Create proxied web apps to allow SSL VPN users to access web-based internal applications. There are predefined web app types for frequently used services, such as Outlook Web Access and SharePoint servers, as well as generic settings that allow you full control over how the web content is rewritten. The contents of the web page are modified as it passes through the SSL VPN tunnel, making it possible to create custom replacement values as needed for different remote users. Web apps can also be customized using user attributes. User attributes are defined by the administrator and filled in by the end user in the mobile or desktop portal. They allow for personalized URLs or single sign-on for web apps.
Configure a Generic Web App
- Go to CONFIGURATION > Configuration Tree > Box > Assigned Services > VPN-Service > SSL-VPN.
- In the left menu, select Web Apps.
- Click Lock.
- In the Proxied Web Apps section, click + to add a web app to the list.
Enter a Name for the web app and click OK. The Proxied Web Apps window opens.
Select Generic from the Web Apps Template drop-down list.
- Enter the Visible Name. This is the name used in the desktop and mobile portal for this web app.
- Enter the Root URL of the web server in the following format: Protocol type (
http://orhttps://) followed by the FQDN or IP address of the web server. E.g.,http://your.domain.comorhttps://10.10.10.10 Enter the Launch Path in the following format: "/" followed by the path and file name you want to request when starting the web app. Hash characters (#) in the launch path must be replaced by
[hash]. You can also include user or session attributes in the launch URL. For more information on attributes, see How to Use and Create Attributes.
E.g.,/wiki/${session:username}/ or /lunchmenu/${user:location}/index.php(optional) To restrict access to the web app by user group, replace the * entry in the Allowed User Groups list. Click + to add new user groups.
- (optional) Click + to enter the additional web servers in the Allowed Hosts list. Add all servers that must be proxied by the SSL VPN when accessing this web app.
- (optional) Click Ex/Import to upload a custom icon.
To configure Authentication (single sign-on) for this web app, see How to Configure Single Sign-On for Proxied Web Apps.
- Click OK.
- Click Send Changes and Activate.
Advanced Settings
For some web apps, more granular control over how the content is rewritten may be required. In the left menu, click Advanced View to set these parameters.
- GET/POST Content Rewrite – Rewrites the web forward path in GET/POST parameters so that the SSL VPN engine can forward it properly. For example, references to "/test.html" will be rewritten to "/web_forward_test/test.html".
Custom Replacements – If you have absolute URL addressing, use the replacement proxy when other web apps do not work. The replacement proxy works most of the time, provided that the web page is not using a lot of JavaScript.
Define a matching and corresponding replacement pattern and assign a weight to each. The lowest weight is processed first.- Custom Headers – Define rules to replace or remove header values for either requests, responses, or both.
Dynamic Access – Make this resource available only when enabled by super user groups:
Select the Dynamic App check box.
Allow super user groups to enable, disable, or time-enable the resource.
Select the Allow Maximum/Minimum Time check boxes and restrict the maximum and minimum amount of time this resource can be time-enabled for.