Configure and Install a Jumpoint

Setup of a Jumpoint on a remote network is a multi-step process that includes configuration on the /login interface, downloading the installer, and running the installation wizard.

Before configuring a Jumpoint, it is important to understand the difference between clustered Jumpoints and standalone Jumpoints because they have different feature sets and because a clustered Jumpoint cannot be converted to standalone, nor a standalone Jumpoint converted to clustered.

A clustered Jumpoint allows you to install up to ten redundant nodes of the same Jumpoint on different host systems in the same local network. A clustered Jumpoint is available as long as at least one of the installed nodes is online. This provides redundancy, preventing the failure of all Jump Items associated with the failure of a single, standalone Jumpoint, and improves load balancing across the system.

All configuration of clustered Jumpoints is done in /login, with no local configuration available on the local host either during or after the install. This means that if you install a clustered Jumpoint, selecting the Bomgar Jumpoint Configuration item on the start menu of the Jumpoint host does not result in a configuration window, and only an About box is shown. Editing a clustered Jumpoint in /login loads the same configuration page which was used to create the Jumpoint. This means clustered Jumpoint configuration lacks the following options which are available to standalone Jumpoints:

  • Proxy
  • Intel vPro
  • Shell Jump
  • TTL

This also means that a clustered Jumpoint cannot be configured as a Jumpzone Proxy. vPro, RDP, VNC, Shell Jump, and normal Jump sessions are all supported when using clustered Jumpoints; however, the advanced configuration of these features is not available. This includes settings such as provisioned SSH hosts, vPro reimaging, Jumpzone Proxy, TTL, etc.

Configuration

  1. From the /login administrative interface, go to Jump > Jumpoint.

Jump > Jumpoint

Jumpoint Management

Edit Jumpoint

  1. Click Add New Jumpoint.
  2. Create a unique name to help identify this Jumpoint. This name should help users locate this Jumpoint when they need to start a session with a computer on its same network.
  3. Set a code name for integration purposes. If you do not set a code name, one is created automatically.
  4. Add comments to help identify this Jumpoint.
  5. Leave the Disabled checkbox unchecked.
  6. Check the Clustered checkbox, if appropriate.
  7. A Clustered Jumpoint allows you to install multiple, redundant nodes of the same Jumpoint on different host systems. If this option is selected, the Jumpoint is available as long as at least one of the installed nodes is online. This provides redundancy, preventing the failure of all Jump Items associated with the failure of a single, standalone Jumpoint, and improves load balancing across the system. All configuration of clustered Jumpoints is done in /login, with no local configuration available during the install. Once created, a clustered Jumpoint cannot be converted to standalone, nor a standalone Jumpoint converted to clustered.

    IMPORTANT!

    Jumpoint cluster nodes must be installed on hosts residing in the same local area network.

  1. If you want users to be able to connect to SSH-enabled and Telnet-enabled network devices through this Jumpoint, check Enable Shell Jump Access. For more information on Shell Jump, see Shell Jump.
  2. From the Jumpoint edit page, you may authorize users to start sessions through this Jumpoint. After the Jumpoint has been created, you can also grant access to groups of users from Users & Security > Group Policies and to embassy groups from Users & Security > Embassy.
  3. Save the configuration. Your new Jumpoint should now appear in the list of configured Jumpoints.

Note: Once you have installed the Jumpoint, the table populates the hostname of the system it is installed on, as well as that system's public and private IP addresses. This information can help you locate the Jumpoint's host system in case you need to change the Jumpoint's configuration.

Note: At the bottom of the Jumpoint page is the option to Enable network browsing. If checked, a permitted user can view and select systems from the network directory tree. If unchecked, a user can access a system through a Jumpoint only by entering the system's hostname or IP address. Either way, the user must provide valid credentials to the remote system before gaining access.

Download

Now that your Jumpoint is configured, you must install the Jumpoint on a single system in the remote network you wish to access. This system serves as the gateway for Jump sessions with other computers on the remote network. You can either install the Jumpoint directly to the host or email the installer to a user at the remote system. If this is to be a clustered Jumpoint, you will be able to add nodes later.

  1. From the table, find the appropriate Jumpoint and click the link to download either the 32-bit or 64-bit installer file (bomgar-jpt-{uid}.exe).
  1. If you are at the system you want to use as the Jumpoint host, you can run the installation file immediately.
  2. Otherwise, save the file and then transfer it to and deploy it on the system that will serve as the Jumpoint host.

Note: If you need to change the Jumpoint's host system, click Redeploy. The Jumpoint uninstalls from its current location, and the download links become available. You can now install the Jumpoint on a new host. The new Jumpoint replaces the old one for any existing Jump shortcuts that are associated with it. The new Jumpoint does not copy over the configuration from the old Jumpoint and must be reconfigured during installation.

Installation

Bomgar Jumpoint Setup

  1. From the system that will host the Jumpoint, run the installation package. When the installation wizard appears, click Next.

 

Waiver Agreement

  1. Read and accept the waiver agreement. You must accept the agreement to be able to proceed with the installation.

 

Disclaimer

  1. Read and agree to the disclaimer.

 

Choose Install Location

  1. Choose where you would like the Jumpoint to install. The default location is C:\Program Files\Bomgar\Jumpoint or C:\Program Files (x86)\Bomgar\Jumpoint.
  2. Click Install. If you are installing a single Jumpoint, the Bomgar Jumpoint Configuration window opens after a moment. If you are installing a clustered Jumpoint node, the installation finishes.

 

Proxy

Note: In the case of clustered Jumpoints, keep in mind that there is no customization available at the local level. As a result, you will not see the configuration window that allows for Proxy and other configuration items available for standalone Jumpoints. If you are installing a clustered Jumpoint, you may skip the following steps and go directly to Clustered Jumpoint Setup: Adding Nodes.

Jumpoint Proxy Configuration: Basic

For a Jumpoint to be deployed on a remote network that is behind a proxy, appropriate proxy information may be necessary for the Jumpoint to connect back to the Bomgar Appliance.

  1. From dropdown on the Proxy tab, select Basic or NTLM to configure proxy settings.
  2. Enter the Proxy Host, Proxy Port, Username and Password. The Jumpoint supplies this proxy information whenever Jumping to another system on the remote network, providing the credentials necessary to download and run the customer client on the target system.

 

Jumpoint Proxy Server

  1. You also can set up this Jumpoint to function as a proxy itself by selecting Jump Zone Proxy Server from the dropdown on the Proxy tab. With Jump Zone Proxy Server selected, this Jumpoint can be used to proxy connections for customer clients and Jump Clients on the network that do not have a native internet connection, such as POS systems. Using a Jumpoint as a proxy routes traffic only to the appliance. If there is a direct connection available, clients attempt to use that connection in preference to the Jump Zone Proxy. For more information on deploying Jump Clients, see the Jump Client Guide.

Note: In order for a Jumpoint to function as a Jump Zone Proxy Server, its host system cannot reside behind a proxy. The Jumpoint must be able to access the internet without having to supply proxy information for its own connection.

  1. Enter the hostname to use at the listening interface, and set which port to use.

IMPORTANT!

Host and port fields should be set carefully since any Jump Client deployed using this Jumpoint as a proxy server uses the settings available to it at the time of deployment and is not updated should the host or port change. If the host or port must be changed, the Jump Client must be redeployed.

  1. Set whether to allow all IP addresses or to limit the IPs that can connect through this proxy.
  2. If allowing or denying access, enter one IP address or CIDR subnet range per line.

Note: It is a best practice to make an exception in the Windows firewall for the port on which the proxy server listens for the process which accepts connections.

 

Intel® vPro

Intel vPro :: Authentication

Note: Intel vPro configuration is available only for standalone Jumpoints. Clustered Jumpoints do not have this option.

Using Intel® Active Management Technology, privileged users can support fully provisioned Intel® vPro Windows systems below the OS level, regardless of the status or power state of these remote systems. Configure this Jumpoint to enable vPro connection by going to the Intel® vPro tab and checking Enable Intel® vPro.

Note: For a representative to use Intel® vPro support, they must be granted access to a Jumpoint with Intel® vPro enabled and must have the user account permission Allowed Jump Methods: Intel® vPro.

Authentication

  1. Under Authentication, designate how the Jumpoint should attempt to authenticate to vPro-provisioned computers. Regardless of the authentication method, the provided credentials must match the authentication settings in the AMT firmware on the vPro systems.
  2. To require representatives to provide credentials each time they connect to a vPro computer, select Basic Digest Password and then Prompt Representative for credentials.

    Prompting for credentials is useful if the vPro systems on this network do not share a common username and password. However, since the vPro AMT firmware is entirely separate from any user accounts on the computer, administrators frequently provision all vPro systems to have the same credentials.

    Additionally, note that there is little security risk in storing credentials in the Jumpoint. To use vPro support, a representative must have not only the vPro user account privilege but also access to the vPro-enabled Jumpoint. Therefore, prompting for credentials may be an unnecessary measure.
  3. If the same credentials are used for all vPro systems on the network, you can select Basic Digest Password and then Use the following credentials for all connections. With this configuration, representatives are never prompted for vPro credentials; the Jumpoint automatically supplies the stored username and password for all vPro connections.
  4. If you select Kerberos, the Jumpoint supplies the credentials for the account that the Jumpoint service is running as. These credentials can be modified to be a specific account that has permissions to access the AMT system. This configuration assumes that the account hosting the Jumpoint uses the same credentials as all provisioned vPro systems to which you wish to connect. With this configuration, representatives are never prompted for vPro credentials.

Encryption

Intel vPro :: Encryption

  1. On the Encryption tab, set how the Jumpoint encrypts vPro network traffic.
  2. If the remote vPro systems are provisioned not to use TLS encryption, simply select No Encryption.
  3. Otherwise, select TLS Encryption and define the path to the Base 64-encoded CER file which contains the certificates used during the provisioning of the remote vPro systems.

 

Disk Redirection

Intel vPro :: Disk Redirection

  1. Under Disk Redirection, specify the folder location of any ISO or IMG disk images you would like to make available for mounting in a vPro session. Representatives can use these files for IDE-R, booting the remote vPro system to a disk image rather than the hard drive.

 

Shell Jump

Shell Jump :: Policy

Note: While Shell Jump can be enabled and disabled from /login for both standalone Jumpoints and clustered Jumpoints, further configuration is available only to standalone Jumpoints; therefore, this section of the guide applies to standalone Jumpoints only.

The Shell Jump tab determines how this Jumpoint can be used to connect to SSH-enabled and Telnet-enabled network devices.

Note: Shell Jump must also be enabled on the Jump > Jumpoint page of the administrative interface. For a representative to use Shell Jump, they must be granted access to a Jumpoint with Shell Jump enabled and must have the user account permission Allowed Jump Methods: Shell Jump.

Policy

  1. On the Policy tab, if Open Access is selected, permitted representatives can Shell Jump to any remote device by entering its hostname or IP address or by selecting it from a list of provisioned devices.
  2. If Limited Access is selected, representatives can Shell Jump to provisioned devices or can enter a device's hostname or IP address provided that it falls within the parameters set by the host list on the Limited tab.
  3. If Provisioned Only is selected, representatives can Shell Jump only to provisioned devices.

 

Shell Jump :: Limited

Limited

  1. If limited access is enabled on the Policy tab, the Limited list accepts IP addresses and CIDR subnet masks to which Shell Jump access is limited.

 

Provisioned

Shell Jump :: Provisioned

  1. Configure access to provisioned Shell Jump targets by going to the Provisioned tab and clicking Add.

 

Provisioned Host Configuration

  1. Enter a Name to help representatives identify this device when starting a Shell Jump session with it.
  2. Enter the device's hostname or IP address.
  3. Choose the Protocol to use, either SSH or Telnet.
  4. Port automatically switches to the default port for the selected protocol but can be modified to fit your network settings.
  5. Select the Terminal Type, either xterm or VT100.
  6. If you are using SSH, you can choose to use Public Key Authentication. If you choose to do so, select a Private Key to use. Private keys are configured from the Private Keys tab.
  7. Representatives Shell Jumping to this provisioned device may connect only with the Username you provide.
  8. You can also select to Send null packets to keep idle sessions from ending. Enter the number of seconds to wait between each packet send.

Private Keys

Shell Jump :: Private Keys

  1. If you are using SSH, you can upload a key file to use by going to the Private Keys tab and clicking Add.

 

Key Configuration

  1. Give this key a Name and browse to the key File you wish to use. Keys must be in PuTTY format (PPK). PuTTYgen can be used to generate a PPK file if needed.
  2. If a Password is required, you can check Store key file password to save the password for all representatives to use, or you can require representatives to enter the key file password each time they connect to a provisioned device using this key.

 

SSH Host Keys

Shell Jump :: SSH Host Keys

  1. You can add SSH Host Keys prior to a representative's Jumping to that host. If no host key is cached, the representative receives a message alerting them that the server's host key is not cached and that there is no guarantee that the server is the computer they think it is. Caching a server's host key prior to connection can help prevent confusion.

 

SSH Host Key

  1. Enter the hostname or IP address.
  2. Enter the Port the device uses.
  3. The server then returns its host key, which you should verify.
  4. Clicking Update polls the device for its host key and lets you know if it has changed.

 

TTL

Time to Live

Note: TTL configuration is available only for standalone Jumpoints. Clustered Jumpoints do not have this option.

A date and time can be set to specify when the Jumpoint should become active and when it should automatically uninstall. Setting these delimiters determines the duration of time for which users can access the remote network through this Jumpoint.

  1. To activate this Jumpoint as soon as its setup is complete, select Always Active.
  2. Alternatively, select Do Not Activate Until, and then set a date and time upon which this Jumpoint should become active.
  3. To keep this Jumpoint available without a designated uninstall date, select Do Not Automatically Uninstall.
  4. Otherwise, select Automatically Uninstall At, and then set a date and time upon which this Jumpoint should uninstall itself.

 

Jumpoint Setup Completion and Revision

Bomgar Jumpoint Setup Complete

After installing the Jumpoint, you receive a confirmation message. Click Finish.

If you installed a standalone Jumpoint, the configuration options can be modified by locating the Bomgar folder in the Windows All Programs or Programs and Features menu, opening the site subfolder, and running Bomgar Jumpoint Configuration.

If you installed a clustered Jumpoint, selecting the Bomgar Jumpoint Configuration item on the start menu of the Jumpoint host does not result in a configuration window, and only an About box is shown

 

Clustered Jumpoint Setup: Adding Nodes

The steps for creating a clustered Jumpoint in /login are the same as for a standalone, with only one difference: once you have created the clustered Jumpoint, you can add nodes to it. At least one node needs to be installed for the Jumpoint to be online.

  1. From the table, find the appropriate Jumpoint and click the Add Node link to download either the 32-bit or 64-bit installer file (bomgar-jpt-{uid}.exe).
  1. If you are at the system you want to use as the Jumpoint host, you can run the installation file immediately.
  2. Otherwise, save the file and then transfer it to and deploy it on the system that will serve as the Jumpoint host.

Jumpoint cluster installed

  1. Follow the prompts and install the node. Note that there are no configuration screens of any kind.
  2. In the Jumpoint table, the clustered Jumpoint now shows information about each installed node, including public and private IP addresses and online or offline status.

Nodes can be deleted but cannot be individually edited. In the representative console, none of the nodes are visible, only the clustered Jumpoint under which they are installed. Nodes function as redundant connection points. When a user needs to use the Jumpoint, one of the nodes is selected randomly. At least one node must be online for the Jumpoint to work.