Manuals / WatchGuard Technologies / Household Appliance / Water Heater

WatchGuard Technologies SSL VPN manual Network topology showing the TCP circuit, Overview

Models: SSL VPN

1 198

Page 20

Overview

As shown in the following illustration, the Firebox SSL VPN Gateway is appropriate for employees accessing the organization remotely and intranet access from restricted LANs such as wireless networks.

Network topography showing the Firebox SSL VPN Gateway in the DMZ.

The following illustration shows how the Firebox SSL VPN Gateway creates a secure virtual TCP circuit between the client computer running the Secure Access Client and the Firebox SSL VPN Gateway.

Network topology showing the TCP circuit.

10	Firebox SSL VPN Gateway

Page 20

Image 20

WatchGuard Technologies SSL VPN manual Network topology showing the TCP circuit, Overview

Contents

Firebox SSL VPN Gateway ADDRESS SUPPORTSALES ABOUT WATCHGUARDContents Configuring Secure Certificate Management Setting Up the Firebox SSL VPN Gateway HardwareFirebox SSL VPN Gateway Administration Desktop The Firebox SSL VPN Gateway operates as followsUsing the Serial Console Configuring Authentication and Authorization Using SafeWord for Citrix or SafeWord RemoteAccess for Authentication Generating a Secure Certificate for the Firebox SSL VPN Gateway APPENDIX A Firebox SSL VPN Gateway Monitoring and Troubleshooting Combining the Private Key with the Signed Certificate CHAPTER 1 Getting Started with Firebox SSL VPN GatewayAudience Operating System RequirementsLiveSecurity Service Solutions Threat responses, alerts, and expert adviceEasy software updates Access to technical support and trainingLiveSecurity Service Broadcasts Software UpdateInformation Alert Threat ResponseLiveSecurity Service Self Help Tools Activating LiveSecurity ServiceBasic FAQs New from WatchGuardAdvanced FAQs Known IssuesWatchGuard Users Forum Fireware “How To”’sLiveSecurity Service technical support Using the WatchGuard Users ForumOnline Help Product DocumentationFirebox Installation Service VPN Installation ServiceService time Training and Certificationa certification exam. The training materials include links to books and web sites with more information about network security CHAPTER 2 Introduction to Firebox SSL VPN Gateway OverviewNetwork topology showing the TCP circuit OverviewNew Features Authentication and one-timepasswordsNew versions of the Secure Access Client Configurable symmetric encryption ciphersSecure Access Client connections Disable desktop sharingDisable kiosk mode Automatic port redirectionFeatures NTLM authentication and authorization supportUpdated serial console menu Administration ToolUser Groups, Local Users, and Resources Firebox SSL VPN Gateway SettingsAuthentication and Authorization Feature Server UpgradeEnable External Administration Saving and RestoringServerConfigurationFeature Summary The User ExperienceDeployment and Administration Connecting to the Firebox SSL Access PortalPlanning your deployment Planning your deploymentConfiguring Secure Certificate Management Authentication Support•A cross-overcable and a Windows computer Setting Up the Firebox SSL VPN Gateway Hardware To physically connect the Firebox SSL VPN GatewayTo configure TCP/IP settings using a serial cable Firebox SSL VPN Gateway Administration Tool To configure TCP/IP Settings Using Network CablesTo configure TCP/IP settings using network cables Using the Firebox SSL VPN Gateway The Firebox SSL VPN Gateway operates as followsTo redirect unsecure connections 2Click the General Networking tabStarting the Secure Access Client To configure a proxy serverEstablishing the Secure Tunnel Operation through Firewalls and ProxiesAdministration Guide Performance and Real-TimeTrafficUsing the Firebox SSL VPN Gateway Using Kiosk Mode Connecting to a Server Load BalancerUsing the Firebox SSL VPN Gateway Administration GuideUsing the Firebox SSL VPN Gateway Firebox SSL VPN GatewayCHAPTER 3 Configuring Basic Settings Downloads Tab Firebox SSL VPN Gateway Administration DesktopUsing the Administration Portal Using the Serial Console Admin Users TabMaintenance Tab To change the administrator passwordTo open the serial console Using the Administration ToolTo download and install the Administration Tool To publish Firebox SSL VPN Gateway settings Upgrading the tunnel and tunnel upgrade licenseProduct Activation and Licensing In SyncManaging Licenses To manage licenses on the Firebox SSL VPN GatewayTo install a license file Testing Your License InstallationTo test your configuration Information about Your LicensesUsing Portal Pages Using the Default Portal Page7Click My own computer and then click Connect 1Click the VPN Gateway Cluster tabContent inserted by variable VariableUsing the ActiveX Control Linking to Clients from Your Web Site Enabling Portal Page AuthenticationTo enable portal page authentication Multiple Log On Options using the Portal Page Pre-AuthenticationPolicy Portal PageSecure Desktop Access Secure Application AccessConnecting Using a Web Address Connecting Using Secure Access ClientDouble-sourceAuthentication Portal Page Double-sourceauthentication portal pageSaving and Restoring the Configuration To save the Firebox SSL VPN Gateway configurationTo restore a saved configuration To upgrade the Firebox SSL VPN GatewayRestarting the Firebox SSL VPN Gateway Shutting Down the Firebox SSL VPN GatewayFirebox SSL VPN Gateway System Date and Time To restart the Firebox SSL VPN GatewayTo enable ICMP traffic Allowing ICMP trafficTo change the system date and time Network Time ProtocolGateway Network Connections CHAPTER 4 Configuring Firebox SSL VPNConfiguring Network Information General Networking General NetworkingExternal Public FQDN Duplex modeVPN port IP addressName Service Providers To enable split DNSTo edit the HOSTS file DNS Server 1, DNS Server 2, DNS ServerConfiguring Network Routing Enable Dynamic GatewayDynamic and Static Routing To remove an entry from the HOSTS fileConfiguring Dynamic Routing Enabling RIP Authentication for Dynamic RoutingTo configure dynamic routing To enable RIP authentication for dynamic routingConfiguring a Static Route Changing from Dynamic Routing to Static RoutingTo save dynamic routes to the static route table To add a static routeStatic Route Example To test a static routeTo remove a static route Network topology showing a static routeConfiguring Firebox SSL VPN Gateway Failover Configuring Internal FailoverTo set up the example static route To enable internal failoverControlling Network Access Configuring Network Access1Click the Global Cluster Policies tab Specifying Accessible NetworksEnabling Split Tunneling Denying Access to Groups without an ACL To enable split tunnelingConfiguring User Groups 1Click the Global Cluster Policies tabTo deny access to user groups without an ACL Improving Voice over IP ConnectionsEnabling Improving Voice over IP Connections 1Click the Global Cluster Policies tabTo improve latency for UDP traffic 1Click the Global Cluster Policies tabConfiguring Authentication and Authorization CHAPTER 5 Configuring Authentication andAuthorization Configuring Authentication and Authorization Using a Local User List for Authentication Configuring Authentication without AuthorizationThe Default Realm Configuring Local Users Changing Password for UsersAdding Users to Multiple Groups To add a user to a groupConfiguring the Default Realm To change a user’s passwordTo remove and create a Default realm 4In Authorization Type, select LDAP Authorization3On the Action menu, select Remove Default realm Creating Additional RealmsTo create a realm Using SafeWord for Authentication To configure SafeWord on the Access Gateway To disable Firebox SSL VPN Gateway authenticationSafeWord PremierAccess Authorization Server To configure the IAS RADIUS realm1Click the Authentication tab 5Select Local computer and click Finish 23In Attribute format, select String default RADIUS=Standard22Under Vendor-assignedattribute number, type To specify RADIUS server authentication To configure RADIUS authorizationChoosing RADIUS Authentication Protocols 1Click the Authentication tabLDAP authentication LDAP ServerUser Attribute Case Sensitive5Click the Authentication tab To configure LDAP authentication1Click the Authentication tab LDAP Authorization LDAP authorization group attribute fields To configure LDAP authentication1Click the Authentication tab 4Click the Authentication tabTo configure LDAP authorization Using certificates for secure LDAP connections To install and set up the LDAP BrowserDetermining Attributes in your LDAP Directory To upload a secure client certificate for LDAPUsing RSA SecurID for Authentication HostPort Base DN5 For Agent type, select UNIX Agent 1Click the Authentication tab To enable RSA SecurID authenticationConfiguration Files Configuring RSA Settings for a Cluster Resetting the node secretConfiguring Gemalto Protiva Authentication To reset the node secret on the RSA ACE/ServerConfiguring NTLM Authentication and Authorization To configure NTLM authentication1Click the Authentication tab 5Click the Authentication tab3In Authorization type, select NTLM authorization Configuring NTLM AuthorizationTo configure NTLM authorization 1On the Authentication tab, click Authentication Configuring Double-SourceAuthenticationTo prevent caching of one-timepasswords Changing Password Labels To change the password labels1Click the Access Policy Manager tab Adding Local UsersTo create a user on the Firebox SSL VPN Gateway User Group Overview To delete a user from the Firebox SSL VPN GatewayCreating User Groups To create a local user groupTo remove a user group 1Click the Access Policy Manager tabConfiguring Properties for a User Group Default group propertiesTo enable or disable Default group properties Forcing Users to Log on AgainEnabling domain logon scripts 1Click the Access Policy Manager tabTo enable logon scripts To enable session time-outEnabling session time-out 1Click the Access Policy Manager tabConfiguring Web Session Time-Outs Setting Application OptionsTo enable Web session time-outs To disable desktop sharingTo configure IP pooling for a group Enabling Split DNSEnabling IP Pooling To allow failover to a user’s local DNSClient certificate criteria configuration Choosing a portal page for a groupTo specify a portal page for a group 3In Use this custom portal page, select the pageConfiguring Resources for a User Group To specify client certificate configurationTo create pre-authenticationpolicies Global policiesGroup properties include Group resources includeAdding Users to Multiple Groups To configure resource access control for a group Defining network resourcesTo remove a resource from a user group 1Click the Access Policy Manager tabTo create and configure a network resource 1Click the Access Policy Manager tabTo configure an application policy Application policiesTo add a network resource to a group To remove a network resourceConfiguring file share resources To deny one application network accessTo add an application policy to a group To deny applications without policiesConfiguring kiosk mode To create and configure a kiosk resourceTo create a file share resource To remove a shareConfiguring end point resources End point resources and policiesTo create an end point resource 1Click the Access Policy Manager tabConfiguring an end point policy for a group To delete an end point resourceTo create an end point policy for a group 1Click the Access Policy Manager tab1Click the Access Policy Manager tab Setting the Priority of GroupsTo build an end point policy expression Configuring Pre-AuthenticationPolicies To set the priority of groupsTo view the group priorities for a user To create pre-authenticationpoliciesSetting the Priority of Groups Firebox SSL VPN GatewayCHAPTER 7 Creating and Installing Secure CertificatesPassword-ProtectedPrivate Keys Overview of the Certificate Signing RequestCreating a Certificate Signing Request To create a Certificate Signing Request1Click the VPN Gateway Cluster tab Installing Multiple Root Certificates Creating Root Certificates Using a Command PromptResetting the Certificate to the Default Setting To reset the default certificate1Click the Global Cluster Policies tab Client CertificatesTo require client certificates Installing Root Certificates Requiring Certificates from Internal Connections Wildcard CertificatesCHAPTER 8 Working with Client Connections System RequirementsOperating Systems Web BrowsersUsing the Access Portal To connect using the default portal pageConnecting from a Private Computer To remove the Linux VPN clientThe Firebox SSL VPN Gateway operates as follows sbin/service net6vpnd startEstablishing the Secure Tunnel ipconfig/all or route printOperation through Firewalls and Proxies Connecting from a Private ComputerAdministration Guide Using the Secure Access Client Window ActiveX HelperAdministration Guide To log on to the Firebox SSL VPN GatewayConnecting from a Private Computer To use the Secure Access Client status properties To disconnect the Secure Access ClientTo disconnect the Secure Access Client To manually configure a proxy serverTo view the Connection Log Connecting from a Public Computer Connections Using Kiosk Modecomputer To enable kiosk modeCreating a Kiosk Mode Resource Working with File Share Resources To add a file share to a kiosk resourceTo create and configure a kiosk resource 1Click the Access Policy Manager tabTo enable client applications Client ApplicationsTo remove a file share To work with file share resourcesTo configure Firefox To configure Remote DesktopFirefox Web Browser Remote Desktop clientTelnet 3270 Emulator Client VNC ClientGaim Instant Messenging To use the SSH clientSupporting Secure Access Client To use GaimManaging Client Connections Connection handlingTo disable a user at a particular MAC address To enable a user at a particular MAC addressClosing a connection to a resource Disabling and enabling a user4Click OK Managing Client Connections Firebox SSL VPN GatewayMonitoring and Troubleshooting APPENDIX A Firebox SSL VPN GatewayViewing and Downloading System Message Logs To view and filter the system logForwarding System Messages to a Syslog Server Viewing the W3C-FormattedRequest Log3Click Logging/Settings 4Under Gateway Log, click Display Logging WindowTo enable logging of SNMP messages Enabling and Viewing SNMP LogsMulti Router Traffic Grapher Example 2 Under SNMP Settings, select Enable SNMPViewing System Statistics Monitoring Firebox SSL VPN Gateway OperationsFirebox SSL Real-timeMonitor Ethereal Network AnalyzerxNetTools TracerouteReinstalling v 4.9 application software Backing up your configuration settingsUpgrading to SSL v Upgrading to SSL vTroubleshooting Launching the v 5.5 Administration ToolTroubleshooting the Web Interface Applications do not Appear after Logging OnWeb Interface Credentials Are Invalid Other IssuesRead/Write Access to the Firebox SSL VPN Gateway Defining Accessible Networks Ping CommandLDAP Authentication VMWareThe Administration Tool Is Inaccessible Internal FailoverCertificate Signing Certificate Revocation ListsCertificates Using 512-bitkeypairs Secure Access ClientSecure Access Client Connections with Windows XP DNS Name Resolution Using Named Service ProvidersNTLM Authentication Using Third-PartyClient SoftwareClient Connections from a Windows Server WINS EntriesAPPENDIX B Using Firewalls with Firebox SSL VPN GatewayMcAfee Personal Firewall Plus To view Secure Access Client status propertiesBlackICE PC Protection Norton Personal Firewall Sygate Personal Firewall Free and Pro VersionsTiny Personal Firewall ServicesZoneAlarm Pro 4Click Install from Internet and then click Next APPENDIX C Installing Windows CertificatesTo install Cygwin Unencrypting the Private Key To unencrypt the private keyConverting to a PEM-FormattedCertificate openssl verify -verbose -CApath /tmp certFileBEGINRSA PRIVATE KEY <Unencrypted Private Key> Intermediate Certificate Administration GuideIntermediate Certificate Intermediate Certificate Firebox SSL VPN Gateway APPENDIX D Examples of Configuring Network Access Administration Guide•Global Cluster Policies •Authentication Collecting the LDAP directory information Collecting the LDAP Directory Information ou=Users,dc=ace,dc=com cn=Users,dc=ace,dc=com 2Click the Global Cluster Policies tab Configuring Accessible NetworksTo configure accessible networks 5In Realm Name, type Default 1Click the Access Policy Manager tab 1Click the Access Policy Manager tab10.10.0.0/24 10.60.10.0/24 10.10.25.50/32 Administration Guide Creating a Guest User Authentication Realm 1Click the Access Policy Manager tab Creating Local UsersTo add the local users 1Click the Access Policy Manager tab 2Expand User Groups and then expand Local UsersAPPENDIX E Legal and Copyright Information GNU GENERAL PUBLIC LICENSE change be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or NO WARRANTY END OF TERMS AND CONDITIONS Administration Guide Firebox SSL VPN Gateway Index Page Page Page Page Page Page Firebox SSL VPN Gateway