Administration Guide 43Connecting Using a Web Addresstication policy check fails, the users receive an error message instructing them to contact their systemadministrator.For more information about pre-authentication policies, see “Global policies” on page 96.Double-source Authentication Portal PageWhen the Firebox SSL VPN Gateway is configured to require users to log on using two types of authenti-cation, such as LDAP and RSA SecurID, they are directed automatically to the Web page or Secure AccessClient dialog box and users enter their user name and passwords.NoteWhen a user logs on using double authentication, the authentication is checked in the opposite orderthat is configured in the realm.For example, if the primary authentication type is LDAP and thesecondary is RSA SecurID, the SecureID credentials are checked first, and then the LDAP credentials. Ifthe user log on fails the first authentication, the second authentication is not checked.For more information about double-source authentication, see “Configuring Double-SourceAuthentication” on page 85.Connecting Using a Web AddressUsers can connect to the Firebox SSL VPN Gateway using a Web browser by typing the Web address,such as https://vpn.mycompany.com. When the IP address or FQDN of the Firebox SSL VPN Gateway isentered and double-source authentication is configured, users are routed automatically to the logonportal page as shown below.Double-source authentication portal pageAfter entering the user name, the user then enters the passwords for each authentication type. After thecredentials are entered, the specified portal page appears and the user completes the connection fromthis portal page. The connection can be either full access or kiosk mode.The double-source authentication portal page cannot be customized.Connecting Using Secure Access ClientUsers can connect to the Firebox SSL VPN Gateway using the Secure Access Client that is downloadedand installed on their computer. When double-source authentication is configured, users see a dialogbox that requires their user name and passwords for each authentication type. After the users enter thecredentials, they click Connect.
