Colleague Remote Access

Service (CRAS)
User Guide

Author Chris Wilkin

Version 0.7
Date 09/11/2018

Page | 1
Table of Contents
1. Introduction 3
2. How to Get Started 4
2.1 How to request CRAS via IT Self Service Portal using Service Anywhere 4
2.2 Desktop Transformation Programme (DTP) roll out to existing GRAS users 5
3. Registration & Activation 6
3.2 Soft Token process 7
3.3 Hard Token (by exception) 8
3.4 Laptop device - desktop application (CISCO – AnyConnect Secure Mobility Client) 9
4. Logging On 10
4.2 Wired: using a LAN cable and router for home use 13
5. Logging Off 16
6. Support / FAQs 17
6.1 CRAS Support Contact 17

Page | 2
1. Introduction

CRAS (Colleague Remote Access Service) is the new Bank only service for remote access
into our dedicated Bank VPN (virtual private network), which will only work on our
Windows 10 desktop operating system. It replaces the existing GRAS service currently
supplied by BT, which can only be accessed using a Windows XP desktop.

This guide will provide you with important information and instructions on how to use
the new service, plus key contact points for technical issues or troubleshooting.

a.

Page | 3
2. How to Get Started

2.1 How to request CRAS via IT Self Service Portal using

Service Anywhere

You can request CRAS through the IT Self Service Portal, as you do today, for any other IT
Service request.

Follow these steps to order CRAS (areas to navigate to will be highlighted by a Red outline):

> Open web browser Internet Explorer 11 (IE11) or Edge

> From the Bank Intranet Home page, navigate to Support & Resource

> Select Self Service

> Select IT Catalogue
> From the IT Catalogue home page, click on Service Anywhere
> Service Anywhere will launch and the below screen may appear. If yes, click on Login Using
Regulated AD. (If using Service Anywhere for the first time, please refer to the User Guide
for that service)

> The below Service Anywhere Menu will be displayed

Page | 4
> Select Catalogue
> Navigate to the Search function
> Input CRAS into the search field and click Enter
> Select CRAS New User
> Complete the required fields and submit. Ensure you have the required Cost Centre owner
approval for requesting the service
> Request complete

2.2 Desktop Transformation Programme (DTP) roll out

to existing GRAS users

For those colleagues that are existing users of the legacy and shared GRAS service, provided
by BT – the Desktop Transformation Programme will migrate colleagues to the new CRAS
service, as part of their Deployment Plan.

This is subject to the following conditions:

A. You are eligible for the CRAS service. Please note, colleagues that are laptop users are not
automatically entitled to be given access to the CRAS service – please refer to the End User
Device Policy for further information and guidance

B. Your current user information as a Windows XP user has been captured, approved by your
Business Champion and formally accepted by the Programme.

From March 2019, Section 2.2 will no longer be applicable.

Page | 5
3. Registration & Activation

3.1 Downloading the RSA Secure ID app for Android,

iPhone (IOS) & Windows (Not available for Blackberry)

Follow the below instructions to download the RSA Secure ID application for your smart
phone type:

> On your smart phone device, navigate to the relevant app store for your Operating System
the e (the below example is for iPhone)

>1. Search for RSA Secure >2. Once found, select RSA >3. Check the application
ID Secure ID to download to has been successfully
your smart phone device downloaded and installed
onto your smart phone
device

Page | 6
3.2 Soft Token process
To activate your Soft Token, following the below instructions:

> Before starting the activation process, you must have received an email from SCC with
information needed to activate your Soft Token. This will include a QR Code
> Once you have this email, print it off for best results
> If you do not have the email, do not continue – as you will be unable to activate your Soft
Token.
> Select the SecurID application on your phone to open it
1. Select the + symbol at 2. A menu will appear at the
the bottom left of the bottom of the screen with two
screen options 1) Scan QR Code and
2) Enter Link

> Select Get Started

Page | 7
> A pop up message will ask for permission to access your smart phone camera, select Allow

> Using your smart phone camera via the RSA Secure ID
application, scan the QR Code from the email you have
printed (this is a very quick process)

> Once the QR Code has been accepted, the following Token Code screen will appear:

> The Token Code will show and is eight digits long and recycles every 60 seconds
> Your Soft Token set up process is now complete and ready to use

Page | 8
3.3 Hard Token (by exception)
A Hard Token to use for the CRAS service will only be issued by exception.

Please speak with your Leader to confirm if a Hard Token can be issued instead of using a
Soft Token.

Requests for Hard Tokens are placed through the IT Self Service Portal via Service Anywhere.

A Hard Token will only generate a six digit code.

3.4 Laptop device - desktop application (CISCO –

AnyConnect Secure Mobility Client)
For those colleagues who will be using the CRAS service, Cisco AnyConnect will be installed
onto your laptop device. To access the application, follow the below instructions:

> Turn on your laptop device

> Enter your Bit Locker password
> Log on to your laptop device using your Regulated User Name and Password
> Once logged on to your laptop device, select the Cisco AnyConnect application

If the Cisco AnyConnect application is not pinned to your task bar, use the Search function to
find it
> See Section 4 for how to log on to CRAS

Page | 9
4. Logging On

There are three ways to access the CRAS service from your laptop device, using a Soft Token.

4.1 Wireless: using WiFi

> Once logged on to your laptop device, select the WiFi connections icon. This will not
appear if a LAN cable is inserted in the Ethernet port

> Your device will pick up all the local WiFi networks within your immediate area
> Select your preferred WiFi service
> In the Enter The Network Security Key field, enter the WiFi password and click Connect

> Once the WiFi connection has been successfully made, select the Cisco AnyConnect
Application

A. First Time Set Up Only – Setting Up Your Cisco AnyConnect Passcode

Page | 10
> From the Cisco AnyConnect screen, select Primary from the drop down list (it should be
the default setting) and click Connect. Use Secondary if you cannot connect via Primary

> The Log In dialogue box will appear

> Enter your Username – this will be your Regulated LAN ID

> In the Password field, enter an eight digit Soft Token Code from your smart phone
> A new dialogue box will appear, enter the six digit passcode you want (can only be six
digits) and click Continue

> You will be prompted to re-enter your six digit passcode and click Continue
> The following dialogue box will display

> Wait for a new eight digit Token Code to cycle, then input into the Answer field and click

Page | 11
Continue
> You may be required to do this several times before the request is successful. After three
attempts with the same Soft Token Code, wait for a new Code to generate
> If successful, the Log On screen will display

> Re-enter your Regulated LAN ID

> In the Password field, you need to enter your six digit passcode and the eight digit Soft
Token code (or six digit Hard Token code) in one continuous string of numbers (no spaces
between them)
> If successful, the following screen will display

> Post initial set up, when logging on to the CRAS service via Cisco AnyConnect, you need to
enter your six digit passcode and the eight digit Soft Token code (or six digit Hard Token
code) in one continuous string of numbers (no spaces between them) in the Password field
> You are now connected to the Bank’s network and access as required for your role

B. Ongoing Access

> When logging on to the CRAS service via Cisco AnyConnect, enter your six digit passcode
and the eight digit Soft Token code (or six digit Hard Token code) in one continuous string of
numbers (no spaces between them) in the Password field
> Select Enter
> You will be connected to CRAS
> Access the Bank network as required for your role

Page | 12
4.2 Wired: using a LAN cable and router for home use

Accessing CRAS using a LAN cable is very similar to wireless. The steps listed below will only
concentrate on the physical connection activity, as there is no difference to the system
access to CRAS.

> Ensure you have a LAN cable long enough to connect between your Modem / Router and
laptop device
> Connect the LAN cable to a spare port in your Modem / Router
> Then connect the LAN cable into the Ethernet port on the right hand side of the laptop
device (if viewing the screen). The bottom of the Ethernet port pulls down slightly, to allow
the LAN cable to be inserted

> Access Cisco AnyConnect as per the Wireless instructions in Section 4.1

4.3 Personal Hotspots

You can use your smart phone (not Blackberry devices) – whether Bank issued or personal,
to create a Personal Hotspot to connect to CRAS.

Firstly, you will need to enable the Personal Hotspot settings on your smart phone (example
given is for an iPhone):

> 1. Access the Settings for your device > 2. Enable Personal Hotspot

Page | 13
> Turn on your laptop device
> Enter your Bit Locker password
> Log on to your laptop device using your Regulated User Name and Password
> Once logged on to your laptop device, select the WiFi connections icon. This will not
appear if a LAN cable is inserted in the Ethernet port
> Your device will pick up the Personal Hotspot created by your smart phone and will display
the name of the device as described in your Settings

For this example, it describes ‘iPhone’

> Select your smart phone device as described in the WiFi Connections icon as highlighted
below

> In the Enter The Network Security Key field, enter the WiFi password as displayed in the
Personal Hotspot section of your smart phone device and click Connect

Personal Hotspot WiFi Password

Page | 14
> Your smart phone device will connect via its Personal Hotspot, the same as WiFi
connections display

Your device will show as connected here

> Once the Personal Hotspot connection has been successfully made, select the Cisco
AnyConnect Application
> Follow the instructions for Cisco AnyConnect as described in Section 4.1

Page | 15
5. Logging Off

Logging off of CRAS is straight forward:

> While in the Cisco AnyConnect application, click on Disconnect

> Cisco AnyConnect will disconnect from the CRAS service
> You are now safe to log off and shut down your device

Page | 16
6. Support / FAQs

Our CRAS service is supported by <put in name> between the hours of <put in operating
hours> and to be contacted for technical faults or issues.

6.1 CRAS Support Contact

> Call our IT Service Desk on x1929 (internal) / 0343 208 2208 (external)
> The menu will be offered and chose # for Windows 10 requests / incidents
> Chose Option 3 for CRAS

6.2 Key contact information, Including Lost & Stolen

Our IT Service Desk can be contacted via the following channels:

> Email: [email protected]

> Phone: x1929 (internal) / 0343 208 2208 (external)
> Opening Times:

Monday – Friday: 7.30 am to 5pm

Saturday: 9am-1pm

Bank issued devices

If your Bank issued smart phone device has been lost or stolen, you must report this
immediately to the IT service desk on the contact number above.

The reporting of any lost or stolen device is critically important as the Bank may have
reporting obligations to its external stakeholders.

6.3 New smart phone devices

If you have a new smart phone device (whether Bank issued or personal), you will need to
re-download the RSA Secure ID application and then activate it – see Section 3.

In order to activate your Soft Token, you will need to request a new QR Code.

> Open web browser Internet Explorer 11 (IE11) or Edge

> From the Bank Intranet Home page, navigate to Support & Resource

> Select Self Service

> Select IT Catalogue
> From the IT Catalogue home page, click on Service Anywhere

Page | 17
> Service Anywhere will launch and the below screen may appear. If yes, click on Login Using
Regulated AD. (If using Service Anywhere for the first time, please refer to the User Guide
for that service)
> The below Service Anywhere Menu will be displayed

> Select Catalogue

> Navigate to the Search function
> Input CRAS into the search field and click Enter
> Select Activate RSA Secure ID
> Complete the required fields and submit
> Request complete
> Once you have received the email with the new QR Code, following the instructions in
Section 3

Page | 18