Clientless Application Access Using a Guacamole Instance

Components

The table below describes the components in the topology:

Onboard the Frontend VOS Device

The frontend VOS device must be properly configured and tagged in Director to allow Concerto to recognize it as a clientless access device. Onboard the frontend VOS device using the post-staging template workflows. For more information on post-staging templates, see Create Post-Staging Templates. 

To onboard the frontend VOS device:

1. In workflow step 1, Basic, set the following parameters:
   • Device Type Name—Cloud Security
   • Device Type Mode—Hub
   • Organization—Select the provider organization.
      
   
2. In workflow step 2, Interfaces, add the NO_DIA tag to each WAN circuit.  The frontend VOS device does not require direct to internet (DIA) access for tenants. The NO_DIA tag prevents Concerto from adding DIA-related configurations when creating a new tenant. 
   
   
3. Add the LAN interface and associate it with the provider organization LAN-VR. This LAN interface is needed for GRE based routing between the frontend VOS device and the Guacamole instance. This VNI LAN acts as an Underlay Transport for the GRE, with a separate GRE tunnel per tenant. Recommended for cloud deployments where VLAN support is unavailable. For datacenter deployments (baremetal or VM) with VLAN routing, this step can be skipped. The GRE or VNI-VLAN selection is configured in Concerto during Clientless Access Instance creation.
4. Create the device and onboard it using zero touch provisioning (ZTP). You must use ZTP for proper device onboarding and configuration management. 
5. After the device is onboarded, add the tag CLOUD-SERVICE-FRONTEND-VOS in the Director Appliances screen. This allows Concerto to identify these devices as frontend VOS rather than SASE gateway. Note that the tag CLOUD-SERVICE-FRONTEND-VOS must be applied in all capital case, as shown below.
   
   
6. After adding the tag, discover the appliances in Concerto under the provider organization. This imports appliances from Director and registers them as Frontend VOS device types in the Concerto database. 

Create Clientless Access Instances

Before creating tenants, you must create clientless access instances that link the front end VOS devices to Guacamole servers. For more information, see Configure Concerto Infrastructure Lifecycle.

1. Go to Infrastructure > Clientless Access Instance.
   
   
2. Click Add Clientless Access Instance.
3. In the Add Clientless Access Instance window, enter information for the following fields.
   
   
    

   Field	Description
   Instance Name	A unique name for the clientless access instance. Typically matches the tenant name.
   API Username	guacadmin (all lowercase - required).
   API Password	guacadmin (all lowercase - required).
   Frontend VOS	Select from dropdown - lists all frontend VOS devices discovered under the provider organization.
   Loopback Address	A unique loopback address advertised in the customer tenant LAN-VR. This is the NAT source IP for Guacamole traffic. It must not overlap with customer network IP addresses.

   Note: Since both the frontend VOS device and Guacamole support multitenancy, a single interface can be created between the two entities and configured as VLAN-based to support multiple tenants. This optimizes resource utilization.

   • For GRE tunnel routing, enter information for the following fields. Note that for a particular frontend VOS device, these parameters remain the same for most tenants unless a different VNI interface or peer IP address is used. GRE tunnel-based routing is recommended for cloud deployments where VLAN-based routing is not supported.
     
     
      

     Field	Description
     Tunnel Transport Local IP	Provide the VOS side VNI interface LAN network added as part of the provider organization.
     Tunnel Transport Remote IP	Provide the Guacamole instance underlay IP address.
     Transport Routing Instance	Provide the provider organization LAN-VR that the Tunnel Transport Local VNI is part of.

   • For VNI interface routing, enter information for the following fields. 
     
     

     Field	Description
     VNI Interface	Select the VNI interface connecting the frontend VOS device to the Guacamole instance.
     VLAN ID	Enter the VLAN ID if a subnet VLAN exists between the frontend VOS devices and Guacamole. If no VLAN is configured, enter 0. Range: 0 through 4094 Default: None

Create the Tenant in Concerto

Create the tenant following the standard SASE/SD-WAN tenant creation process in Concerto. Under the Select Tenant Product section, select Versa Secure Access Fabric–Elite Bundle and enable the Privileged Access option. This is required to create private applications within the tenant.

When creating a tenant in Concerto, you must select the appropriate product bundle and assign Guacamole instances per region.

1. In the Select Tenant Product section, select Versa Secure Access Fabric – Elite Bundle.
   
   
2. Click the Privileged Access checkbox. This is required to create private applications within the tenant. 
3. After selecting gateways per region, select workflow step 5, Advance Security Cloud.
4. Select the Clientless Access Instances tab.
5. Add the Guacamole instances for each region, as shown below.
   
   

   Note: For high availability, it is recommended to deploy two frontend VOS devices and two Guacamole instances per region.

6. Select the final workflow step, Review and Submit.
7. Click Publish to create the tenant. Concerto automatically pushes the required configurations to the selected SASE gateways and frontend VOS devices.

Configure the Guacamole Instance

You can configure the Guacamole instance on a per-tenant basis within the Guacamole VM. Contact the Versa Networks customer support team for the shell script and Docker images. Bring the Ubuntu-VM 22.04 in the same network as in the frontend VOS device with a minimum of one interface directly connected to it. 

To configure the Guacamole instance using the shell script: 

1. Copy the contents of the .tar file which contains the auth extensions, Docker images and the shell script. 
   
   For example:
   
   
2. Install the Docker package using the following commands:
   • sudo apt update
   • sudo apt install docker.io -y
      
3. Load the Docker images into the Ubuntu VM using the following commands:
   • sudo docker load -i docker_guac_images_<filename>.tar
   • sudo docker images
      
   For example:
   
   
4. Run the Guacamole Docker script (guac-docker*.sh) to bring up Docker containers for each tenant. Run the appropriate script based on the routing mode configured between the frontend VOS device and the Guacamole instance. The tenant name must exactly match the name configured in Concerto (case-sensitive). 
   • Option 1—Use the VNI-based script. Provide the interface name with VLAN-ID connected to the Frontend VOS. The VLAN ID must match the value provided in the Concerto Clientless Access Instance creation step.
   • Option 2—Use the GRE-based script. Provide the Outer Local IP (Guacamole instance underlay IP) and Outer Peer IP (VOS-side VNI interface IP in the provider organization LAN-VR). The tenant name must match exactly as configured in Concerto.
5. To verify the Docker containers are running, issue the sudo docker ps command. This will bring up the Docker containers for the given tenant.
   
   For example:
   
   
    
6. Run the verification script (verify_namespace_local.py) with the tenant name.
   
   For example:
   
   
7. Check the routes configured and the ports opened inside the tenant namespace.
   
   For example:
   
   

Configure the SASE Gateway

Configure the following features, in order, on the SASE gateway in the provider organization. 

1. In Director: 
   1. Configure captive portal to handle user authentication management. The certificate in the captive portal must include the following Subject Alternative Name (SAN):  For more information, see Modify Captive Portal Settings. 
      • *.myapps.<sse-root-domain.com>
   2. Configure the Versa Forward Proxy (VFP) with SNAT pool. For the IP Address field, enter the WAN interface IP address. For the Port field, enter port 443. For more information, see Configure a Web Proxy.
2. In Concerto:
   1. Create User Device Authentication profiles and specify the users and groups that will have access to Clientless Applications. You can create an authentication profile using one of the following methods:
      • SAML authentication
      • LDAP authentication
      • Versa local directory
      For more information, see Configure User and Device Authentication.
   2. Configure the RDP, SSH or VNC applications with parameters such as host IP address, port, username, and password. For more information, see Configure Clientless Applications in Concerto. 
   3. Create a clientless application policy rule with the users and groups that were created for the User Device Authentication profiles. Configure the source geolocation and source IP address if required. In the Clientless Application tab, select the list of private applications allowed for the list of users referred. For more information, see Configure SASE Secure Clientless Access Policy Rules.
   4. Create an internet protection rule to allow the following destination zones: Internet, SD-WAN Zone (ptvi), and Versa Client, as shown below. For more information, see Configure SASE Internet Protection Rules. 
      
      
   5. Publish the configuration to the SASE gateway.