configure thin client settings locally · configure thin client settings locally...

Configure Thin Client Settings Locally

This chapter contains information to help you set up your thin client hardware, look and feel, and systemsettings using the Control Center.

While it is not recommended to use dialog boxes for configuring thin client system settings, they areavailable in case you want to temporarily override central default configurations or you do not have theoption to set up central configuration (smaller environments). In general, it is recommended that you usecentral configuration to enable you to automatically push updates and any desired default configurationto all supported thin clients in your environment (see Release 10.6 Upgrade and Setup Using Cisco VXCManager).

Tip

Clicking Control Center in the Computer menu or in the Connection Manager opens the Control Center.

Figure 1: Control Center

Administration Guide for Cisco VXC 6215 Firmware Release 10.6 1

vxcc_BK_VBCD2C7D_00_vxc-6215-admin-971_chapter_01.pdf#unique_8

vxcc_BK_VBCD2C7D_00_vxc-6215-admin-971_chapter_01.pdf#unique_8

You can right-click an icon in the Control Center to add the application to your Favorite Applications area(shown in the Computer menu) or to your Startup Programs.

Tip

The Custom GNOME feature allows you to use INI parameter settings to customize the display andarrangement of the Control Center and Application Browser application icons for your users (see INI FilesReference Guide for Cisco Virtualization Experience Client 6215.)

Important

The Control Center displays the following thin client options that you can configure locally on a thin clientusing dialog boxes (depending on user privilege level, some dialog boxes and options may not be availablefor use):

• Display, page 3

• Keyboard, page 4

• Mouse, page 5

• Printers, page 5

• Appearance, page 9

• Language, page 9

• Panel Settings, page 10

• Screensaver, page 10

• Add-on Manager, page 11

• Citrix Global Settings, page 11

• Configure VDA, page 18

• Configure Desktop Appliance Settings, page 18

• Device Settings, page 20

• Import Certificates, page 24

• INI and Upgrade Settings, page 26

• Network Connections, page 29

• Power Management, page 34

• SCEP Client Configuration, page 35

• TCX USB Virtualizer, page 36

• User Administration, page 36

• Configure Cisco VXC Manager Agent Settings, page 37

Administration Guide for Cisco VXC 6215 Firmware Release 10.62

Configure Thin Client Settings Locally

DisplayUse the Display Preferences dialog box (click Display) to set the monitor display settings (Primary DisplayOutput, Resolution, Refresh Rate, and Rotation). For most monitors, resolution is obtained automatically fromthe monitor.

When multiple monitors are identified, the screens are extended by default.

To set up mirrored monitors, check theMirror Screens check box.

Tip

If you manually set the monitor settings using the Display Preferences dialog box, the settings are lost at thenext reboot. To retain the monitor settings after a reboot, set the display settings using the INI file.

Figure 2: Display Preferences


Configure Thin Client Settings LocallyDisplay

KeyboardUse the Keyboard Preferences dialog box (clickKeyboard) to select general (repeat key and cursor blinking),layout (keyboard models and layout options), accessibility (sticky key, slow key, bounce, key audio feedback),mouse keys (keypad control of pointer), and typing break (reminder) preferences.

Figure 3: Keyboard Preferences


Configure Thin Client Settings LocallyKeyboard

MouseUse the Mouse Preferences dialog box (clickMouse) to select general (mouse orientation, locate pointer,pointer speed, drag-and-drop, double-click time out) and accessibility (simulated secondary click and Dwellclick) preferences.

Figure 4: Mouse Preferences

PrintersUse the Printer Configuration dialog box (click Printing) to:

• View the list of currently configured printers.

• Add and configure a network or local printer (click theNew icon to open and use the New Printer wizard).

• Select the default printer (select a printer in the list and click Printer > Set as Default). Note thatadministrators can specify system-wide and personal default printers.

• Change printer settings (right-click a printer in the list, select Properties, and then click Settings).

• Change printer policies (right-click a printer in the list, select Properties, and then click Policies).

• Change user access to the printer (right-click a printer in the list, select Properties, and then clickAccessControl).

• Change printer job options (right-click a printer in the list, select Properties, and then click JobOptions).


Configure Thin Client Settings LocallyMouse

• Delete a printer (right-click a printer in the list, select Delete, and click OK).

Figure 5: Printer Configuration

Install a Network Printer

Procedure

Step 1 Click the New icon in the Printer Configuration dialog box to open the New Printer wizard.

Step 2 Select the printer option you want from the Devices list and follow the New Printer wizard using the followingguidelines:

• AppSocket/HP JetDirect—Use this option for a printer connected directly to the network instead ofthrough a computer.

• Forward print job data like a pipe to another command—Use this option to "pipe" the output of theprinting command into another command or to "redirect" the output to a file.

• Internet Printing Protocol (IPP)—Use this option for a printer attached to a different Linux system onthe same network running CUPS or a printer configured on another operating system to use IPP (httpprinting).

• LPD/LPR Host or Printer—Use this option for a printer attached to a different UNIX system that canbe accessed over a TCP/IP network (for example, a printer attached to another Linux system on your


Configure Thin Client Settings LocallyInstall a Network Printer

network) or a thin client used as an LPD (Line Printer Daemon) server for LPD printing requests fromthe network. You can enter the DNS orWINS name of the server for the network printer, or an IP addresscan also be entered. Note that if the printer is attached to another thin client on your network, the entryin the Host box is the name or address of that thin client.

•Windows Printer via SAMBA—Use this option for a printer attached to a different system that is sharinga printer over an SMB network (for example, a printer attached to a Microsoft Windows machine).

• Other—Use this option for other device Uniform Resource Identifier (URI) needs.

Install a Local PrinterConnect the printer cable to your thin client and use the following guidelines:

Procedure

Step 1 Click the New icon in the Printer Configuration dialog box to open the New Printer wizard.

Step 2 Be sure the USB printer you connected to your thin client is selected and click Forward.You can use the Serial Port # 1 and Serial Port # 2 options as needed for your local serial port printers.Tip


Configure Thin Client Settings LocallyInstall a Local Printer

Step 3 Select the option with which you want to obtain your printer driver and click Forward.

Step 4 Select the Model and Driver and click Forward.

Step 5 Enter the Printer Name, Description, Location, and then click Apply.The printer is added to the Printer Configuration dialog box and is ready for use.


Configure Thin Client Settings LocallyInstall a Local Printer

AppearanceUse the Appearance Preferences dialog box (click Appearance) to set the desktop display settings (Theme,Background, Fonts, and Interface). It is recommended to use default settings for best performance.

Figure 6: Appearance Preferences

LanguageUse the Select a Language dialog box (click Language) to select the language of the User Interface (UI) fromthe list of supported languages.


Configure Thin Client Settings LocallyAppearance

Panel SettingsUse the Panel Settings dialog box (click Panel Settings) to set whether or not to always display the taskbaron top of all other windows.

Figure 7: Panel Settings

ScreensaverUse the Screensaver Preferences dialog box (click Screensaver) to select screen saver theme settings andpower management settings (click PowerManagement to open and use the Power Management Preferencesdialog box. See Power Management, on page 34).

Figure 8: Screensaver Preferences


Configure Thin Client Settings LocallyPanel Settings

Add-on ManagerUse the Add-on Manager dialog box (click Add-on Manager) to view and manage (add and remove) the listof add-on packages available. Add-ons that are selected in the list have been installed on your thin client.

Figure 9: Add-on Manager

To install add-ons, your thin client must be connected to the correct update server and folder on that server.If you receive a Failed to download available add-on list error message, click ServerSettings in the Add-on Manager dialog box to open and use the Thin Client Settings dialog box as describedin Image Upgrade Options, on page 28.

In the Update Server URL text box, be sure to enter the root path on the server followed by the path tothe Addons folder.

Important

The Add-OnManager populates the list with add-ons listed in the directory plain text file located in the addonsfolder.

Use the following guidelines to install and uninstall add-ons:

• Installing add-ons—Select the check box of the add-on and click Execute.

• Uninstalling add-ons—Clear the check box of the add-on and click Execute.

Citrix Global SettingsClicking the Citrix Settings icon in the Control Center opens the Citrix Settings dialog box. Use this dialogbox to configure the common settings you want for all Citrix connections, and then click OK.


Configure Thin Client Settings LocallyAdd-on Manager

NetworkUse the Network tab to configure the servers and reconnection settings.

Figure 10: Citrix Settings

Use the following guidelines:

• PN Agent Server—Enter the PN Agent Server you want to use (this can be a list of servers with eachserver separated by a semi-colon).

• Metaframe Server—Enter the Metaframe Server you want to use (this can be a list of servers with eachserver separated by a semi-colon).

• Browsing Protocol—Select TCP/IP + HTTP server location, TCP/IP, or SSL/TLS + HTTPS serverlocation

• PN Logon Domains—Enter the PN logon domains.

• Storename—Enter the Store Name you want to use (multiple store names are not supported).

• PN Desktop Setup—Select the Show All Applications check box to display all published applicationson the desktop.

•Window Style—Select the Seamless check box to display the connection in a seamless window.

• Application Reconnection—Select the Automatic reconnection at logon check box to enablereconnection, and then select the connect option you want.


Configure Thin Client Settings LocallyNetwork

Drive MappingUse the Drive Mapping tab to map drives on the server to devices on the thin client, and to view and manage(add, edit, and delete) the list of current drives (including drive information) mapped on the thin client.

Figure 11: Drive Mapping

Add Drives

Procedure

Step 1 Clear the Dynamic Mapping check box, and then click Add to open the Citrix Drive Map dialog box.


Configure Thin Client Settings LocallyDrive Mapping

Step 2 Select a drive letter (A to Z) from the Drive Letter list.Step 3 To enable or disable reading and writing for the drive, select or clear the Enable Read and Enable Write

check boxes.Step 4 Select a drive type (USB Floppy, USB CDROM, USB Disk or Memory Stick, or Local or Mounted Disk)

from the Drive Type list.Step 5 (Optional) Enter the directory on the USB device to access in the Base Directory text box.Step 6 Click OK to add the drive to the list of available drives.

Edit and Delete Drives

Procedure

To edit or delete a drive, select a drive from the list of available drives and do one of the following:

• Edit—Click Edit and configure the drive as described in Add Drives, on page 13.

• Delete—Click Delete to remove the drive.

HotkeysUse the Hotkeys tab to map hotkeys on the thin client (select a Hotkey option using the Hotkey lists for eachfunction you want).

Figure 12: Hotkeys


Configure Thin Client Settings LocallyHotkeys

COM PortsUse the COM Ports tab to map COM ports on the server to devices on the thin client, and to view and manage(add and delete) the list of current COM ports (including device information) mapped on the thin client.

Figure 13: COM Ports

Add COM Ports

Procedure

Step 1 Click Add to open the Add COM Port Mapping dialog box.

Step 2 Select a COM Port (1 to 4) from the COM Port list.Step 3 Select a device from the Device list.Step 4 Click OK to add the COM port and device to the list of available COM Ports.


Configure Thin Client Settings LocallyCOM Ports

Delete COM Ports

Procedure

To delete a COM Port, select a COM Port from the list of available COM Ports and click Delete.

DisplayUse the Display tab to set:

• Scroll Adjustment—If you encounter over-scrolling when using certain published applications, increasethe adjustment by 100 until the display improves (maximum scroll adjustment is 1000).

• PrintScreen—Select to use the Print Screen key to capture an image of the desktop to the Clipboard(used for Citrix XCapture support). If the check box is selected, a message appears warning about theinfluence of this setting on other applications.

Figure 14: Display

FirewallUse the Firewall tab to set the firewall options on the thin client:

• Automatically detect proxy—Detects proxy servers automatically.

• Use Alternate Address for Firewalls—Enables connections behind a firewall.


Configure Thin Client Settings LocallyDisplay

• Proxy Type—Select a Proxy Type from the list and if necessary (Secure (HTTPS) or SOCKS), enterthe Proxy Address and Port.

Figure 15: Firewall

Trusted Server ConfigurationUse the Trusted Server Configuration tab to set and enforce the trusted server configuration. To enforce atrusted server configuration, select the Enabled option, select the Enforce trusted server configurationcheck box, enter the Address of the trusted server, and then clickOK (you can also use the Enabled or Disabledoptions to quickly enable or disable the enforcement configuration).

Figure 16: Trusted Server Configuration


Configure Thin Client Settings LocallyTrusted Server Configuration

Configure VDAClick Configure VDA to open the VDA Configuration dialog box.

The Cisco VXC 6215 does not support the configuration of Wyse VDA.

Configure Desktop Appliance SettingsUse the Desktop Appliance Configuration dialog box (clickDesktop Appliance) to configure your thin clientto easily access your XenDesktop. Once the thin client is in Desktop Appliance Mode, a user can login to aXenDesktop with an "Out-of-the-box HDX Plug-n-play" experience.

Figure 17: Desktop Appliance Configuration


Procedure

Step 1 Select the Desktop Appliance Mode check box.Step 2 Enter the XenDesktop URL (this is the location of the XenDesktop server where you can log in and use your

desktop). Note that Desktop Appliance Mode can also be enabled through the INI parametersEnableApplianceMode=Yes and Xendesktop URL=<URL> as described in INI Files Reference Guide forCisco VIrtualization Experience Client 6215. Note also that you can connect to your XenDesktop environmentby using DCHP Option tag 191 on your DHCP server to specify the XenDesktop DDC URL (see Direct theClient to the Server).

Step 3 Click OK to open the confirmation message.


Configure Thin Client Settings LocallyConfigure VDA

vxcc_BK_VBCD2C7D_00_vxc-6215-admin-971_appendix_01000.pdf#unique_91

vxcc_BK_VBCD2C7D_00_vxc-6215-admin-971_appendix_01000.pdf#unique_91

Step 4 Click Yes to reboot the thin client.Step 5 Upon system reboot the thin client will connect to your XenDesktop server and prompt you for your XenDesktop

login credentials (enter your login credentials to access your desktop). The following is a Citrix example.

To exit Desktop Appliance Mode and allow normal log in after system start, administrators can useALT+F4 to display the Desktop Appliance Admin Login dialog box, where you can enter youradministrator login credentials and access the Control Center to use the Desktop Appliance icon andclear the Desktop Appliance Mode check box (be sure to click OK to reboot the thin client).

Tip

Step 6 (Administrators Only) While in Desktop Appliance Mode, administrators can use ALT+F4 to display theDesktop Appliance Admin Login dialog box, where you can enter your administrator login credentials andaccess the Control Center for administrative setup.


Configure Thin Client Settings LocallyConfigure Desktop Appliance Settings

Device SettingsUse the Device Settings dialog box (click Device Settings) to set the parameters of your device, and thenclick OK.

The COM tab will not appear for mobile thin clients.Tip

Terminal NameUse the Terminal Name tab to obtain the device name:

• Contact DHCP server—Obtains the name from the DHCP server.

• DNS reverse lookup—Obtains the name from a DNS reverse lookup.

• Derive from MAC address—Generates the name from the device MAC address.


Configure Thin Client Settings LocallyDevice Settings

• Use the following name—Allows you to manually enter a name.

Figure 18: Terminal Name

HostsUse the Hosts tab to add mappings of IP addresses to hostnames that are not available through DNS (thenames of mapped addresses appear on the Hosts tab):

• Adding an IP address—ClickAdd to open the /etc hosts entry dialog box, enter an IP Address, Hostname(and optionally, Aliases), and then click OK.

• Editing a Host—Select a host from the list, click Edit, and configure the host.

• Deleting a Host—Select a host from the list and click Delete.

Figure 19: Hosts


Configure Thin Client Settings LocallyHosts

Ethernet SpeedUse the Ethernet Speed tab to select the Ethernet speed.

Figure 20: Ethernet Speed

Serial Ports Configuration (COM)Use the Serial Ports Configuration tab to select COM1 and COM2 Speed, Parity, Size, Flow control, and Stopbits (the size of the stop bit with respect to the size of all the other signaling bits in a character).


Configure Thin Client Settings LocallyEthernet Speed

NTPUse the NTP tab to enter the IP Address or hostname of the Network Time Protocol (NTP) server (the currentNTP server is shown) to synchronize the clock time and date of the thin client.

Figure 21: NTP

AdvancedUse the Advanced tab to:

• Enable or disable ReadyMode—You can use ReadyMode for easy login after thin client shut down. Ifthe ReadyMode feature has been enabled (select the ReadyMode check box) and the thin client is shutdown, the session ends, the power button LED is put in a state of OFF, and the thin client is placed inStandby mode to preserve power. Upon pressing the power button, the thin client exits Standby mode,and immediately prompts the user with the login dialog box.


Configure Thin Client Settings LocallyNTP

• Restore default user settings—When you use the Reset to Factory Defaults command button, usercustomizations are deleted. However, add-on applications that you installed are retained, and applicationsthat you removed are not restored.

Figure 22: Advanced

Import CertificatesClicking the Import Certificates icon in the Control Center opens the Import Certificates dialog box. Usethis dialog box to import and manage (add and delete) ICA Digital Certificates as described in the followingsections.

Figure 23: Import Certificates


Configure Thin Client Settings LocallyImport Certificates

Add Certificates from a Remote ServerUse the following guidelines (certificate files you add from a remote server must end with the extension .crt,.cer, or .pem, and be DER-encoded or Base64-encoded):

Procedure

Step 1 In the Import Certificates dialog box, click Add to open the Add Certificate dialog box.

Step 2 Select the Remote Server option, and then click Next to open the Certificate Import Server Settings dialogbox.

Step 3 Select the Remote Certificate Source server option that contains the certificate you want. If you select theUsethe following Server option, enter the Import Server URL (supported protocols are ftp, http, and https) andthe User name, and Password required for that server.

Step 4 Select the certificate file from the Certificate file list (if the Import Server URL, User name, and Passwordare entered correctly, this list automatically displays the names of available certificates on the server).

Step 5 After configuring the Remote Certificate Source server option you selected, click Add.


Configure Thin Client Settings LocallyAdd Certificates from a Remote Server

Add Certificates from a Local Device

Procedure

Step 1 In the Import Certificates dialog box, click Add to open the Add Certificate dialog box.

Step 2 Select the Local Server option, and then click Next to open the Open File dialog box.

Step 3 Use the folders and command buttons to find and select the certificate you want to use.

INI and Upgrade SettingsUse the INI and Upgrade Settings dialog box (click INI Settings) to direct the thin client to the source (serverlocation) of INI files and image updates.

It is recommended to obtain INI files through a DHCP server using DHCP options rather than through astatic IP address.

Caution


Configure Thin Client Settings LocallyAdd Certificates from a Local Device

Cisco VXC 6215 devices also support INI updates through Cisco VXC Manager's DDC.Tip

Figure 24: INI and Upgrade Settings


• Do not use INI files—Use this option when you want to use only locally configured settings (using thethin client dialog boxes available) and do not want to use available INI files on the network or local INIfiles.

• Use INI files from server only—Use this option when you want to use INI files from the specified serveronly (for example, you do not want to use local INI files or do not want to allow INI use whendisconnected from the server for security reasons). When using this option you can direct the thin clientto the server location through either of the following ways:

◦DHCP Server—Select theGet INI andUpgrade server details via DHCP check box. The DHCPserver will direct the thin client (using DHCP options) to the server location where the INI filesand image updates reside.

◦Manually entered server address - Clear theGet INI andUpgrade server details via DHCP checkbox and enter the static INI Settings (INI Server URL, and optionally the Username and Passwordof the server, if selecting the Server requires authentication check box).

• If server is available, use INI files from server only; otherwise use local INI files—Use this option whenyou want to use INI files from the specified server, however, local INI files can be used if that server isunavailable. When using this option you can direct the thin client to the server location through eitherof the following ways:

◦DHCP Server—Select theGet INI andUpgrade server details via DHCP check box. The DHCPserver will direct the thin client (using DHCP options) to the server location where the INI filesand image updates reside.


Configure Thin Client Settings LocallyINI and Upgrade Settings

◦Manually entered server address—Clear the Get INI and Upgrade server details via DHCPcheck box and enter the INI Settings (INI Server URL, and optionally the Username and Passwordof the server, if selecting the Server requires authentication check box).

• Use local INI files only—Use this option when you want to use only local INI files and do not want touse available INI files on the network.

INI files can be cached locally if using the EnableLocal and LocalCopy INI parameters;see INI Files Reference Guide For Cisco Virtualization Experience Client 6215.

Tip

• Image Upgrade Settings—You can click Image Upgrade Settings to configure the INI and upgradesettings as described in Image Upgrade Options, on page 28.

Image Upgrade OptionsUsing the INI and Upgrade Settings dialog box, you can configure how the image on the thin client is updatedif you manually configure the INI server URL as described in INI and Upgrade Settings, on page 26.

In the INI and Upgrade Settings dialog box, click Image Upgrade Settings to open and use the Thin ClientSettings dialog box.

Figure 25: Thin Client Settings


• Update Mode—select one of the following:

◦No Update—Image updates are disabled.

◦Base System & Add-ons—The base image and add-ons are updated at each reboot.

◦Base System Only—Only the base image is updated at each reboot.

◦Add-ons Only—Only add-ons are updated at each reboot.


Configure Thin Client Settings LocallyImage Upgrade Options

• Enter the Update Server URL—If the server from which the thin client updates requires authentication,select the Server required authentication check box and enter the Username and Password.

• Restore factory defaults when updating—When selected, removes all local-machine customizationswhen software is updated from the file server. This setting is enabled by default and is recommended.However, if you want to keep locally defined connections or custom changes to installed applications,you can clear this check box.

In order to update with the Restore Factory Defaults When Updating option disabled,you must have a properly set-up add-ons folder with a directory file that defines whichsoftware versions you want on the thin client. Moreover, it may take two full rebootsto restore the latest software as well as your customizations.

Tip

• Force base system update—If you want to install the image and add-ons available on the file serverregardless of whether they are the same as the currently installed image and add-ons on the thin client,select this check box.

The Restore Factory DefaultsWhen Updating option and the Force Base SystemUpdateoption are useful when you want to fully restore the unit to factory defaults. Theseoptions remove any customizations and install only the base image.

Tip

• Click OK to return to the INI and Upgrade Settings dialog box.

Network ConnectionsUse the Network Connections dialog box (click Network Connections) to configure the settings you wantfor supported network connections. Use the Wired, Mobile Broadband, VPN, and DSL tabs to view andmanage (add, edit, and delete) the list of network connections configured on the thin client. By default, yourthin client obtains information from the DHCP server about network connections (highly recommended), but


Configure Thin Client Settings LocallyNetwork Connections

you can manually enter connection information (provided by your network administrator) to connect to othernetworks (experienced users only).

Figure 26: Network Connections

Currently, 802.1x configuration (using the Enable802 INI parameter) is supported only for Wiredconnections and supported authentications are EAP-PEAP (MSCHAPv2) and EAP-TLS using SCEP.

Important

802.1x AuthenticationSupported seamless 802-1x authenticationworks with SUSE-based Linux thin clients by using Active Directorydomain user credentials for EAP-MSCHAPv2 authentication. EAP-TLS is certificate-based authentication


Configure Thin Client Settings Locally802.1x Authentication

which uses SCEP for certificate enrollment. The following diagram depicts communication between thecomponents in an 802.1x Linux thin client solution.

Figure 27: Major Components of 802.1x

EAP-TLS security requires client side and server side certificates for mutual authentication. Every enduser and client, including the authentication server that participates in EAP-TLS, must have at least thefollowing two certificates:

Note

• Client certificate signed by the certificate authority (CA)

• Copy of the CA root certificate

EAP-PEAP (MSCHAPv2) Authentication WorkflowWhen you initially connect a Cisco VXC 6215 to your network, the thin client will obtain the Guest VLANresources by default. That is, the thin client should be able to reach Active Directory, DNS, and INI servers



to fetch the INI configurations required for Active Directory Domain User Authentication, 802.1x, ImportCerts,and so on.

The following are the steps involved in 802.1x authentication:

1 When the thin client boots up, it remains in the Guest VLAN and downloads the ini configuration fromthe INI server.

2 The INI file must have the configurations for 802.1x, Active Directory server, and Domain and Importcerts. If you are pushing a CA certificate via Cisco VXC Manager, Imports Certs INI is not required, butyou must be sure that the CA certificate name is correct in the 802.1x INI parameter.

3 When the INI is downloaded to the thin client, the user obtains the domain which is configured via theINI in the domain drop down list at the user GDM login screen.

4 The user must then select the domain, and enter the user domain credentials to login to the thin client.Domain User authentication is performed against the AD server named in the INI configuration.

5 If the domain user login is successful and the correct CA certificate is available, then 802.1x authenticationwill begin (users will see the network progress icon on the taskbar) and the thin client will move to theAuthorized VLAN.

If 802.1x authentication fails due to any incorrect 802.1x configuration (or if the CA certificate has expired),the thin client will automatically fall back to the Guest VLAN, and the following notification messageappears to the user at the right corner of the GNOME panel (taskbar): Failed to connect totrusted network. Please contact your system administrator.

6 When the user logs out or restarts the device, the thin client will again move to the Guest VLAN by sendingan EAPOL logoff to the switch and disabling the 802.1x configuration at the Network Connections applet.

The following is an example INI configuration for EAP-PEAP (MSCHAPv2) 802.1x authentication:; AD and Domain settingsDomainList=npac.localDisableDomain=noActiveDirectoryServer=10.150.124.150

; Imports CertficatesImportCerts=yesCerts=npac-ca-cert.pem

; 802-1x ConfigurationEnable802=yes Authentication=PEAP InnerAuthentication=MSCHAPv2PeapVersion=Auto PromptPassword=no CACertificate=npac-ca-cert.pem

EAP-TLS Authentication WorkflowWhen a Linux thin client is initially connected to the network, it should be able to obtain the Guest VLANresources by default (that is, it should be able to reach AD, DNS, SCEP and the INI server to fetch the INIconfigurations required for Active Directory Domain User Authentication, 802.1x, SCEP, and so on. EAP-TLS



802.1x authentication can be configured via INI in 2 different modes: Machine Authentication and UserAuthentication.

EAP TLS Machine Authentication

The following steps are involved with 802.1x authentication:

1 When the thin client boots up, it remains in the Guest VLAN and downloads the INI configuration fromthe INI server.

2 The INI file must have the configurations for 802.1x (EAP-TLS with AuthMode set for MachineAuthentication) and SCEP.

3 Once the INI is downloaded to the thin client, SCEP client enrolls the client certificate with Machinehostname and Domain configured in the INI.

4 802.1x EAP-TLS machine authentication will then begin (you can view the network progress icon in thetaskbar) and the thin client will move to an Authorized VLAN.

5 If 802.1x authentication fails due to any wrong 802.1x configuration, the thin client will automaticallyfall back to the Guest VLAN, with a notification message (Failed to connect to trustednetwork. Please contact your system administrator) in the right corner of theGNOME panel (taskbar). The user receives the same notification in the case of an expired CA certificate.

6 When a user restarts the device, the thin client will again move to the Guest VLAN by sending an EAPOLlogoff to switch and disable the 802.1x configuration at the Network Connections applet.

The following is an example of the INI configuration for 802.1x TLS Machine authentication.Enable802=yes Authentication=TLSPromptPassword=no CACertificate=scepUserCertificate=scep PrivateKey=scepPrivateKeyPassword=ZG90MXg=AuthMode=Machine

EAP TLS User Authentication

The following steps are involved with 802.1x authentication:

1 When the thin client boots up, it remains in the Guest VLAN and downloads the INI configuration fromthe INI server.

2 The INI file must have the configurations for 802.1x, AD server, DomainList, and SCEP.

3 Once the INI is downloaded to the thin client, the user obtains the domain that is configured via INI in thedomain drop-down list on the GDM login screen.

4 The user must then select the domain, and enter their domain credentials to login to the thin client. DomainUser authentication is performed against the AD server mentioned in the INI configuration.

5 If domain user login is successful, then the user certificate will be enrolled via SCEP and 802.1xauthentication will begin (you can view the network progress icon on the taskbar) and the thin client willmove to an Authorized VLAN.

6 If 802.1x authentication fails due to any wrong 802.1x configuration, the thin client will automaticallyfall back to the Guest VLAN, with a notification message ("Failed to connect to trusted network. Pleasecontact your system administrator") in the right corner of the GNOME panel (taskbar). The user receivesthe same notification in the case of an expired CA certificate.



7 After user log-off or a restart of the device, the thin client will again move to the Guest VLAN by sendingan EAPOL logoff to switch and disable the 802.1x configuration at the Network Connections applet.

A successful TLS authenticationwill display security connection information in the Connection Informationdialog box as shown below.

Figure 28: Connection Information

The following is an example of the INI configuration for 802.1x TLS User authentication.Enable802=yes Authentication=TLSPromptPassword=no CACertificate=scepUserCertificate=scep PrivateKey=scepPrivateKeyPassword=ZG90MXg= AuthMode=User

Note

Power ManagementUse the Power Management Preferences dialog box (click Power Management) to select On AC Powerpreferences. Press the Power button to wake the thin client from standby.

Figure 29: Power Management Preferences


Configure Thin Client Settings LocallyPower Management

SCEP Client ConfigurationUse the SCEP Client Configuration dialog box (click SCEP Client Configuration) to direct the thin clientto use automated certificate enrollment (SCEP offers a standard interface to communicate with a CertificateAuthority).

Figure 30: SCEP Client Configuration

SCEP (Simple Certificate Enrollment Protocol) is a PKI communication protocol which leverages existingtechnology by using PKCS#7 and PKCS#10. It includes several properties that allow it to do an automaticenrollment without manual interaction. The typical usage scenarios of SCEP are large network environmentswith many networkdevices that require automatic enrollment of certificates.

Enrollment and usage of SCEP generally follows the following work flow:Tip

1 Obtain a copy of the Certificate Authority (CA) certificate and validate it.

2 Generate a CSR and send it securely to the CA.

3 Poll the SCEP server in order to check whether the certificate was signed.

4 Enroll/re-enroll as necessary in order to obtain a new certificate prior to the expiration of the currentcertificate.

5 Retrieve the CRL as necessary.


• Adding a SCEP Client Configuration Certificate—Click Add to open the SCEP Certificate EnrollmentSettings dialog box, enter a Certificate Name (Certificate file name must be unique), SCEP Server URL,Enrollment challenge password, CADistinguished Name, and then clickOK to create a SCEP certificateentry for a CA enrollment.


Configure Thin Client Settings LocallySCEP Client Configuration

After adding a certificate, the newly added certificate entries will be displayed in theSCEP Client Configuration dialog box

Note

Figure 31: SCEP Client Enrollment Settings

• Editing a SCEP Certificate—Select a certificate from the list, click Edit, and configure the certificatesettings.

• Deleting a SCEP Certificate—Select a certificate from the list, click Delete, and then confirm.

• Enroll a SCEP Certificate—Select a certificate from the list and clickEnroll. After successful certificateenrollment, the Status columnwill display as Enrolled (in a case of failure, the Status columnwill displayas Failed.

TCX USB VirtualizerYou can click TCX USB Virtualizer to open the TCX USB Virtualizer Configuration Utility dialog box.The Cisco VXC 6215 does not support TCX configuration.

User AdministrationUse the User Administration dialog box (clickUser Administration) to view and edit passwords for all users(both built-in defaults and those defined through INI files) and to enable automatic login for a user(automatically log in a user at system start up). In addition, you can manage SSH root User password andlogin (using the SSH Root User tab).

While this dialog box allows you to edit the passwords and automatic login for users of the thin client,you must use central configuration (INI files) to add or delete users beyond the built-in default usersprovided. In general, it is recommended that you use user.ini files to manage (add, edit, or delete) usersfor normal use cases. For example, a new user should be created through a user.ini file with the appropriateprivilege level defined in the text file.

Caution

To edit a user password, select the change password check box you want, and then enter a new password inthe New Password and Confirm Password boxes.


Configure Thin Client Settings LocallyTCX USB Virtualizer

The Users tab can be a convenient way to locally change the password and enable automatic login for aspecific user.

Tip

Figure 32: User Administration

Configure Cisco VXC Manager Agent SettingsUse the Cisco VXC Manager Agent Configuration dialog box (click Cisco VXC-M) to configure the CiscoVXC Manager server location and discovery settings.

You can use this dialog box to specify which method the client uses to discover Cisco VXC Manager. Bydefault, all discovery methods listed are enabled. You can also use this dialog box to manually specify theCisco VXC Manager server IP address. In addition, you can specify the number of Cisco VXC Managercheckins that the device can miss before the device reenables the specified discovery methods. (The defaultis 15 checkins; 0 specifies to not reenable discovery if Cisco VXC Manager checkins fail.)

After the device is discovered, the discovery preferences specified on CiscoVXCManager (under ConfigurationManager > Preferences > Discovery) take precedence over the settings specified on the client (either throughthe GUI or using the MgmtDiscoveryMethod INI parameter).


Configure Thin Client Settings LocallyConfigure Cisco VXC Manager Agent Settings

It is recommended that after configuring, you reboot the thin client.Tip

Figure 33: Cisco VXC Manager Agent Configuration Dialog Box

To configure the Cisco VXC Manager server location:

Procedure

Step 1 Enter the Cisco VXC Manager Server IP address.Step 2 Enter the Non-secure Port (HTTP) for client to server communication (default is 80).Step 3 Enter the Secure Port (HTTPS) for client to server communication (default is 443).Step 4 Select the Discovery Settings you want. For more information on Cisco VXCManager, see your Cisco VXC

Manager documentation.Step 5 Click OK.

After you reboot the thin client, the thin client performs a checkin with the Cisco VXC Manager.


Configure Thin Client Settings LocallyConfigure Cisco VXC Manager Agent Settings

configure thin client settings locally · configure thin client settings locally...

Documents