Firebox SSL VPN Gateway
ABOUT WATCHGUARD
ADDRESS
SUPPORT
SALES
Contents
The Firebox SSL VPN Gateway operates as follows
Configuring Secure Certificate Management
Setting Up the Firebox SSL VPN Gateway Hardware
Firebox SSL VPN Gateway Administration Desktop
Using the Serial Console
Configuring Authentication and Authorization
Using SafeWord for Citrix or SafeWord RemoteAccess for Authentication
Generating a Secure Certificate for the Firebox SSL VPN Gateway
APPENDIX A Firebox SSL VPN Gateway Monitoring and Troubleshooting
Combining the Private Key with the Signed Certificate
Operating System Requirements
CHAPTER 1 Getting Started with Firebox SSL
VPN Gateway
Audience
Access to technical support and training
LiveSecurity Service Solutions
Threat responses, alerts, and expert advice
Easy software updates
Threat Response
LiveSecurity Service Broadcasts
Software Update
Information Alert
New from WatchGuard
LiveSecurity Service Self Help Tools
Activating LiveSecurity Service
Basic FAQs
Fireware “How To”’s
Advanced FAQs
Known Issues
WatchGuard Users Forum
Product Documentation
LiveSecurity Service technical support
Using the WatchGuard Users Forum
Online Help
Training and Certification
Firebox Installation Service
VPN Installation Service
Service time
a certification exam. The training materials include links to books and web sites with more information about network security
Overview
CHAPTER 2 Introduction to Firebox SSL VPN Gateway
Overview
Network topology showing the TCP circuit
Configurable symmetric encryption ciphers
New Features
Authentication and one-timepasswords
New versions of the Secure Access Client
Automatic port redirection
Secure Access Client connections
Disable desktop sharing
Disable kiosk mode
Administration Tool
Features
NTLM authentication and authorization support
Updated serial console menu
Firebox SSL VPN Gateway Settings
Authentication and Authorization
User Groups, Local Users, and Resources
Saving and RestoringServerConfiguration
Feature
Server Upgrade
Enable External Administration
The User Experience
Feature Summary
Connecting to the Firebox SSL Access Portal
Deployment and Administration
Planning your deployment
Planning your deployment
Authentication Support
Configuring Secure Certificate Management
•A cross-overcable and a Windows computer
To physically connect the Firebox SSL VPN Gateway
Setting Up the Firebox SSL VPN Gateway Hardware
To configure TCP/IP settings using a serial cable
To configure TCP/IP Settings Using Network Cables
To configure TCP/IP settings using network cables
Firebox SSL VPN Gateway Administration Tool
2Click the General Networking tab
Using the Firebox SSL VPN Gateway
The Firebox SSL VPN Gateway operates as follows
To redirect unsecure connections
To configure a proxy server
Starting the Secure Access Client
Operation through Firewalls and Proxies
Establishing the Secure Tunnel
Performance and Real-TimeTraffic
Using the Firebox SSL VPN Gateway
Administration Guide
Connecting to a Server Load Balancer
Using Kiosk Mode
Administration Guide
Using the Firebox SSL VPN Gateway
Firebox SSL VPN Gateway
Using the Firebox SSL VPN Gateway
CHAPTER 3 Configuring Basic Settings
Firebox SSL VPN Gateway Administration Desktop
Using the Administration Portal
Downloads Tab
To change the administrator password
Using the Serial Console
Admin Users Tab
Maintenance Tab
Using the Administration Tool
To download and install the Administration Tool
To open the serial console
In Sync
To publish Firebox SSL VPN Gateway settings
Upgrading the tunnel and tunnel upgrade license
Product Activation and Licensing
To manage licenses on the Firebox SSL VPN Gateway
Managing Licenses
Information about Your Licenses
To install a license file
Testing Your License Installation
To test your configuration
1Click the VPN Gateway Cluster tab
Using Portal Pages
Using the Default Portal Page
7Click My own computer and then click Connect
Variable
Content inserted by variable
Using the ActiveX Control
Enabling Portal Page Authentication
To enable portal page authentication
Linking to Clients from Your Web Site
Secure Application Access
Multiple Log On Options using the Portal Page
Pre-AuthenticationPolicy Portal Page
Secure Desktop Access
Double-sourceauthentication portal page
Connecting Using a Web Address
Connecting Using Secure Access Client
Double-sourceAuthentication Portal Page
To upgrade the Firebox SSL VPN Gateway
Saving and Restoring the Configuration
To save the Firebox SSL VPN Gateway configuration
To restore a saved configuration
To restart the Firebox SSL VPN Gateway
Restarting the Firebox SSL VPN Gateway
Shutting Down the Firebox SSL VPN Gateway
Firebox SSL VPN Gateway System Date and Time
Network Time Protocol
To enable ICMP traffic
Allowing ICMP traffic
To change the system date and time
CHAPTER 4 Configuring Firebox SSL VPN
Configuring Network Information
Gateway Network Connections
General Networking
General Networking
IP address
External Public FQDN
Duplex mode
VPN port
DNS Server 1, DNS Server 2, DNS Server
Name Service Providers
To enable split DNS
To edit the HOSTS file
To remove an entry from the HOSTS file
Configuring Network Routing
Enable Dynamic Gateway
Dynamic and Static Routing
To enable RIP authentication for dynamic routing
Configuring Dynamic Routing
Enabling RIP Authentication for Dynamic Routing
To configure dynamic routing
To add a static route
Configuring a Static Route
Changing from Dynamic Routing to Static Routing
To save dynamic routes to the static route table
Network topology showing a static route
Static Route Example
To test a static route
To remove a static route
To enable internal failover
Configuring Firebox SSL VPN Gateway Failover
Configuring Internal Failover
To set up the example static route
Configuring Network Access
Controlling Network Access
Specifying Accessible Networks
Enabling Split Tunneling
1Click the Global Cluster Policies tab
1Click the Global Cluster Policies tab
Denying Access to Groups without an ACL
To enable split tunneling
Configuring User Groups
1Click the Global Cluster Policies tab
To deny access to user groups without an ACL
Improving Voice over IP Connections
Enabling Improving Voice over IP Connections
1Click the Global Cluster Policies tab
To improve latency for UDP traffic
CHAPTER 5 Configuring Authentication and
Authorization
Configuring Authentication and Authorization
Configuring Authentication and Authorization
Configuring Authentication without Authorization
The Default Realm
Using a Local User List for Authentication
To add a user to a group
Configuring Local Users
Changing Password for Users
Adding Users to Multiple Groups
4In Authorization Type, select LDAP Authorization
Configuring the Default Realm
To change a user’s password
To remove and create a Default realm
Creating Additional Realms
To create a realm
3On the Action menu, select Remove Default realm
Using SafeWord for Authentication
To disable Firebox SSL VPN Gateway authentication
SafeWord PremierAccess Authorization
To configure SafeWord on the Access Gateway
To configure the IAS RADIUS realm
1Click the Authentication tab
Server
5Select Local computer and click Finish
default RADIUS=Standard
22Under Vendor-assignedattribute number, type
23In Attribute format, select String
1Click the Authentication tab
To specify RADIUS server authentication
To configure RADIUS authorization
Choosing RADIUS Authentication Protocols
Case Sensitive
LDAP authentication
LDAP Server
User Attribute
To configure LDAP authentication
1Click the Authentication tab
5Click the Authentication tab
LDAP Authorization
4Click the Authentication tab
LDAP authorization group attribute fields
To configure LDAP authentication
1Click the Authentication tab
To configure LDAP authorization
To upload a secure client certificate for LDAP
Using certificates for secure LDAP connections
To install and set up the LDAP Browser
Determining Attributes in your LDAP Directory
Base DN
Using RSA SecurID for Authentication
Host
Port
5 For Agent type, select UNIX Agent
To enable RSA SecurID authentication
Configuration Files
1Click the Authentication tab
To reset the node secret on the RSA ACE/Server
Configuring RSA Settings for a Cluster
Resetting the node secret
Configuring Gemalto Protiva Authentication
5Click the Authentication tab
Configuring NTLM Authentication and Authorization
To configure NTLM authentication
1Click the Authentication tab
Configuring NTLM Authorization
To configure NTLM authorization
3In Authorization type, select NTLM authorization
Configuring Double-SourceAuthentication
To prevent caching of one-timepasswords
1On the Authentication tab, click Authentication
To change the password labels
Changing Password Labels
Adding Local Users
To create a user on the Firebox SSL VPN Gateway
1Click the Access Policy Manager tab
To delete a user from the Firebox SSL VPN Gateway
User Group Overview
1Click the Access Policy Manager tab
Creating User Groups
To create a local user group
To remove a user group
Forcing Users to Log on Again
Configuring Properties for a User Group
Default group properties
To enable or disable Default group properties
1Click the Access Policy Manager tab
Enabling domain logon scripts
1Click the Access Policy Manager tab
To enable logon scripts
To enable session time-out
Enabling session time-out
To disable desktop sharing
Configuring Web Session Time-Outs
Setting Application Options
To enable Web session time-outs
To allow failover to a user’s local DNS
To configure IP pooling for a group
Enabling Split DNS
Enabling IP Pooling
3In Use this custom portal page, select the page
Client certificate criteria configuration
Choosing a portal page for a group
To specify a portal page for a group
Global policies
Configuring Resources for a User Group
To specify client certificate configuration
To create pre-authenticationpolicies
Group resources include
Group properties include
Adding Users to Multiple Groups
1Click the Access Policy Manager tab
To configure resource access control for a group
Defining network resources
To remove a resource from a user group
1Click the Access Policy Manager tab
To create and configure a network resource
To remove a network resource
To configure an application policy
Application policies
To add a network resource to a group
To deny applications without policies
Configuring file share resources
To deny one application network access
To add an application policy to a group
To remove a share
Configuring kiosk mode
To create and configure a kiosk resource
To create a file share resource
1Click the Access Policy Manager tab
Configuring end point resources
End point resources and policies
To create an end point resource
1Click the Access Policy Manager tab
Configuring an end point policy for a group
To delete an end point resource
To create an end point policy for a group
Setting the Priority of Groups
To build an end point policy expression
1Click the Access Policy Manager tab
To create pre-authenticationpolicies
Configuring Pre-AuthenticationPolicies
To set the priority of groups
To view the group priorities for a user
Firebox SSL VPN Gateway
Setting the Priority of Groups
Certificates
CHAPTER 7 Creating and Installing Secure
Overview of the Certificate Signing Request
Password-ProtectedPrivate Keys
To create a Certificate Signing Request
Creating a Certificate Signing Request
1Click the VPN Gateway Cluster tab
To reset the default certificate
Installing Multiple Root Certificates
Creating Root Certificates Using a Command Prompt
Resetting the Certificate to the Default Setting
Client Certificates
To require client certificates
1Click the Global Cluster Policies tab
Installing Root Certificates
Wildcard Certificates
Requiring Certificates from Internal Connections
Web Browsers
CHAPTER 8 Working with Client Connections
System Requirements
Operating Systems
To connect using the default portal page
Using the Access Portal
sbin/service net6vpnd start
Connecting from a Private Computer
To remove the Linux VPN client
The Firebox SSL VPN Gateway operates as follows
ipconfig/all or route print
Establishing the Secure Tunnel
Connecting from a Private Computer
Administration Guide
Operation through Firewalls and Proxies
ActiveX Helper
Using the Secure Access Client Window
To log on to the Firebox SSL VPN Gateway
Connecting from a Private Computer
Administration Guide
To disconnect the Secure Access Client
To use the Secure Access Client status properties
To manually configure a proxy server
To view the Connection Log
To disconnect the Secure Access Client
Connections Using Kiosk Mode
Connecting from a Public Computer
To enable kiosk mode
Creating a Kiosk Mode Resource
computer
1Click the Access Policy Manager tab
Working with File Share Resources
To add a file share to a kiosk resource
To create and configure a kiosk resource
To work with file share resources
To enable client applications
Client Applications
To remove a file share
Remote Desktop client
To configure Firefox
To configure Remote Desktop
Firefox Web Browser
To use the SSH client
Telnet 3270 Emulator Client
VNC Client
Gaim Instant Messenging
To use Gaim
Supporting Secure Access Client
Connection handling
Managing Client Connections
Disabling and enabling a user
To disable a user at a particular MAC address
To enable a user at a particular MAC address
Closing a connection to a resource
4Click OK
Firebox SSL VPN Gateway
Managing Client Connections
To view and filter the system log
Monitoring and Troubleshooting
APPENDIX A Firebox SSL VPN Gateway
Viewing and Downloading System Message Logs
4Under Gateway Log, click Display Logging Window
Forwarding System Messages to a Syslog Server
Viewing the W3C-FormattedRequest Log
3Click Logging/Settings
2 Under SNMP Settings, select Enable SNMP
To enable logging of SNMP messages
Enabling and Viewing SNMP Logs
Multi Router Traffic Grapher Example
Monitoring Firebox SSL VPN Gateway Operations
Viewing System Statistics
Traceroute
Firebox SSL Real-timeMonitor
Ethereal Network Analyzer
xNetTools
Upgrading to SSL v
Reinstalling v 4.9 application software
Backing up your configuration settings
Upgrading to SSL v
Applications do not Appear after Logging On
Troubleshooting
Launching the v 5.5 Administration Tool
Troubleshooting the Web Interface
Other Issues
Read/Write Access to the Firebox SSL VPN Gateway
Web Interface Credentials Are Invalid
VMWare
Defining Accessible Networks
Ping Command
LDAP Authentication
Certificate Revocation Lists
The Administration Tool Is Inaccessible
Internal Failover
Certificate Signing
DNS Name Resolution Using Named Service Providers
Certificates Using 512-bitkeypairs
Secure Access Client
Secure Access Client Connections with Windows XP
WINS Entries
NTLM Authentication
Using Third-PartyClient Software
Client Connections from a Windows Server
VPN Gateway
APPENDIX B Using Firewalls with Firebox SSL
To view Secure Access Client status properties
BlackICE PC Protection
McAfee Personal Firewall Plus
Services
Norton Personal Firewall
Sygate Personal Firewall Free and Pro Versions
Tiny Personal Firewall
ZoneAlarm Pro
APPENDIX C Installing Windows Certificates
To install Cygwin
4Click Install from Internet and then click Next
To unencrypt the private key
Unencrypting the Private Key
openssl verify -verbose -CApath /tmp certFile
Converting to a PEM-FormattedCertificate
BEGINRSA PRIVATE KEY <Unencrypted Private Key>
Administration Guide
Intermediate Certificate Intermediate Certificate
Intermediate Certificate
Firebox SSL VPN Gateway
Administration Guide
APPENDIX D Examples of Configuring Network Access
•Global Cluster Policies •Authentication
Collecting the LDAP directory information
Collecting the LDAP Directory Information
ou=Users,dc=ace,dc=com cn=Users,dc=ace,dc=com
Configuring Accessible Networks
To configure accessible networks
2Click the Global Cluster Policies tab
5In Realm Name, type Default
1Click the Access Policy Manager tab
1Click the Access Policy Manager tab
10.10.0.0/24 10.60.10.0/24
10.10.25.50/32
Administration Guide
Creating a Guest User Authentication Realm
Creating Local Users
To add the local users
1Click the Access Policy Manager tab
2Expand User Groups and then expand Local Users
1Click the Access Policy Manager tab
APPENDIX E Legal and Copyright Information
GNU GENERAL PUBLIC LICENSE
change
be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or
NO WARRANTY
END OF TERMS AND CONDITIONS
Administration Guide
Firebox SSL VPN Gateway
Index
Page
Page
Page
Page
Page
Page
Firebox SSL VPN Gateway
