Firebox SSL VPN Gateway
ADDRESS
SUPPORT
SALES
ABOUT WATCHGUARD
Contents
Configuring Secure Certificate Management
Setting Up the Firebox SSL VPN Gateway Hardware
Firebox SSL VPN Gateway Administration Desktop
The Firebox SSL VPN Gateway operates as follows
Using the Serial Console
Configuring Authentication and Authorization
Using SafeWord for Citrix or SafeWord RemoteAccess for Authentication
Generating a Secure Certificate for the Firebox SSL VPN Gateway
APPENDIX A Firebox SSL VPN Gateway Monitoring and Troubleshooting
Combining the Private Key with the Signed Certificate
CHAPTER 1 Getting Started with Firebox SSL
VPN Gateway
Audience
Operating System Requirements
LiveSecurity Service Solutions
Threat responses, alerts, and expert advice
Easy software updates
Access to technical support and training
LiveSecurity Service Broadcasts
Software Update
Information Alert
Threat Response
LiveSecurity Service Self Help Tools
Activating LiveSecurity Service
Basic FAQs
New from WatchGuard
Advanced FAQs
Known Issues
WatchGuard Users Forum
Fireware “How To”’s
LiveSecurity Service technical support
Using the WatchGuard Users Forum
Online Help
Product Documentation
Firebox Installation Service
VPN Installation Service
Service time
Training and Certification
a certification exam. The training materials include links to books and web sites with more information about network security
CHAPTER 2 Introduction to Firebox SSL VPN Gateway
Overview
Network topology showing the TCP circuit
Overview
New Features
Authentication and one-timepasswords
New versions of the Secure Access Client
Configurable symmetric encryption ciphers
Secure Access Client connections
Disable desktop sharing
Disable kiosk mode
Automatic port redirection
Features
NTLM authentication and authorization support
Updated serial console menu
Administration Tool
Authentication and Authorization
Firebox SSL VPN Gateway Settings
User Groups, Local Users, and Resources
Feature
Server Upgrade
Enable External Administration
Saving and RestoringServerConfiguration
Feature Summary
The User Experience
Deployment and Administration
Connecting to the Firebox SSL Access Portal
Planning your deployment
Planning your deployment
Configuring Secure Certificate Management
Authentication Support
•A cross-overcable and a Windows computer
Setting Up the Firebox SSL VPN Gateway Hardware
To physically connect the Firebox SSL VPN Gateway
To configure TCP/IP settings using a serial cable
To configure TCP/IP settings using network cables
To configure TCP/IP Settings Using Network Cables
Firebox SSL VPN Gateway Administration Tool
Using the Firebox SSL VPN Gateway
The Firebox SSL VPN Gateway operates as follows
To redirect unsecure connections
2Click the General Networking tab
Starting the Secure Access Client
To configure a proxy server
Establishing the Secure Tunnel
Operation through Firewalls and Proxies
Using the Firebox SSL VPN Gateway
Performance and Real-TimeTraffic
Administration Guide
Using Kiosk Mode
Connecting to a Server Load Balancer
Using the Firebox SSL VPN Gateway
Administration Guide
Using the Firebox SSL VPN Gateway
Firebox SSL VPN Gateway
CHAPTER 3 Configuring Basic Settings
Using the Administration Portal
Firebox SSL VPN Gateway Administration Desktop
Downloads Tab
Using the Serial Console
Admin Users Tab
Maintenance Tab
To change the administrator password
To download and install the Administration Tool
Using the Administration Tool
To open the serial console
To publish Firebox SSL VPN Gateway settings
Upgrading the tunnel and tunnel upgrade license
Product Activation and Licensing
In Sync
Managing Licenses
To manage licenses on the Firebox SSL VPN Gateway
To install a license file
Testing Your License Installation
To test your configuration
Information about Your Licenses
Using Portal Pages
Using the Default Portal Page
7Click My own computer and then click Connect
1Click the VPN Gateway Cluster tab
Content inserted by variable
Variable
Using the ActiveX Control
To enable portal page authentication
Enabling Portal Page Authentication
Linking to Clients from Your Web Site
Multiple Log On Options using the Portal Page
Pre-AuthenticationPolicy Portal Page
Secure Desktop Access
Secure Application Access
Connecting Using a Web Address
Connecting Using Secure Access Client
Double-sourceAuthentication Portal Page
Double-sourceauthentication portal page
Saving and Restoring the Configuration
To save the Firebox SSL VPN Gateway configuration
To restore a saved configuration
To upgrade the Firebox SSL VPN Gateway
Restarting the Firebox SSL VPN Gateway
Shutting Down the Firebox SSL VPN Gateway
Firebox SSL VPN Gateway System Date and Time
To restart the Firebox SSL VPN Gateway
To enable ICMP traffic
Allowing ICMP traffic
To change the system date and time
Network Time Protocol
Configuring Network Information
CHAPTER 4 Configuring Firebox SSL VPN
Gateway Network Connections
General Networking
General Networking
External Public FQDN
Duplex mode
VPN port
IP address
Name Service Providers
To enable split DNS
To edit the HOSTS file
DNS Server 1, DNS Server 2, DNS Server
Configuring Network Routing
Enable Dynamic Gateway
Dynamic and Static Routing
To remove an entry from the HOSTS file
Configuring Dynamic Routing
Enabling RIP Authentication for Dynamic Routing
To configure dynamic routing
To enable RIP authentication for dynamic routing
Configuring a Static Route
Changing from Dynamic Routing to Static Routing
To save dynamic routes to the static route table
To add a static route
Static Route Example
To test a static route
To remove a static route
Network topology showing a static route
Configuring Firebox SSL VPN Gateway Failover
Configuring Internal Failover
To set up the example static route
To enable internal failover
Controlling Network Access
Configuring Network Access
Enabling Split Tunneling
Specifying Accessible Networks
1Click the Global Cluster Policies tab
Denying Access to Groups without an ACL
To enable split tunneling
Configuring User Groups
1Click the Global Cluster Policies tab
To deny access to user groups without an ACL
Improving Voice over IP Connections
Enabling Improving Voice over IP Connections
1Click the Global Cluster Policies tab
To improve latency for UDP traffic
1Click the Global Cluster Policies tab
Authorization
CHAPTER 5 Configuring Authentication and
Configuring Authentication and Authorization
Configuring Authentication and Authorization
The Default Realm
Configuring Authentication without Authorization
Using a Local User List for Authentication
Configuring Local Users
Changing Password for Users
Adding Users to Multiple Groups
To add a user to a group
Configuring the Default Realm
To change a user’s password
To remove and create a Default realm
4In Authorization Type, select LDAP Authorization
To create a realm
Creating Additional Realms
3On the Action menu, select Remove Default realm
Using SafeWord for Authentication
SafeWord PremierAccess Authorization
To disable Firebox SSL VPN Gateway authentication
To configure SafeWord on the Access Gateway
1Click the Authentication tab
To configure the IAS RADIUS realm
Server
5Select Local computer and click Finish
22Under Vendor-assignedattribute number, type
default RADIUS=Standard
23In Attribute format, select String
To specify RADIUS server authentication
To configure RADIUS authorization
Choosing RADIUS Authentication Protocols
1Click the Authentication tab
LDAP authentication
LDAP Server
User Attribute
Case Sensitive
1Click the Authentication tab
To configure LDAP authentication
5Click the Authentication tab
LDAP Authorization
LDAP authorization group attribute fields
To configure LDAP authentication
1Click the Authentication tab
4Click the Authentication tab
To configure LDAP authorization
Using certificates for secure LDAP connections
To install and set up the LDAP Browser
Determining Attributes in your LDAP Directory
To upload a secure client certificate for LDAP
Using RSA SecurID for Authentication
Host
Port
Base DN
5 For Agent type, select UNIX Agent
Configuration Files
To enable RSA SecurID authentication
1Click the Authentication tab
Configuring RSA Settings for a Cluster
Resetting the node secret
Configuring Gemalto Protiva Authentication
To reset the node secret on the RSA ACE/Server
Configuring NTLM Authentication and Authorization
To configure NTLM authentication
1Click the Authentication tab
5Click the Authentication tab
To configure NTLM authorization
Configuring NTLM Authorization
3In Authorization type, select NTLM authorization
To prevent caching of one-timepasswords
Configuring Double-SourceAuthentication
1On the Authentication tab, click Authentication
Changing Password Labels
To change the password labels
To create a user on the Firebox SSL VPN Gateway
Adding Local Users
1Click the Access Policy Manager tab
User Group Overview
To delete a user from the Firebox SSL VPN Gateway
Creating User Groups
To create a local user group
To remove a user group
1Click the Access Policy Manager tab
Configuring Properties for a User Group
Default group properties
To enable or disable Default group properties
Forcing Users to Log on Again
Enabling domain logon scripts
1Click the Access Policy Manager tab
To enable logon scripts
To enable session time-out
Enabling session time-out
1Click the Access Policy Manager tab
Configuring Web Session Time-Outs
Setting Application Options
To enable Web session time-outs
To disable desktop sharing
To configure IP pooling for a group
Enabling Split DNS
Enabling IP Pooling
To allow failover to a user’s local DNS
Client certificate criteria configuration
Choosing a portal page for a group
To specify a portal page for a group
3In Use this custom portal page, select the page
Configuring Resources for a User Group
To specify client certificate configuration
To create pre-authenticationpolicies
Global policies
Group properties include
Group resources include
Adding Users to Multiple Groups
To configure resource access control for a group
Defining network resources
To remove a resource from a user group
1Click the Access Policy Manager tab
To create and configure a network resource
1Click the Access Policy Manager tab
To configure an application policy
Application policies
To add a network resource to a group
To remove a network resource
Configuring file share resources
To deny one application network access
To add an application policy to a group
To deny applications without policies
Configuring kiosk mode
To create and configure a kiosk resource
To create a file share resource
To remove a share
Configuring end point resources
End point resources and policies
To create an end point resource
1Click the Access Policy Manager tab
Configuring an end point policy for a group
To delete an end point resource
To create an end point policy for a group
1Click the Access Policy Manager tab
To build an end point policy expression
Setting the Priority of Groups
1Click the Access Policy Manager tab
Configuring Pre-AuthenticationPolicies
To set the priority of groups
To view the group priorities for a user
To create pre-authenticationpolicies
Setting the Priority of Groups
Firebox SSL VPN Gateway
CHAPTER 7 Creating and Installing Secure
Certificates
Password-ProtectedPrivate Keys
Overview of the Certificate Signing Request
Creating a Certificate Signing Request
To create a Certificate Signing Request
1Click the VPN Gateway Cluster tab
Installing Multiple Root Certificates
Creating Root Certificates Using a Command Prompt
Resetting the Certificate to the Default Setting
To reset the default certificate
To require client certificates
Client Certificates
1Click the Global Cluster Policies tab
Installing Root Certificates
Requiring Certificates from Internal Connections
Wildcard Certificates
CHAPTER 8 Working with Client Connections
System Requirements
Operating Systems
Web Browsers
Using the Access Portal
To connect using the default portal page
Connecting from a Private Computer
To remove the Linux VPN client
The Firebox SSL VPN Gateway operates as follows
sbin/service net6vpnd start
Establishing the Secure Tunnel
ipconfig/all or route print
Administration Guide
Connecting from a Private Computer
Operation through Firewalls and Proxies
Using the Secure Access Client Window
ActiveX Helper
Connecting from a Private Computer
To log on to the Firebox SSL VPN Gateway
Administration Guide
To use the Secure Access Client status properties
To disconnect the Secure Access Client
To view the Connection Log
To manually configure a proxy server
To disconnect the Secure Access Client
Connecting from a Public Computer
Connections Using Kiosk Mode
Creating a Kiosk Mode Resource
To enable kiosk mode
computer
Working with File Share Resources
To add a file share to a kiosk resource
To create and configure a kiosk resource
1Click the Access Policy Manager tab
To enable client applications
Client Applications
To remove a file share
To work with file share resources
To configure Firefox
To configure Remote Desktop
Firefox Web Browser
Remote Desktop client
Telnet 3270 Emulator Client
VNC Client
Gaim Instant Messenging
To use the SSH client
Supporting Secure Access Client
To use Gaim
Managing Client Connections
Connection handling
To disable a user at a particular MAC address
To enable a user at a particular MAC address
Closing a connection to a resource
Disabling and enabling a user
4Click OK
Managing Client Connections
Firebox SSL VPN Gateway
Monitoring and Troubleshooting
APPENDIX A Firebox SSL VPN Gateway
Viewing and Downloading System Message Logs
To view and filter the system log
Forwarding System Messages to a Syslog Server
Viewing the W3C-FormattedRequest Log
3Click Logging/Settings
4Under Gateway Log, click Display Logging Window
To enable logging of SNMP messages
Enabling and Viewing SNMP Logs
Multi Router Traffic Grapher Example
2 Under SNMP Settings, select Enable SNMP
Viewing System Statistics
Monitoring Firebox SSL VPN Gateway Operations
Firebox SSL Real-timeMonitor
Ethereal Network Analyzer
xNetTools
Traceroute
Reinstalling v 4.9 application software
Backing up your configuration settings
Upgrading to SSL v
Upgrading to SSL v
Troubleshooting
Launching the v 5.5 Administration Tool
Troubleshooting the Web Interface
Applications do not Appear after Logging On
Read/Write Access to the Firebox SSL VPN Gateway
Other Issues
Web Interface Credentials Are Invalid
Defining Accessible Networks
Ping Command
LDAP Authentication
VMWare
The Administration Tool Is Inaccessible
Internal Failover
Certificate Signing
Certificate Revocation Lists
Certificates Using 512-bitkeypairs
Secure Access Client
Secure Access Client Connections with Windows XP
DNS Name Resolution Using Named Service Providers
NTLM Authentication
Using Third-PartyClient Software
Client Connections from a Windows Server
WINS Entries
APPENDIX B Using Firewalls with Firebox SSL
VPN Gateway
BlackICE PC Protection
To view Secure Access Client status properties
McAfee Personal Firewall Plus
Norton Personal Firewall
Sygate Personal Firewall Free and Pro Versions
Tiny Personal Firewall
Services
ZoneAlarm Pro
To install Cygwin
APPENDIX C Installing Windows Certificates
4Click Install from Internet and then click Next
Unencrypting the Private Key
To unencrypt the private key
Converting to a PEM-FormattedCertificate
openssl verify -verbose -CApath /tmp certFile
BEGINRSA PRIVATE KEY <Unencrypted Private Key>
Intermediate Certificate Intermediate Certificate
Administration Guide
Intermediate Certificate
Firebox SSL VPN Gateway
APPENDIX D Examples of Configuring Network Access
Administration Guide
•Global Cluster Policies •Authentication
Collecting the LDAP directory information
Collecting the LDAP Directory Information
ou=Users,dc=ace,dc=com cn=Users,dc=ace,dc=com
To configure accessible networks
Configuring Accessible Networks
2Click the Global Cluster Policies tab
5In Realm Name, type Default
1Click the Access Policy Manager tab
1Click the Access Policy Manager tab
10.10.0.0/24 10.60.10.0/24
10.10.25.50/32
Administration Guide
Creating a Guest User Authentication Realm
To add the local users
Creating Local Users
1Click the Access Policy Manager tab
1Click the Access Policy Manager tab
2Expand User Groups and then expand Local Users
APPENDIX E Legal and Copyright Information
GNU GENERAL PUBLIC LICENSE
change
be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or
NO WARRANTY
END OF TERMS AND CONDITIONS
Administration Guide
Firebox SSL VPN Gateway
Index
Page
Page
Page
Page
Page
Page
Firebox SSL VPN Gateway
