citrix ICA Client Object to Run Click Yes to license agreement. Note: This prompt maybe hidden behind the Internet Explorer window. Minimize Internet Explorer if necessary to click Yes then maximize Internet Explorer window. Check the Do not show me the warning for this program again checkbox and Click Allow button on each warning message Page 5 of 17
23. Non-Windows 7 / Vista Users: If a previous version of the Citrix ICA Client is not detected, it will begin to install. After completion of the Citrix ICA Client, Click Yes to the license agreement. Allow access for Citrix programs (wfica32.exe): If you have security software such as Norton, ZoneAlarm or MacAfee installed on your computer, you may be prompted to allow access to the Internet for some Citrix files such as wfica32.3xe. This is expected and you should allow these programs to access the Internet. Tip: If you have an option to Remember Setting or Always Allow choose this option so you will not be prompted in the future for this program. Allow access for Aventail programs (ewpca.exe): If you have security software such as Norton, ZoneAlarm or MacAfee installed on your computer, you may be prompted to allow access to the Internet for some Aventail files such as ewpca.exe. This is expected and you should allow these programs to access the Internet. Tip: If you have an option to Remember Setting or Always Allow choose this option so you will not be prompted in the future for this program. 24. Click OK to the Public Service Enterprise Group security message. 25. Type your PSEG LAN ID and password in the corresponding text boxes and click OK. 26. Work within the Terminal Server window to access your network drives, PSEG applications, and email. Be Careful Saving Documents in PSEG Terminal Server: If you have not used terminal server before, read through the PSEG Terminal Server section below. There is important information about how to save work, print, and disconnect from terminal server. Disconnect from SSL VPN Workplace Portal 1. When you are finished working, logoff Enterprise Terminal Server. 2. Click Log Off link on SSL VPN Workplace portal screen. 3. Close Browser. Page 6 of 17
PSEG TERMINAL SERVER Terminal Server allows PSEG mobile users to access corporate applications. The following applications are available through Terminal Server: PSEG TERMINAL SERVER APPLICATIONS Microsoft Outlook Microsoft Word Microsoft PowerPoint Microsoft Excel Lotus Notes Electronic Forms Information Central PSEG Applications Online (SAP, IDS, etc) IWMS Remedy DM-Net (NBU only) INSS (NBU only) ITTS (NBU only) ProRad (NBU only) The Terminal Server is described in the following sections: Saving Your Work Printing Disconnecting and Reconnecting Terminal Server Availability Saving Your Work on Terminal Server PSEG Terminal Server connects your local computer s C and D drives to the U and V drives within the Terminal Server screen. It is important to remember this when saving a document or other work within the Terminal Server screen to avoid saving sensitive information to the terminal server s C and D drives, which other users can view, instead of your personal C and D drives. Location of Local Drives On Terminal Server, your computer s local drives will be the following: The drive labeled C$ on Client (V:) is your local C: drive. The drive labeled D$ on Client (U:) is your local D: drive. The drive labeled E$ on Client (T:) is your local E: drive. Be aware of the following when saving on Terminal Server: For sensitive or personal information, save it to your P drive so others cannot access it. Double-check that your work saved to where you intended it to be saved. Call IT Help Desk if it did not, so that IT can recover it for you. By default, the save location on a Terminal Server is your P drive. However, if your P drive is full or unavailable, the terminal server will not default to your P drive. Below is an example of the Save As window that appears when you attempt to save a file. To see this window on a Terminal Server: 1. Open a Word or Excel document. 2. Click on the File menu and select Save As 3. Click on the Save in: box dropdown arrow to select the location to save your file. Save documents to the U and V drive that you can access from your home computer when Page 7 of 17
not connected to VPN. Be aware that these documents are not backed up. Example of which local drives are safe to save to and which are not in Terminal Server. When you logon to Terminal Server, your P drive will be checked to verify that it is connected and is not full. If it is not connected, you will receive the following message soon after logon: If your P drive is full, you will receive this message soon after logon: Page 8 of 17
Printing Terminal Server will attempt to connect your local printer when you logon. If it is unable to connect to a compatible printer, Microsoft Office products may not work properly. For example, Outlook may freeze when opening an attachment or Word may quit when printing. Follow the instructions below to designate a valid default printer. Using Your Home Computer to Print You may be able to print to your home printer if you designate it as the default printer prior to connecting to TS as follows: 1. 2. 3. 4. Click on the Start button on your desktop. Click on Settings, then Printers. Click on your home printer. Click on the File menu Set as Default Printer. Problems Using Your Home Computer to Print Due to printer driver compatibility issues, TS does not support all printers. If your home printer does not appear you will not be able to print from home. Disconnecting and Reconnecting If you are disconnected from Terminal Server for any reason and have not logged off: You will have 30 minutes to log back on and continue where you left off. This is called a disconnect. All open applications and data will remain in stasis until you log back on or the time limit expires. Once 30 minutes has passed, the session will be closed and any unsaved data will be lost. Your session is active when you type or move the mouse. After 45 minutes of inactivity, the session will be disconnected. This is called the idle time disconnect. Terminal Server Availability PSEG Terminal Server is available: 23 ½ hours a day, 7 days a week. Every morning between 2:30 a.m. and 4:00 a.m. Eastern Time, the Terminal servers will be backed up and taken offline for routine maintenance. The servers are taken offline one-at-a-time so that users can continue to access Terminal Server. If you are on the system during that time and receive an outage message, simply log off of your Terminal Server session and log back on. The system will log you onto a server that is still online. If you do not log off upon receiving the outage message, your open sessions will be closed and any unsaved data will be lost. Page 9 of 17
SETUP YOUR RSA SECURID TOKEN If you have a new RSA SecurID token, you must first create a PIN number to be used in conjunction with the token. Follow these instructions to create a PIN. 1. Type your LAN ID in the Username box. 2. Type the token code that is currently displayed on your RSA SecurID Token in the Enter PASSCODE box. 3. Click the Log In button. 4. Think of a PIN number that is between 4 8 characters, numbers and/or letters only, no special characters. Type your PIN in the box and click OK. 5. You will now be prompted to confirm your PIN. Re-enter the PIN you created in the previous step and click OK. Page 10 of 17
6. Wait for the token code on your token to change to a new number. Type your PIN followed by the new token number (no spaces) in the box. Click OK. 7. If the logon is successful, you will see the screen below. Go to step 6 in the First Time User Setup section of this document and continue with the SSL VPN setup. Page 11 of 17
MOBILE ACCESS SUPPORT Mobile Access information is described in the following sections: Who to call about Technical Problems Troubleshooting Internet Usage during VPN sessions Mobile Access Website Who to Call About Technical Problems If you are having technical problems with any application after connecting to VPN, call: PSEG IT Client Services at 1-877-430-7500, Option 1 PSEG IT Client Services cannot support the mobile access user s connection to the Internet. If you are not able to browse the Internet, you have not successfully connected to your Internet Service Provider (ISP). You will need to call your ISP for help. Please do not call the PSEG help desk until you have resolved the problem with your ISP. Troubleshooting Common SSL VPN Errors Listed below are common VPN errors with descriptions of the problem: ERROR MESSAGE Link for PSEG Enterprise or NBU Terminal Server does not function and you are directed back to the SSL VPN Workplace login screen. SOLUTION Internet Explorer 8 1. Start Internet Explorer 2. Click Tools 3. Select Internet Options 4. Click Advanced tab 5. Click Reset Internet Explorer Settings 6. Click Reset 7. Do Not Check Delete Personal Settings 8. Click Reset button 9. Close Internet Explorer 10. Login to SSL VPN Workplace 11. Follow 1st Time User Setup Steps No Java Found Install latest version of Java http://www.java.com/en/download/manual.j sp Page 12 of 17
Error - Cannot run applet successfully. Link for PSEG Enterprise or NBU Terminal Server does not function or you are directed to the Citrix website to upgrade your Citrix client. Aventail Installation Manager hangs or fails to install Unable to contact the Metaframe server browser. The connection to the Citrix server was interrupted. Old Version of Java Upgrade to newer version of Java. http://www.java.com/en/download/manual.j sp Old Citrix client Uninstall previous version of Citrix client. Client will be listed as PSEG Enterprise Terminal Server Client or PSEG ICA Client in Add/Remove Programs. Once the client has been uninstalled reconnect to PSEG SSL VPN. A new client will be installed on your Home PC via the SSL VPN website. Enable User Access Control Click Start->Control Panel->User Accounts>User Accounts->Turn User Account Control on or off. Select On and reboot as instructed. Or Upgrade Java to version 1.6 or higher http://www.java.com/en/download/manual.j sp No VPN Connection when Connecting to Terminal Server The PSEG VPN Client must be connected before attempting to start the PSEG Enterprise Terminal Server. Connect to the PSEG VPN Client. Then click on the Terminal Server icon. Terminal Server Session Disconnected unexpectedly This error is caused by a lost Internet connection, a lost VPN connection, or a system logoff due to inactivity (30 minutes or more). Check the Internet and VPN connections. If this error appears frequently within an hour, call IT Client Services for support. Page 13 of 17
Terminal Server Connection Screen Hangs Some firewalls will prevent access from your PC to PSEG s network and not notify you that it is blocking access. This problem readily occurs on PCs that have CA Security Suite installed. Below are the instructions necessary to get CA Security Suite to work with Aventail SSL VPN. Other firewalls have similar interfaces so you may be able to perform similar steps as below with your firewall. 1. Open CA Security Center 2. Click on Advanced Settings in the SA Firewall section 3. Click on Safeguard 4. Click on the Program Control tab 5. Click Add 6. Browse to c:\program files\citrix\icaweb32\wfica32.exe 7. Click OK 8. Select wfica32.exe in list of programs and choose Edit 9. Check the box called Trusted in the Program Group Assignment section at the bottom 10. Click OK 11. Close CA Firewall screen 12. Close CA Security Center 13. Login to SSL VPN as usual 14. Try PSEG Enterprise Terminal Server link Internet Usage During VPN Sessions Once remote users have made the VPN connection, they will not be allowed to surf the Internet. This is to prevent viruses and hackers from getting into the PSEG Network. While the VPN connection is active, PSEG will be able to monitor any network and Internet activity on your machine. Internet surfing is strictly prohibited while the VPN connection is active. Mobile Access Website Go to the Mobile Access website, at any time for more detailed information about VPN: http://infocentral.pseg.com/mobile_access Page 14 of 17
ENTERPRISE SECURITY POLICIES Enterprise Security Policies are described in the following sections: Access Security Monitoring Security Hardware/Software Individual Responsibilities Access Security PSEG Terminal Server is designed to provide easy access to Enterprise applications and network services. However, although this service provides transparent access to network-based information and services, PSEG information security practices still need to be adhered to while using this service.this mobile access service is a corporate resource and is restricted to business use only. Maintaining the integrity of PSEG s Network, systems and data is extremely important. IT has implemented multiple levels of security associated with this mobile access service. Use the following guidelines: Remember your User Identification Code and Password to access this service is the same as your LAN ID and Password. Do not share this information or write it down in an obvious location (e.g., post-it note attached to the computer or monitor). Your LAN ID and Password, if compromised, will allow an unauthorized individual to obtain access to those resources to which you have access and potentially to additional corporate resources. Should an unauthorized individual gain access to the Enterprise Network, Enterprise data and systems can be compromised. If you suspect that someone may have compromised your id and password, notify the Client Service Center immediately so appropriate action can be taken. PSEG IT Client Services at 1-877-430-7500, Option 1 Monitoring Use of this service is subject to monitoring to ensure compliance with Enterprise security practices as detailed in Manuals Connection on Information Central. The security associated with this service will allow IT to trace what machine gained entry, what data was accessed, and even the originating telephone number for the call or ISP network address initiating the VPN connection. Security Hardware / Software To protect your computer and PSEG information from viruses and hacking, PSEG recommends security hardware for laptop users with a cable or DSL modem connected to their docking station. Any security hardware device may be used as long as it is IPSec-compatible and has a built-in firewall. The following security hardware devices are recommended (but not supported by PSEG IT as they are intended for home networks): SMC Barricade 4-Port Cable/DSL Router (SMC7004ABR) Page 15 of 17
This hardware device is used with Cable and DSL modems. It acts as a home network router and firewall. It is best if used in conjunction with a software firewall. Linksys Wireless G Broadband Router (WRT54G) This hardware device is used with Cable and DSL modems. It acts as a wireless home network router and firewall. It is best if used in conjunction with a software firewall. For more information about ordering and installing these products, go to the Mobile Access Website, http://www.informationcentral.pseg.com/corporate/it/service_center/it_client_services/mobile_access/mobi le_access.jsp. Individual Responsibilities User identification codes and passwords are for the exclusive use of designated users and are not to be shared. In particular, users of the TS need to follow the security practices detailed in the following Enterprise Practices1: Enterprise Practice Number Enterprise Practice Name 282-1 Internet Usage 282-2 Electronic Mail Usage 282-3 Password Use 282-4 Understanding Information Security 282-5 Information Security Classification, Labeling and Handling 282-6 Information Sharing Practice External Third Parties 282-7 Personal Computer Protection Practice 282-8 Personal Computer Backup Practice 282-9 Anti-Virus Practice and Responsibilities If you experience password difficulties, call the Client Service Center for assistance. PSEG IT Client Services at 1-877-430-7500, Option 1 These practices are to be adhered to even if the device being used to access the TS is a home PC. In particular, logon passwords must not be saved or scripted into the logon process. Doing this can enable any user of that device, including unauthorized users, direct access to the Enterprise Network. Keep in mind that information security is everyone s responsibility! 1 Standards are documented on Information Central in Manuals Connection Page 16 of 17