Manuals / WatchGuard Technologies / Household Appliance / Water Heater

WatchGuard Technologies SSL VPN manual

Models: SSL VPN

1 198

Page 197

failover servers 55 General Networking 14, 47 logging 14, 137 managing licenses 15, 36 Name Service Providers 14, 47 Network Time Protocol 15 restarting 15

restarting appliance 45 restoring configuration 15, 44 routes 14, 48, 52, 54

save configuration 15, 44 shut down 15, 45 SNMP 139

static route 53 statistics 15, 140 Syslog settings 138 system date and time 45 upgrading 15, 44

VPN Installation Services 7

W3C-formatted log 138

WatchGuard Certified Training Partners 8 WatchGuard users forum 5, 6

WCTP 8

Web address

of Administration Portal 32 of Java client 126

Web Interface

access without credentials 143 applications not available 143 configuring as portal page 15 invalid credentials 144 single sign-on 15 troubleshooting 143

whois query 141 wildcard certificates 116

WINS

IP address 50 name resolution 14

WINS server setting 50

WINS, see Name Service Providers

xNetTools 17, 141

ZoneAlarm Pro 152

Administration Guide

187

Page 197

Image 197

Contents

Firebox SSL VPN Gateway SUPPORT ADDRESSSALES ABOUT WATCHGUARDContents Setting Up the Firebox SSL VPN Gateway Hardware Configuring Secure Certificate ManagementFirebox SSL VPN Gateway Administration Desktop The Firebox SSL VPN Gateway operates as followsUsing the Serial Console Configuring Authentication and Authorization Using SafeWord for Citrix or SafeWord RemoteAccess for Authentication Generating a Secure Certificate for the Firebox SSL VPN Gateway APPENDIX A Firebox SSL VPN Gateway Monitoring and Troubleshooting Combining the Private Key with the Signed Certificate VPN Gateway CHAPTER 1 Getting Started with Firebox SSLAudience Operating System RequirementsThreat responses, alerts, and expert advice LiveSecurity Service SolutionsEasy software updates Access to technical support and trainingSoftware Update LiveSecurity Service BroadcastsInformation Alert Threat ResponseActivating LiveSecurity Service LiveSecurity Service Self Help ToolsBasic FAQs New from WatchGuardKnown Issues Advanced FAQsWatchGuard Users Forum Fireware “How To”’sUsing the WatchGuard Users Forum LiveSecurity Service technical supportOnline Help Product DocumentationVPN Installation Service Firebox Installation ServiceService time Training and Certificationa certification exam. The training materials include links to books and web sites with more information about network security Overview CHAPTER 2 Introduction to Firebox SSL VPN GatewayOverview Network topology showing the TCP circuitAuthentication and one-timepasswords New FeaturesNew versions of the Secure Access Client Configurable symmetric encryption ciphersDisable desktop sharing Secure Access Client connectionsDisable kiosk mode Automatic port redirectionNTLM authentication and authorization support FeaturesUpdated serial console menu Administration ToolUser Groups, Local Users, and Resources Firebox SSL VPN Gateway SettingsAuthentication and Authorization Server Upgrade FeatureEnable External Administration Saving and RestoringServerConfigurationThe User Experience Feature SummaryConnecting to the Firebox SSL Access Portal Deployment and AdministrationPlanning your deployment Planning your deploymentAuthentication Support Configuring Secure Certificate Management•A cross-overcable and a Windows computer To physically connect the Firebox SSL VPN Gateway Setting Up the Firebox SSL VPN Gateway HardwareTo configure TCP/IP settings using a serial cable Firebox SSL VPN Gateway Administration Tool To configure TCP/IP Settings Using Network CablesTo configure TCP/IP settings using network cables The Firebox SSL VPN Gateway operates as follows Using the Firebox SSL VPN GatewayTo redirect unsecure connections 2Click the General Networking tabTo configure a proxy server Starting the Secure Access ClientOperation through Firewalls and Proxies Establishing the Secure TunnelAdministration Guide Performance and Real-TimeTrafficUsing the Firebox SSL VPN Gateway Connecting to a Server Load Balancer Using Kiosk ModeAdministration Guide Using the Firebox SSL VPN GatewayFirebox SSL VPN Gateway Using the Firebox SSL VPN GatewayCHAPTER 3 Configuring Basic Settings Downloads Tab Firebox SSL VPN Gateway Administration DesktopUsing the Administration Portal Admin Users Tab Using the Serial ConsoleMaintenance Tab To change the administrator passwordTo open the serial console Using the Administration ToolTo download and install the Administration Tool Upgrading the tunnel and tunnel upgrade license To publish Firebox SSL VPN Gateway settingsProduct Activation and Licensing In SyncTo manage licenses on the Firebox SSL VPN Gateway Managing LicensesTesting Your License Installation To install a license fileTo test your configuration Information about Your LicensesUsing the Default Portal Page Using Portal Pages7Click My own computer and then click Connect 1Click the VPN Gateway Cluster tabVariable Content inserted by variableUsing the ActiveX Control Linking to Clients from Your Web Site Enabling Portal Page AuthenticationTo enable portal page authentication Pre-AuthenticationPolicy Portal Page Multiple Log On Options using the Portal PageSecure Desktop Access Secure Application AccessConnecting Using Secure Access Client Connecting Using a Web AddressDouble-sourceAuthentication Portal Page Double-sourceauthentication portal pageTo save the Firebox SSL VPN Gateway configuration Saving and Restoring the ConfigurationTo restore a saved configuration To upgrade the Firebox SSL VPN GatewayShutting Down the Firebox SSL VPN Gateway Restarting the Firebox SSL VPN GatewayFirebox SSL VPN Gateway System Date and Time To restart the Firebox SSL VPN GatewayAllowing ICMP traffic To enable ICMP trafficTo change the system date and time Network Time ProtocolGateway Network Connections CHAPTER 4 Configuring Firebox SSL VPNConfiguring Network Information General Networking General NetworkingDuplex mode External Public FQDNVPN port IP addressTo enable split DNS Name Service ProvidersTo edit the HOSTS file DNS Server 1, DNS Server 2, DNS ServerEnable Dynamic Gateway Configuring Network RoutingDynamic and Static Routing To remove an entry from the HOSTS fileEnabling RIP Authentication for Dynamic Routing Configuring Dynamic RoutingTo configure dynamic routing To enable RIP authentication for dynamic routingChanging from Dynamic Routing to Static Routing Configuring a Static RouteTo save dynamic routes to the static route table To add a static routeTo test a static route Static Route ExampleTo remove a static route Network topology showing a static routeConfiguring Internal Failover Configuring Firebox SSL VPN Gateway FailoverTo set up the example static route To enable internal failoverConfiguring Network Access Controlling Network Access1Click the Global Cluster Policies tab Specifying Accessible NetworksEnabling Split Tunneling To enable split tunneling Denying Access to Groups without an ACLConfiguring User Groups 1Click the Global Cluster Policies tabImproving Voice over IP Connections To deny access to user groups without an ACLEnabling Improving Voice over IP Connections 1Click the Global Cluster Policies tab1Click the Global Cluster Policies tab To improve latency for UDP trafficConfiguring Authentication and Authorization CHAPTER 5 Configuring Authentication andAuthorization Configuring Authentication and Authorization Using a Local User List for Authentication Configuring Authentication without AuthorizationThe Default Realm Changing Password for Users Configuring Local UsersAdding Users to Multiple Groups To add a user to a groupTo change a user’s password Configuring the Default RealmTo remove and create a Default realm 4In Authorization Type, select LDAP Authorization3On the Action menu, select Remove Default realm Creating Additional RealmsTo create a realm Using SafeWord for Authentication To configure SafeWord on the Access Gateway To disable Firebox SSL VPN Gateway authenticationSafeWord PremierAccess Authorization Server To configure the IAS RADIUS realm1Click the Authentication tab 5Select Local computer and click Finish 23In Attribute format, select String default RADIUS=Standard22Under Vendor-assignedattribute number, type To configure RADIUS authorization To specify RADIUS server authenticationChoosing RADIUS Authentication Protocols 1Click the Authentication tabLDAP Server LDAP authenticationUser Attribute Case Sensitive5Click the Authentication tab To configure LDAP authentication1Click the Authentication tab LDAP Authorization To configure LDAP authentication LDAP authorization group attribute fields1Click the Authentication tab 4Click the Authentication tabTo configure LDAP authorization To install and set up the LDAP Browser Using certificates for secure LDAP connectionsDetermining Attributes in your LDAP Directory To upload a secure client certificate for LDAPHost Using RSA SecurID for AuthenticationPort Base DN5 For Agent type, select UNIX Agent 1Click the Authentication tab To enable RSA SecurID authenticationConfiguration Files Resetting the node secret Configuring RSA Settings for a ClusterConfiguring Gemalto Protiva Authentication To reset the node secret on the RSA ACE/ServerTo configure NTLM authentication Configuring NTLM Authentication and Authorization1Click the Authentication tab 5Click the Authentication tab3In Authorization type, select NTLM authorization Configuring NTLM AuthorizationTo configure NTLM authorization 1On the Authentication tab, click Authentication Configuring Double-SourceAuthenticationTo prevent caching of one-timepasswords To change the password labels Changing Password Labels1Click the Access Policy Manager tab Adding Local UsersTo create a user on the Firebox SSL VPN Gateway To delete a user from the Firebox SSL VPN Gateway User Group OverviewTo create a local user group Creating User GroupsTo remove a user group 1Click the Access Policy Manager tabDefault group properties Configuring Properties for a User GroupTo enable or disable Default group properties Forcing Users to Log on Again1Click the Access Policy Manager tab Enabling domain logon scriptsTo enable session time-out To enable logon scriptsEnabling session time-out 1Click the Access Policy Manager tabSetting Application Options Configuring Web Session Time-OutsTo enable Web session time-outs To disable desktop sharingEnabling Split DNS To configure IP pooling for a groupEnabling IP Pooling To allow failover to a user’s local DNSChoosing a portal page for a group Client certificate criteria configurationTo specify a portal page for a group 3In Use this custom portal page, select the pageTo specify client certificate configuration Configuring Resources for a User GroupTo create pre-authenticationpolicies Global policiesGroup resources include Group properties includeAdding Users to Multiple Groups Defining network resources To configure resource access control for a groupTo remove a resource from a user group 1Click the Access Policy Manager tab1Click the Access Policy Manager tab To create and configure a network resourceApplication policies To configure an application policyTo add a network resource to a group To remove a network resourceTo deny one application network access Configuring file share resourcesTo add an application policy to a group To deny applications without policiesTo create and configure a kiosk resource Configuring kiosk modeTo create a file share resource To remove a shareEnd point resources and policies Configuring end point resourcesTo create an end point resource 1Click the Access Policy Manager tabTo delete an end point resource Configuring an end point policy for a groupTo create an end point policy for a group 1Click the Access Policy Manager tab1Click the Access Policy Manager tab Setting the Priority of GroupsTo build an end point policy expression To set the priority of groups Configuring Pre-AuthenticationPoliciesTo view the group priorities for a user To create pre-authenticationpoliciesFirebox SSL VPN Gateway Setting the Priority of GroupsCertificates CHAPTER 7 Creating and Installing SecureOverview of the Certificate Signing Request Password-ProtectedPrivate KeysTo create a Certificate Signing Request Creating a Certificate Signing Request1Click the VPN Gateway Cluster tab Creating Root Certificates Using a Command Prompt Installing Multiple Root CertificatesResetting the Certificate to the Default Setting To reset the default certificate1Click the Global Cluster Policies tab Client CertificatesTo require client certificates Installing Root Certificates Wildcard Certificates Requiring Certificates from Internal ConnectionsSystem Requirements CHAPTER 8 Working with Client ConnectionsOperating Systems Web BrowsersTo connect using the default portal page Using the Access PortalTo remove the Linux VPN client Connecting from a Private ComputerThe Firebox SSL VPN Gateway operates as follows sbin/service net6vpnd startipconfig/all or route print Establishing the Secure TunnelOperation through Firewalls and Proxies Connecting from a Private ComputerAdministration Guide ActiveX Helper Using the Secure Access Client WindowAdministration Guide To log on to the Firebox SSL VPN GatewayConnecting from a Private Computer To disconnect the Secure Access Client To use the Secure Access Client status propertiesTo disconnect the Secure Access Client To manually configure a proxy serverTo view the Connection Log Connections Using Kiosk Mode Connecting from a Public Computercomputer To enable kiosk modeCreating a Kiosk Mode Resource To add a file share to a kiosk resource Working with File Share ResourcesTo create and configure a kiosk resource 1Click the Access Policy Manager tabClient Applications To enable client applicationsTo remove a file share To work with file share resourcesTo configure Remote Desktop To configure FirefoxFirefox Web Browser Remote Desktop clientVNC Client Telnet 3270 Emulator ClientGaim Instant Messenging To use the SSH clientTo use Gaim Supporting Secure Access ClientConnection handling Managing Client ConnectionsTo enable a user at a particular MAC address To disable a user at a particular MAC addressClosing a connection to a resource Disabling and enabling a user4Click OK Firebox SSL VPN Gateway Managing Client ConnectionsAPPENDIX A Firebox SSL VPN Gateway Monitoring and TroubleshootingViewing and Downloading System Message Logs To view and filter the system logViewing the W3C-FormattedRequest Log Forwarding System Messages to a Syslog Server3Click Logging/Settings 4Under Gateway Log, click Display Logging WindowEnabling and Viewing SNMP Logs To enable logging of SNMP messagesMulti Router Traffic Grapher Example 2 Under SNMP Settings, select Enable SNMPMonitoring Firebox SSL VPN Gateway Operations Viewing System StatisticsEthereal Network Analyzer Firebox SSL Real-timeMonitorxNetTools TracerouteBacking up your configuration settings Reinstalling v 4.9 application softwareUpgrading to SSL v Upgrading to SSL vLaunching the v 5.5 Administration Tool TroubleshootingTroubleshooting the Web Interface Applications do not Appear after Logging OnWeb Interface Credentials Are Invalid Other IssuesRead/Write Access to the Firebox SSL VPN Gateway Ping Command Defining Accessible NetworksLDAP Authentication VMWareInternal Failover The Administration Tool Is InaccessibleCertificate Signing Certificate Revocation ListsSecure Access Client Certificates Using 512-bitkeypairsSecure Access Client Connections with Windows XP DNS Name Resolution Using Named Service ProvidersUsing Third-PartyClient Software NTLM AuthenticationClient Connections from a Windows Server WINS EntriesVPN Gateway APPENDIX B Using Firewalls with Firebox SSLMcAfee Personal Firewall Plus To view Secure Access Client status propertiesBlackICE PC Protection Sygate Personal Firewall Free and Pro Versions Norton Personal FirewallTiny Personal Firewall ServicesZoneAlarm Pro 4Click Install from Internet and then click Next APPENDIX C Installing Windows CertificatesTo install Cygwin To unencrypt the private key Unencrypting the Private Keyopenssl verify -verbose -CApath /tmp certFile Converting to a PEM-FormattedCertificateBEGINRSA PRIVATE KEY <Unencrypted Private Key> Intermediate Certificate Administration GuideIntermediate Certificate Intermediate Certificate Firebox SSL VPN Gateway Administration Guide APPENDIX D Examples of Configuring Network Access•Global Cluster Policies •Authentication Collecting the LDAP directory information Collecting the LDAP Directory Information ou=Users,dc=ace,dc=com cn=Users,dc=ace,dc=com 2Click the Global Cluster Policies tab Configuring Accessible NetworksTo configure accessible networks 5In Realm Name, type Default 1Click the Access Policy Manager tab 1Click the Access Policy Manager tab10.10.0.0/24 10.60.10.0/24 10.10.25.50/32 Administration Guide Creating a Guest User Authentication Realm 1Click the Access Policy Manager tab Creating Local UsersTo add the local users 2Expand User Groups and then expand Local Users 1Click the Access Policy Manager tabAPPENDIX E Legal and Copyright Information GNU GENERAL PUBLIC LICENSE change be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or NO WARRANTY END OF TERMS AND CONDITIONS Administration Guide Firebox SSL VPN Gateway Index Page Page Page Page Page Page Firebox SSL VPN Gateway