Pulse Secure Client for Chrome OS Quick Start Guide · Chrome OS is the same as that of Pulse for...

© 2018 by Pulse Secure, LLC. All rights reserved 1

Pulse Secure Client for Chrome OS Quick Start Guide

Published March, 2018 Release 5.2r1 Version 1.6


Pulse Secure, LLC

2700 Zanker Road, Suite 200

San Jose, CA 95134

http://www.pulsesecure.net

© 2018 by Pulse Secure, LLC. All rights reserved

Pulse Secure and the Pulse Secure logo are trademarks of Pulse Secure, LLC in the United States. All other trademarks, service marks,

registered trademarks, or registered service marks are the property of their respective owners.

Pulse Secure, LLC assumes no responsibility for any inaccuracies in this document. Pulse Secure, LLC reserves the right to change,

modify, transfer, or otherwise revise this publication without notice.


The information in this document is current as of the date on the title page.

END USER LICENSE AGREEMENT

The Pulse Secure product that is the subject of this technical documentation consists of (or is intended for use with) Pulse Secure

software. Use of such software is subject to the terms and conditions of the End User License Agreement (“EULA”) posted at

http://www.pulsesecure.net/support/eula. By downloading, installing or using such software, you agree to the terms and conditions of

that EULA.

http://www.pulsesecure.net/

http://www.pulsesecure.net/support/eula


Revision History

Revision Date Description

1.6 March 2018 5.2 R1

1.5 June 2016 5.2.1.17

1.4 April 2016 5.2.1.15

1.3 February 2016 5.2.1.14

1.2 November 2015 5.2.1.9

1.1 October 2015 5.2.1.8

1.0 September 2015 5.2.1.7



Table of Contents

Revision History ................................................................................................................................... 3

Introduction.......................................................................................................................................... 5

Overview ............................................................................................................................................... 5

Supported Platforms ..................................................................................................... 5

Supported Features ....................................................................................................... 6

Limitations.......................................................................................................................... 7

Diagnostics and Status ................................................................................................... 7

Configuring Server VPN Policy ........................................................................................................ 11

Configuring Manual Connections.................................................................................................... 13

Modifying VPN Connection ................................................................................................................ 16

Deleting VPN Connection ................................................................................................................... 17

Starting and Stopping VPN Connections with Chrome OS ........................................................ 18

Appendix A .......................................................................................................................................... 19

Chromebook Advanced Sync Settings .......................................................................................... 19

Appendix B .......................................................................................................................................... 21

Managing Certificates on Chromebook ........................................................................................ 21

Importing Client Certificates ............................................................................................................ 21

Importing Public Key Certificate of the Issuer of the PCS Gateway........................................ 23

Appendix C .......................................................................................................................................... 24

Google Management Console ........................................................................................................ 24

Managing Connection Policy ........................................................................................................... 26

Index ..................................................................................................................................................... 30



Introduction

Overview

Pulse Secure client for Chrome OS provides secure connectivity between a device running

Chrome OS and Pulse Connect Secure. Pulse Secure client for Chrome OS is available from

the Chrome Web Store. After installing the Pulse Secure client app on a Chrome OS device, the

user can configure a connection and establish Layer 3 VPN (SSL) communications.

Configuration on the Pulse Connect Secure gateway to support Pulse Secure clients for

Chrome OS is the same as that of Pulse for Windows and Mac OSX. Use the sign-in policies,

authentication realms, roles and VPN tunnel policies to define authentication and access

permissions. A typical Pulse server configuration for Chrome OS access is to create a realm, a

role and a remediation role that are designed for Chrome OS users.

Figure 1: Pulse Secure Client for Chrome Web Store App Page

Supported Platforms

Pulse Secure client for Chrome OS is supported on devices running version 43.0.2357.19 or

later of Chrome OS.

https://chrome.google.com/webstore/detail/pulse-secure-vpn/eiddfaedmgnpnnojolcknhpjbmmpplgd



Pulse Secure client for Chrome OS is supported on Pulse Connect Secure version 8.1 and

later.

Supported Features

The following features are supported by the Pulse Secure client for Chrome OS:

• VPN (SSL) connections to Pulse Connect Secure v8.1 and later

• Manual end-user connection and disconnection

• Authentication types:

o Username and password

o Username and RSA token code

(User PIN and system PIN are supported.)

o Client certificate and smart card

o Radius challenge/response

o Secondary authentication

o SAML (Security Assertion Markup Language)

• Authentication server prompts for retry, change password, create PIN, change PIN and next-token

code

• Realm and role selection

• Pre- and post-authentication sign-in notification messages

• IPv4

• Split tunneling enabled and disabled

Note: Pulse for Chrome OS connections always have local subnet access enabled.

• Split tunneling policies: IPv4 inclusion and exclusion routes

(In split-tunneled mode, the Pulse Connect Secure DNS search-order configuration

settings do not apply to Pulse for Chrome OS.)

• Host Checker (OS-Check only)

• Graceful handling of sleep/wakeup transitions, including session resumption and

termination

• App download from Google’s Chrome Web Store

• Tunnel proxy settings



Limitations

The following features are not available with Pulse Secure client for Chrome OS:

• Connections to Pulse Policy Secure gateways or gateways from third parties (Only

connections to Pulse Connect Secure gateways are supported.)

• Host Checker (only the Host Checker “OS-Check” is supported)

• Machine authentication

• Location awareness rules

• Logon and logoff scripts

• WINS server tunnel parameter

• UDP-ESP tunnel (only SSL mode is supported)

• Certificate trust override prompt

• RSA soft-token integration

• Session extension

• Manual suspend/resume tunnel

Diagnostics and Status

After installing the Pulse app on a Google Chrome device, you can see the Pulse Secure icon

by clicking on the launcher icon available in the lower left-hand corner of the Google Chrome

desktop screen.



Figure 2: Chrome OS Apps List – Pulse Secure icon

When you click on the Pulse Secure icon, a screen appears that has Status, Pulse Log and

About tabs, and Refresh and Clear Credentials buttons.



Figure 3: Diagnostics and Status screen – Pulse Log tab

A brief description about these items is given in the table below.

Table 1: Diagnostics and Status

Item Description

Status tab Provides the version of the Pulse client and information about the number

of connections attempted (including failures) and packets transmitted. The

status is used to verify if connections are being created correctly and if data

is being transmitted through the secured tunnel.

Pulse Log tab Displays detailed diagnostics logs and debug information. If you need help

diagnosing a connectivity issue, you may be asked to provide these logs to

an authorized support representative.

About tab Displays the Pulse app version, copyright and trademark information.

Refresh button Updates the Status and Pulse Log tabs.

Clear Credentials button Clears any connection’s automatically saved credentials such as the user

password or client certificate selection. To clear any other information, use

the Edit Connections dialog.

Note: The Status and Pulse Log tabs are static, which means that they will display only

the state of the Pulse app at the time the Pulse app was started. The screen will not



dynamically update as additional data is transmitted. To update Status or Pulse Log, click the

Refresh button.



Configuring Server VPN Policy

The Pulse Secure client enables you to secure your company resources using authentication

realms, user roles and resource policies. For complete information on the Pulse Connect

Secure gateway, see the Pulse Connect Secure documentation.

The Pulse Connect Secure gateway checks the authentication policy defined for the

authentication realm. The user must meet the security requirements that are defined for

a realm's authentication policy. At the realm level, you can specify security requirements

based on various elements, such as the user's source IP address or the possession of a

client-side certificate. If the user meets the requirements specified by the realm's

authentication policy, the gateway forwards the user's credentials to the appropriate

authentication server. If this server successfully authenticates the user, then the gateway

evaluates the role-mapping rules defined for the realm to determine which roles to

assign to the user.

The following is a generalized example of configuring a Pulse Connect Secure gateway for the

Pulse for Chrome OS app.

Click Users > User Roles and then either select an existing role (preferred) or create a new

role.

If creating a new role, specify a name and optional description for the role, for example:

Chrome OS Role, Chrome OS VPN Role.

To use certificate authentication at the role level, click Restrictions > Certificate on the role’s

General tab, and add the required certificate information.

To sign in, enable certificate authentication by clicking “Only allow users with a client-side

certificate signed by Certification Authority”.

Note: One typical method of installing the client certificate on a Chrome OS device is to send the

certificate as an attachment to the Chrome OS user. The certificate must be installed on the Chrome

OS device before the user can connect. The user is prompted to select the certificate during the initial

Pulse Secure client connection process. There are other mechanisms for transferring the certificate

to the client, including MDM systems and Google Drive.

Define the trusted client certificate authorities.

For complete information on certificate authentication, see Understanding Digital

Certificate Security.

Note: Due to limitations, you must specify the set of client certificate issuer certificate authorities.

The Chromebook does not support the specification of root or intermediate certificate authorities in

certificate authority hierarchies greater than 2.

Set the options on the role’s Web and Files tabs as required.

Click Users > User Realms and then create a new realm or select an existing realm. Configure and

http://www.juniper.net/techpubs/en_US/release-independent/sa/information-products/pathway-pages/sa-series/product/

http://www.juniper.net/techpubs/en_US/sa8.0/information-products/pathway-pages/sa-series/junos-pulse-sa-certificate.html

http://www.juniper.net/techpubs/en_US/sa8.0/information-products/pathway-pages/sa-series/junos-pulse-sa-certificate.html



save your options on the General and Authentication Policy tabs.

On the Role Mapping tab, click New Rule to create a new role-mapping rule.

One option for a role-mapping rule is to create a custom expression that uses the

user agent string to identify a Chrome OS device. The Pulse Secure client for Chrome

OS user agent string has a form like this:

Pulse-Secure/8.1.0.0 (ChromeOS; ARM) PulseVpn/5.2.1.0

You can use all or part of the string in a custom expression that uses the userAgent

variable. For example:

userAgent = '*ChromeOS*'

Select the role that you created earlier for the Chrome OS users, add it to the Selected Roles list,

and then click Save Changes.



Configuring Manual Connections

Pulse Secure client for Chrome OS is available from the Chrome Web Store.

After the user installs the app, the user can create Pulse Secure client connections.

Figure 4 shows the Pulse Secure client after it has been installed on a Chrome OS device.

Figure 4: Chrome OS Apps List

The Pulse Secure icon in the apps list is used primarily to view connection, versioning and

diagnostic information. To configure a VPN connection or to initiate a manual VPN

connection, click on the system tray in the lower-right-hand corner of the main Chrome OS

screen, then select the VPN option in the popup-menu. Pulse Connect Secure connections

will appear in the resulting VPN dialog.

Note: If you use client certificate authentication, the client certificate must be installed

on the Chrome OS device before the Pulse Secure client can connect.

To create a Pulse Secure client connection on a Chrome OS device:

https://chrome.google.com/webstore/detail/pulse-secure-vpn/eiddfaedmgnpnnojolcknhpjbmmpplgd



Go to the system tray, open the popup menu and select the VPN disconnected option.

Figure 5: VPN disconnected Option

Tap the Pulse Secure option.

Figure 6: Pulse Secure Option

To create a new connection, tap the “Pulse Secure” option. The Add Connection screen

appears.



Figure 7: Add Connection screen

In the URL field, specify the URL for the Pulse Connect Secure gateway.

You can identify the server using the server IP address, the hostname, or a URL that

optionally specifies the port the connection uses and the specific sign-in page. To specify

an URL, use the following format:

https://hostname[:port][/][sign-in page]

The brackets indicate options. If you specify a specific sign-in page, make sure that the

name you specify matches what is defined on the Pulse Connect Secure gateway.

(Authentication > Signing in > Sign-in pages.)

Specify the optional parameters.

If you specify a username, future connection prompts will be seeded with this user

name.

After the user saves the new connection, it appears in the VPN list. The user can tap the

connection to initiate a VPN connection. The VPN connection state is indicated in the VPN

popup menu.

Note: The connection ‘Save identity and password’ option controls whether credentials

will be automatically saved or not. Saved credentials are not stored persistently and will be

removed on logout, uninstallation and restarting the computer.



Modifying VPN Connection

To modify a Pulse Secure client connection on a Chrome OS device:

Open the Chrome Settings page.

Under Private network settings, select the connection you want to modify.

Click Configure.

The Pulse Secure client connection configuration screen is displayed.

Figure 8: Modify Connection screen

Click Configure to launch the Pulse Secure Edit Connection dialog.



Deleting VPN Connection

To delete a Pulse Secure client connection on a Chrome OS device:

Open the Chrome Settings page.

Under Private network settings, select the Preferred networks….

Figure 9: Delete Connection screen

Select the delete symbol “x” corresponding to the connection you want to remove.

Click Done.



Starting and Stopping VPN Connections with Chrome OS

To start Pulse Secure client connection, in the Chrome OS System menu, click the Pulse

Secure connection that you want to start.

Figure 10: Start Pulse Secure Client Connection

To stop Pulse Secure client connection, in the Chrome OS System menu, select the Pulse

Secure connection that you want to stop and click Disconnect.

Figure 11: Stop Pulse Secure Client Connection



Appendix A

Chromebook Advanced Sync Settings

The Advanced Sync Settings option provides the access to apps, extensions, bookmarks and

other information across Chromebooks.

You can sync:

• Apps and extensions from the Chrome Web Store (except extensions containing plug-ins)

• Chrome browser settings

• Custom wallpapers

• Language preferences

• Prediction of network actions

To set up sync:

On the Settings page, in the Users section, click Advanced sync settings.

The Advanced sync settings window is displayed.

Figure 12: Advanced sync settings window

From the drop-down list, select Sync everything and click OK.



The Pulse Secure client extension would be synced to all Chromebook devices with the

default settings. You will be able to access apps, extensions, bookmarks and other

information across Chromebooks.



Appendix B

Managing Certificates on Chromebook

If you are not using certificates from one of the existing public certificate authorities, you

must import the public key certificate of the issuer of the Pulse Connect Secure (PCS)

gateway. This will allow the Chromebook to trust the PCS.

If you are using client certificate authentication, you must import the client certificates into

the Chromebook certificate store.

Importing Client Certificates

To import the client certificates:

Go to the chrome tab chrome://certificate-manager.

In the Your Certificates tab, import user certificates.

Figure 13: Certificate Manager – Your Certificates tab



Note: For managed accounts:

• Only the certificates, imported by the chrome.enterprise.platformKeys API will qualify for corporate

usage.

• If the certificate is generated or imported by other means, such as manually then it is not available

for the API.

For more information please refer:

https://support.google.com/chrome/a/answer/6080885?hl=en&ref_topic=6330253

https://support.google.com/chrome/a/answer/6080885?hl=en&ref_topic=6330253



Importing Public Key Certificate of the Issuer of the PCS

Gateway

To import the public key certificate:

Go to the chrome tab chrome://certificate-manager.

In the Authorities tab, import the public key certificate of the issuer of the PCS gateway.

Figure 14: Certificate Manager – Authorities tab

To test your certificates:

Open the Chrome browser.

Enter your PCS URL and see if you get an HTTPS certificate error.



Appendix C

Google Management Console To manage the Pulse Secure VPN with the Google Management Console, do the

following steps:

Add the Pulse Secure app to either the Force-installed or Allowed Apps and

Extensions from the Chrome->User Settings.

Add the ‘Pulse Secure VPN’ from the Device management->Network->VPN.

Choose the appropriate organizational unit.



Hover over the Pulse Secure VPN item and depress the ‘EDIT’ button.

Configure the policies and settings for the Pulse Secure VPN app.



Select the ‘Allow access to client certificates and keys’ if you are using client

certificates.

Managing Connection Policy

From within Google Management Console you can manage the Pulse Secure application and

import a connection policy.



The Pulse Secure connection policy implements these policy options.

Policy Description

AllowLocal If set to true, then enable add, edit and delete of local connections.

Default: true

AllowAutoSave If set to true, then enable the auto-save option on local connections.

If set to false, this option disables auto-save for all connections.

Default: true

Connections Attribute Description

name Connection Name.

url Server URL.

check If set to true, then identity and password

credential information will be automatically

saved and used transparently in subsequent

authentication attempts.

Default: true

username If primary username is set, then primary

username prompts will default to this value.

The following substitution symbols are

supported:

Variable Description

${LOGIN_ID} The current user's username,



Policy Description

such as mscarlet.

${LOGIN_EMAIL}

The current user's full email

address, such as

mscarlet@your_domain.com.

username2 If secondary username is set, then secondary

username prompts will default to this value.

The following substitution symbols are

supported:

Variable Description

${LOGIN_ID} The current user's username,

such as mscarlet.

${LOGIN_EMAIL}

The current user's full email

address, such as

mscarlet@your_domain.com.

realm If realm is set, then this realm preference will

be automatically selected during

authentication.

role If role is set, then this preferred role will be

automatically selected during authentication.

A configuration conforming to the specification above can be placed in a configuration file in

JSON format and uploaded in the Google Management Console. Below is a sample Pulse

Secure connection policy in JSON format showing a locked-down policy useful for a kiosk

application.

{

"AllowLocal": {

"Value": false

},

"AllowAutoSave": {

"Value": false

},

"Connections": {

"Value": [

{"name": "test", "url": "10.17.1.222", "check": true,

"username": "${LOGIN_ID}", "username2": "${LOGIN_EMAIL}"},

{"name": "vpn", "url": "vpn.psecure.net", "realm": "Users", "role": "Users"}

]

}

}

Note:

• The policy is case sensitive.



• The policy attributes and Connections array must not have a trailing ‘,’ after the last

element.

• Not all Connections attributes have to be specified; only ‘name’ and ‘url’ are

required.

• ‘AllowLocal’ and ‘AllowAutoSave’ are optional

• The Google Management Console doesn’t validate configuration and fails silently on

malformed policies.

Once you make your configuration file, use the ‘UPLOAD CONFIGURATION FILE’ button in the

Google Management Console to upload the configuration.

To see the downloaded policy on a managed Chromebook device, navigate the browser to

‘chrome://policy’ page.

For information on managing chrome devices, see:

https://support.google.com/chrome/a/answer/1289314?hl=en

For instructions for enrolling chrome devices, see:






Index

A

apps and extensions 18

authentication realms 4

authentication types 5

C

certificate authentication 10

certificate manager 19, 20

Chrome Web Store 4, 5, 12

client certificate authentication 19

client certificate authorities 10

custom wallpapers 18

D

delete VPN connection 16

diagnostics 7

DNS 5

H

host checker 5

I

IPv4 5

L

Layer 3 VPN(SSL) communication 4

local awareness 6

logs 7

M

machine authentication 5

modify VPN connection 15

P

Pulse Secure icon 12

R

Radius challenge/response 5

RSA soft token 6

RSA token code 5

S

secondary authentication 5

session extension 6

sign-in notification messages 5

sleep/wakeup transitions 5

smart card 5

split tunneling 5

start VPN connection 17

status 7

stop VPN connection 17

supported features 5

supported platforms 4

sync settings 18

U

UDP-ESP tunnel 6

user agent string 11

Pulse Secure Client for Chrome OS Quick Start Guide · Chrome OS is the same as that of Pulse for...

Documents

Transcript of Pulse Secure Client for Chrome OS Quick Start Guide · Chrome OS is the same as that of Pulse for...