WatchGuardFireboxSSL VPN Gateway Administration Guide
 Address
 Contents
 Installing the Firebox SSL VPN Gateway for the First Time
Planning for Security with the Firebox SSL VPN Gateway
 To download the portal page templates to your local computer
 Configuring Firebox SSL VPN Gateway Network Connections
Configuring Authentication without Authorization
 Using Ldap Servers for Authentication and Authorization
Configuring Ntlm Authentication and Authorization
 Digital Certificates and Firebox SSL VPN Gateway Operation
Requiring Certificates from Internal Connections
 Recovering from a Failure of the Firebox SSL VPN Gateway
 Appendix B Using Firewalls with Firebox SSL VPN Gateway
 Audience
Operating System Requirements
 Easy software updates
LiveSecurity Service Solutions
Threat responses, alerts, and expert advice
Access to technical support and training
 LiveSecurity Service Broadcasts
Information Alert
 LiveSecurity Service Self Help Tools
Activating LiveSecurity Service
Click Register
 Click Self Help Tools
To get access to the LiveSecurity Service Self Help Tools
WatchGuard Users Forum
Click your selection
 Online Help
LiveSecurity Service technical support
Using the WatchGuard Users Forum
Product Documentation Technical Support
 Training and Certification
Firebox Installation Service
VPN Installation Service
LiveSecurity Gold
 Training and Certification
 Introduction to Firebox SSL VPN Gateway
Overview
 Network topology showing the TCP circuit
Overview
 New versions of the Secure Access Client
New Features
Authentication and one-time passwords
Configurable symmetric encryption ciphers
 Additional control over Secure Access Client connections
Secure Access Client connections
Disable desktop sharing
Disable kiosk mode
 Added challenge-response to Radius user authentication
Features
Ntlm authentication and authorization support
Updated serial console menu
 Following table maps the Firebox SSL VPN Gateway settings
Firebox SSL VPN Gateway Settings
Authentication and Authorization
User Groups, Local Users, and Resources
 Feature FireboxSSL VPN Gateway Server Upgrade
 Feature Summary
User Experience
 Deployment and Administration
Connecting to the Firebox SSL Access Portal
 Planning your deployment
Deploying the Firebox SSL VPN Gateway in the Network DMZ
Deploying the Firebox SSL VPN Gateway in a Secure Network
 Planning for Security with the Firebox SSL VPN Gateway
Configuring Secure Certificate Management
Authentication Support
RSA SecurID
 Installing the Firebox SSL VPN Gateway for the First Time
Getting Ready to Install the Firebox SSL VPN Gateway
 Setting Up the Firebox SSL VPN Gateway Hardware
Configuring TCP/IP Settings for the Firebox SSL VPN Gateway
To physically connect the Firebox SSL VPN Gateway
 To configure TCP/IP settings using a serial cable
 To configure TCP/IP Settings Using Network Cables
Power on the Firebox SSL VPN Gateway
 Firebox SSL VPN Gateway operates as follows
Using the Firebox SSL VPN Gateway
Redirecting Connections on Port 80 to a Secure Port
To redirect unsecure connections
 Starting the Secure Access Client
To configure a proxy server
 Establishing the Secure Tunnel
Operation through Firewalls and Proxies
 Performance and Real-Time Traffic
 Using Kiosk Mode
Connecting to a Server Load Balancer
 Using the Firebox SSL VPN Gateway
 Using the Firebox SSL VPN Gateway
 Configuring Basic Settings
 Firebox SSL VPN Gateway Administration Desktop
Using the Administration Portal
Downloads Tab
 Maintenance Tab
Using the Serial Console
Admin Users Tab
To change the administrator password
 Using the Administration Tool
To download and install the Administration Tool
To open the serial console
 Upgrading the tunnel and tunnel upgrade license
Publishing Settings to Multiple Firebox SSL VPN Gateways
To publish Firebox SSL VPN Gateway settings
Product Activation and Licensing
 Managing Licenses
To manage licenses on the Firebox SSL VPN Gateway
 To test your configuration
To install a license file
Testing Your License Installation
Information about Your Licenses
 To block external access to the Administration Portal
Blocking External Access to the Administration Portal
Using Portal Pages
Using the Default Portal
 Variable Content inserted by variable
Downloading and Working with Portal Page Templates
 To work with the templates for Windows and Linux users
Using the ActiveX Control
Kiosk mode only
Save the file
 Linking to Clients from Your Web Site
Enabling Portal Page Authentication
To enable portal page authentication
To remove a portal file from the Firebox SSL VPN Gateway
 To configure multiple log on options
Multiple Log On Options using the Portal
Pre-Authentication Policy Portal
On the Gateway Portal tab, select Redirect to URL
 Double-source Authentication Portal
Connecting Using a Web Address
Connecting Using Secure Access Client
Double-source authentication portal
 To restore a saved configuration
Saving and Restoring the Configuration
To save the Firebox SSL VPN Gateway configuration
To upgrade the Firebox SSL VPN Gateway
 Firebox SSL VPN Gateway System Date and Time
Restarting the Firebox SSL VPN Gateway
Shutting Down the Firebox SSL VPN Gateway
To restart the Firebox SSL VPN Gateway
 To change the system date and time
To enable Icmp traffic
Allowing Icmp traffic
Network Time Protocol
 Configuring Firebox SSL VPN Gateway Network Connections
Configuring Network Information
 General Networking
Firebox SSL VPN Gateway located inside the firewall
 MTU
 To edit the Hosts file
Name Service Providers
To enable split DNS
To add an entry to the Hosts file
 Configuring Network Routing
Dynamic and Static Routing
To remove an entry from the Hosts file
 To configure dynamic routing
Configuring Dynamic Routing
Enabling RIP Authentication for Dynamic Routing
To enable RIP authentication for dynamic routing
 To save dynamic routes to the static route table
Configuring a Static Route
Changing from Dynamic Routing to Static Routing
To add a static route
 To remove a static route
Static Route Example
To test a static route
Network topology showing a static route
 To set up the example static route
Configuring Firebox SSL VPN Gateway Failover
Configuring Internal Failover
To enable internal failover
 Controlling Network Access
Configuring Network Access
 Enabling Split Tunneling
Specifying Accessible Networks
To give the Firebox SSL VPN Gateway access to a network
Click the Global Cluster Policies tab
 Denying Access to Groups without an ACL
To enable split tunneling
Configuring User Groups
 Enabling Improving Voice over IP Connections
To deny access to user groups without an ACL
Improving Voice over IP Connections
Specific ciphers used to encrypt the UDP traffic include
 To improve latency for UDP traffic
 Configuring Authentication Authorization
Configuring Authentication and Authorization
 Configuring Authentication and Authorization
 Using a Local User List for Authentication
Configuring Authentication without Authorization
Default Realm
On the Authentication tab, select an authorization realm
 Adding Users to Multiple Groups
Configuring Local Users
Changing Password for Users
To add a user to a group
 Changing the Authentication Type of the Default Realm
Using Ldap Authorization with Local Authentication
Configuring the Default Realm
 To create a realm
Configure the settings for the realm and then click Submit
Creating Additional Realms
Do one of the following
 Configuring SafeWord Settings on the Access Gateway
Using SafeWord for Authentication
Configuring Secure Computing SafeWord Authentication
Removing Realms
 To disable Firebox SSL VPN Gateway authentication
SafeWord PremierAccess Authorization
To configure SafeWord on the Access Gateway
 Using Radius Servers for Authentication and Authorization
To configure the IAS Radius realm
Server
 Select Local computer and click Finish
Click Close and then click OK
Policy name, give the policy a name and click Next
 Attribute format, select String
Attribute value, type the attribute name and the groups
 Choosing Radius Authentication Protocols
To specify Radius server authentication
To configure Radius authorization
Complete the settings using the attributes defined in IAS
 Using Ldap Servers for Authentication and Authorization
Ldap authentication
 This table contains examples of the base dn
To configure Ldap authentication
Realm Name, type a name for the authentication realm
Following table contains examples of bind dn
 Ldap Authorization
 Ldap authorization group attribute fields
Group memberships from group objects working evaluations
 To configure Ldap authorization
 Ldap Administrator Password, type the password
Using certificates for secure Ldap connections
To install and set up the Ldap Browser
Determining Attributes in your Ldap Directory
 Using RSA SecurID for Authentication
To look up Ldap attributes
 For Agent type, select Unix Agent
 To enable RSA SecurID authentication
Configuration Files
 Configuring Gemalto Protiva Authentication
Configuring RSA Settings for a Cluster
Resetting the node secret
To reset the node secret on the RSA ACE/Server
 Configuring Ntlm Authentication and Authorization
To configure Ntlm authentication
 To configure Ntlm authorization
Configuring Ntlm Authorization
Configuring Authentication to use One-Time Passwords
Authorization type, select Ntlm authorization
 Select Use the password one time and click Submit
Configuring Double-Source Authentication
To prevent caching of one-time passwords
On the Authentication tab, click Authentication
 Changing Password Labels
To change the password labels
 Adding Local Users
To create a user on the Firebox SSL VPN Gateway
 User Group Overview
To delete a user from the Firebox SSL VPN Gateway
 Creating User Groups
To create a local user group
To remove a user group
 To enable or disable Default group properties
Configuring Properties for a User Group
Default group properties
Forcing Users to Log on Again
 Enabling domain logon scripts
Configuring Secure Access Client for single sign-on
To configure Secure Access Client for single sign-on
Left pane, right-click a group and then click Properties
 Enabling session time-out
To enable logon scripts
To enable session time-out
Left pane, right-click a group and click Properties
 Configuring Web Session Time-Outs
Setting Application Options
Disabling Desktop Sharing
 Enabling IP Pooling
To configure IP pooling for a group
Enabling Split DNS
To allow failover to a user’s local DNS
 Client certificate criteria configuration
Choosing a portal page for a group
To specify a portal page for a group
 To create pre-authentication policies
Configuring Resources for a User Group
To specify client certificate configuration
Global policies
 Group properties include
Group resources include
 Adding Users to Multiple Groups
 To configure resource access control for a group
Defining network resources
To remove a resource from a user group
 To create and configure a network resource
22, 80
 To add a network resource to a group
To configure an application policy
Application policies
To remove a network resource
 Configuring file share resources
To deny one application network access
To add an application policy to a group
 To create a file share resource
Configuring kiosk mode
To create and configure a kiosk resource
To remove a share
 To create an end point resource
Configuring end point resources
End point resources and policies
Click Registry Rule
 To create an end point policy for a group
Configuring an end point policy for a group
To delete an end point resource
If you selected Process Rule, do the following
 Setting the Priority of Groups
To build an end point policy expression
Under End Point Scan Expression, select Auto-build
 To view the group priorities for a user
Configuring Pre-Authentication Policies
To set the priority of groups
Click the Group Priority tab
 108
 Creating and Installing Secure Certificates
 Password-Protected Private Keys
Digital Certificates and Firebox SSL VPN Gateway Operation
Overview of the Certificate Signing Request
 Creating a Certificate Signing Request
To create a Certificate Signing Request
 To upload a certificate using the Administration Portal
Installing Root Certificates on the Firebox SSL VPN Gateway
To install a certificate file using the Administration Tool
Locate the file you want to upload and click Open
 Resetting the Certificate to the Default Setting
Installing Multiple Root Certificates
Creating Root Certificates Using a Command Prompt
To reset the default certificate
 Client Certificates
To require client certificates
 Selecting an Encryption Type for Client Connections
Installing Root Certificates on a Client Device
Obtaining a Root Certificate from a CertificateAuthority
To select an encryption type for client connections
 Requiring Certificates from Internal Connections
Wildcard Certificates
 System Requirements
Operating Systems
Web Browsers
 Using the Access Portal
To connect using the default portal
 To remove the Linux VPN client
Connecting from a Private Computer
Sbin/service net6vpnd start
Firebox SSL VPN Gateway operates as follows
 Tunneling Private Network Traffic over Secure Connections
Establishing the Secure Tunnel
 Administration Guide 121
 Using the Secure Access Client Window
ActiveX Helper
 To log on to the Firebox SSL VPN Gateway
 To use the Secure Access Client status properties
To disconnect the Secure Access Client
To close the window, click Close
 Configuring Proxy Servers for the Secure Access Client
To manually configure a proxy server
To view the Connection Log
 Connecting from a Public Computer
Connections Using Kiosk Mode
 To log on to the Firebox SSL VPN Gateway using kiosk mode
Creating a Kiosk Mode Resource
To enable kiosk mode
Enter your network logon credentials and click Login
 Working with File Share Resources
To add a file share to a kiosk resource
 To remove a file share
To enable client applications
Client Applications
To work with file share resources
 Firefox Web Browser
Remote Desktop client
SSH Client
 Telnet 3270 Emulator Client
VNC Client
Gaim Instant Messenging
 Supporting Secure Access Client
To use Gaim
 Managing Client Connections
Connection handling
 Closing a connection to a resource
To disable a user at a particular MAC address
To enable a user at a particular MAC address
Disabling and enabling a user
 Administration Guide 135
 136
 Viewing and Downloading System Message Logs
To view and filter the system log
 Forwarding System Messages to a Syslog Server
Viewing the W3C-Formatted Request Log
 Enabling and Viewing Snmp Logs
To enable logging of Snmp messages
Under Snmp Settings, select Enable Snmp
Multi Router Traffic Grapher Example
 Multi Router Traffic Grapher configuration file
Viewing System Statistics
Monitoring Firebox SSL VPN Gateway Operations
 Recovering from a Failure of the Firebox SSL VPN Gateway
To open the Firebox SSL VPN Gateway Administration Desktop
Monitoring applications are as follows
 Apply the v 5.5 software update
Reinstalling v 4.9 application software
Backing up your configuration settings
Upgrading to SSL v
 Troubleshooting the Web Interface
Troubleshooting
Launching the v 5.5 Administration Tool
Web Interface Appears without Typing in Credentials
 Web Interface Credentials Are Invalid
Other Issues
Read/Write Access to the Firebox SSL VPN Gateway
License File Does not Match Firebox SSL VPN Gateway
 Ldap Authentication
Defining Accessible Networks
Ping Command
VMWare
 Certificate Signing
Administration Tool Is Inaccessible
Internal Failover
Certificate Revocation Lists
 Secure Access Client Connections with Windows XP
Certificates Using 512-bit keypairs
Secure Access Client
DNS Name Resolution Using Named Service Providers
 Client Connections from a Windows Server
Ntlm Authentication
Using Third-Party Client Software
Wins Entries
 Appendix B Using Firewalls with Firebox SSL VPN Gateway
 To view Secure Access Client status properties
BlackICE PC Protection
McAfee Personal Firewall Plus
 Norton Personal Firewall
Sygate Personal Firewall Free and Pro Versions
Tiny Personal Firewall
 ZoneAlarm Pro
Add
 To install Cygwin
Click Install from Internet and then click Next
New column for those two entries, click Skip
 To unencrypt the private key
To generate a CSR using the Cygwin Unix environment
Unencrypting the Private Key
Double-click the Cygwin icon on the desktop
 To convert the certificate from PKCS7 to PEM format
Converting to a PEM-Formatted Certificate
Combining the Private Key with the Signed Certificate
Openssl verify -verbose -CApath /tmp certFile
 Generating Trusted Certificates for Multiple Levels
To combine the private key with the signed certificate
To generate trusted certificates for multiple levels
 Intermediate Certificate
 158
 Appendix D Examples of Configuring Network Access
 Scenario 1 Configuring Ldap Authentication and Authorization
 Administration Guide 161
 Collecting the Ldap Directory Information
 Ldap Server User Attributes Case Sensitive
 If necessary, select Enable split tunneling
Configuring Accessible Networks
To configure accessible networks
10.10.0.0/24 10.60.10.0/24
 Creating an Ldap Authentication and Authorization Realm
Realm Name, type Default
 Creating and Assigning Network Resources to the User Groups
Creating and Assigning Network Resources to the Sales Users
 To provide the Engineering users with access to the network
 Creating an Application Policy for an Email Server
To implement the application policy for the email server
 Administration Guide 169
 Creating a Guest User Authentication Realm
 To create a guest authentication realm for the guest users
Creating Local Users
To add the local users
 Scenario 3 Configuring Local Authorization for Local Users
 Appendix E Legal and Copyright Information
 174
 Administration Guide 175
 176
 No Warranty
 END of Terms and Conditions
 Administration Guide 179
 180
 Index
 DNS
 FTP
 LiveSecurity Service activating 4 benefits of 2 broadcasts
 Administration Guide 185
 Connection to 28 service scanner 141 session timeout 15, 88
 Wctp
 188