WatchGuardFireboxSSL VPN Gateway Administration Guide
Address
Contents
Installing the Firebox SSL VPN Gateway for the First Time
Planning for Security with the Firebox SSL VPN Gateway
To download the portal page templates to your local computer
Configuring Firebox SSL VPN Gateway Network Connections
Configuring Authentication without Authorization
Using Ldap Servers for Authentication and Authorization
Configuring Ntlm Authentication and Authorization
Digital Certificates and Firebox SSL VPN Gateway Operation
Requiring Certificates from Internal Connections
Recovering from a Failure of the Firebox SSL VPN Gateway
Appendix B Using Firewalls with Firebox SSL VPN Gateway
Audience
Operating System Requirements
Easy software updates
LiveSecurity Service Solutions
Threat responses, alerts, and expert advice
Access to technical support and training
LiveSecurity Service Broadcasts
Information Alert
Click Register
LiveSecurity Service Self Help Tools
Activating LiveSecurity Service
Click Self Help Tools
To get access to the LiveSecurity Service Self Help Tools
WatchGuard Users Forum
Click your selection
Online Help
LiveSecurity Service technical support
Using the WatchGuard Users Forum
Product Documentation Technical Support
Training and Certification
Firebox Installation Service
VPN Installation Service
LiveSecurity Gold
Training and Certification
Introduction to Firebox SSL VPN Gateway
Overview
Network topology showing the TCP circuit
Overview
New versions of the Secure Access Client
New Features
Authentication and one-time passwords
Configurable symmetric encryption ciphers
Additional control over Secure Access Client connections
Secure Access Client connections
Disable desktop sharing
Disable kiosk mode
Added challenge-response to Radius user authentication
Features
Ntlm authentication and authorization support
Updated serial console menu
Following table maps the Firebox SSL VPN Gateway settings
Firebox SSL VPN Gateway Settings
Authentication and Authorization
User Groups, Local Users, and Resources
Feature FireboxSSL VPN Gateway Server Upgrade
Feature Summary
User Experience
Deployment and Administration
Connecting to the Firebox SSL Access Portal
Deploying the Firebox SSL VPN Gateway in a Secure Network
Planning your deployment
Deploying the Firebox SSL VPN Gateway in the Network DMZ
Planning for Security with the Firebox SSL VPN Gateway
Configuring Secure Certificate Management
Authentication Support
RSA SecurID
Installing the Firebox SSL VPN Gateway for the First Time
Getting Ready to Install the Firebox SSL VPN Gateway
To physically connect the Firebox SSL VPN Gateway
Setting Up the Firebox SSL VPN Gateway Hardware
Configuring TCP/IP Settings for the Firebox SSL VPN Gateway
To configure TCP/IP settings using a serial cable
To configure TCP/IP Settings Using Network Cables
Power on the Firebox SSL VPN Gateway
Firebox SSL VPN Gateway operates as follows
Using the Firebox SSL VPN Gateway
Redirecting Connections on Port 80 to a Secure Port
To redirect unsecure connections
Starting the Secure Access Client
To configure a proxy server
Establishing the Secure Tunnel
Operation through Firewalls and Proxies
Performance and Real-Time Traffic
Using Kiosk Mode
Connecting to a Server Load Balancer
Using the Firebox SSL VPN Gateway
Using the Firebox SSL VPN Gateway
Configuring Basic Settings
Downloads Tab
Firebox SSL VPN Gateway Administration Desktop
Using the Administration Portal
Maintenance Tab
Using the Serial Console
Admin Users Tab
To change the administrator password
To open the serial console
Using the Administration Tool
To download and install the Administration Tool
Upgrading the tunnel and tunnel upgrade license
Publishing Settings to Multiple Firebox SSL VPN Gateways
To publish Firebox SSL VPN Gateway settings
Product Activation and Licensing
Managing Licenses
To manage licenses on the Firebox SSL VPN Gateway
To test your configuration
To install a license file
Testing Your License Installation
Information about Your Licenses
To block external access to the Administration Portal
Blocking External Access to the Administration Portal
Using Portal Pages
Using the Default Portal
Variable Content inserted by variable
Downloading and Working with Portal Page Templates
To work with the templates for Windows and Linux users
Using the ActiveX Control
Kiosk mode only
Save the file
Linking to Clients from Your Web Site
Enabling Portal Page Authentication
To enable portal page authentication
To remove a portal file from the Firebox SSL VPN Gateway
To configure multiple log on options
Multiple Log On Options using the Portal
Pre-Authentication Policy Portal
On the Gateway Portal tab, select Redirect to URL
Double-source Authentication Portal
Connecting Using a Web Address
Connecting Using Secure Access Client
Double-source authentication portal
To restore a saved configuration
Saving and Restoring the Configuration
To save the Firebox SSL VPN Gateway configuration
To upgrade the Firebox SSL VPN Gateway
Firebox SSL VPN Gateway System Date and Time
Restarting the Firebox SSL VPN Gateway
Shutting Down the Firebox SSL VPN Gateway
To restart the Firebox SSL VPN Gateway
To change the system date and time
To enable Icmp traffic
Allowing Icmp traffic
Network Time Protocol
Configuring Firebox SSL VPN Gateway Network Connections
Configuring Network Information
General Networking
Firebox SSL VPN Gateway located inside the firewall
MTU
To edit the Hosts file
Name Service Providers
To enable split DNS
To add an entry to the Hosts file
To remove an entry from the Hosts file
Configuring Network Routing
Dynamic and Static Routing
To configure dynamic routing
Configuring Dynamic Routing
Enabling RIP Authentication for Dynamic Routing
To enable RIP authentication for dynamic routing
To save dynamic routes to the static route table
Configuring a Static Route
Changing from Dynamic Routing to Static Routing
To add a static route
To remove a static route
Static Route Example
To test a static route
Network topology showing a static route
To set up the example static route
Configuring Firebox SSL VPN Gateway Failover
Configuring Internal Failover
To enable internal failover
Controlling Network Access
Configuring Network Access
Enabling Split Tunneling
Specifying Accessible Networks
To give the Firebox SSL VPN Gateway access to a network
Click the Global Cluster Policies tab
Configuring User Groups
Denying Access to Groups without an ACL
To enable split tunneling
Enabling Improving Voice over IP Connections
To deny access to user groups without an ACL
Improving Voice over IP Connections
Specific ciphers used to encrypt the UDP traffic include
To improve latency for UDP traffic
Configuring Authentication Authorization
Configuring Authentication and Authorization
Configuring Authentication and Authorization
Using a Local User List for Authentication
Configuring Authentication without Authorization
Default Realm
On the Authentication tab, select an authorization realm
Adding Users to Multiple Groups
Configuring Local Users
Changing Password for Users
To add a user to a group
Configuring the Default Realm
Changing the Authentication Type of the Default Realm
Using Ldap Authorization with Local Authentication
To create a realm
Configure the settings for the realm and then click Submit
Creating Additional Realms
Do one of the following
Configuring SafeWord Settings on the Access Gateway
Using SafeWord for Authentication
Configuring Secure Computing SafeWord Authentication
Removing Realms
To configure SafeWord on the Access Gateway
To disable Firebox SSL VPN Gateway authentication
SafeWord PremierAccess Authorization
Server
Using Radius Servers for Authentication and Authorization
To configure the IAS Radius realm
Policy name, give the policy a name and click Next
Select Local computer and click Finish
Click Close and then click OK
Attribute format, select String
Attribute value, type the attribute name and the groups
Choosing Radius Authentication Protocols
To specify Radius server authentication
To configure Radius authorization
Complete the settings using the attributes defined in IAS
Using Ldap Servers for Authentication and Authorization
Ldap authentication
This table contains examples of the base dn
To configure Ldap authentication
Realm Name, type a name for the authentication realm
Following table contains examples of bind dn
Ldap Authorization
Ldap authorization group attribute fields
Group memberships from group objects working evaluations
To configure Ldap authorization
Ldap Administrator Password, type the password
Using certificates for secure Ldap connections
To install and set up the Ldap Browser
Determining Attributes in your Ldap Directory
Using RSA SecurID for Authentication
To look up Ldap attributes
For Agent type, select Unix Agent
To enable RSA SecurID authentication
Configuration Files
Configuring Gemalto Protiva Authentication
Configuring RSA Settings for a Cluster
Resetting the node secret
To reset the node secret on the RSA ACE/Server
Configuring Ntlm Authentication and Authorization
To configure Ntlm authentication
To configure Ntlm authorization
Configuring Ntlm Authorization
Configuring Authentication to use One-Time Passwords
Authorization type, select Ntlm authorization
Select Use the password one time and click Submit
Configuring Double-Source Authentication
To prevent caching of one-time passwords
On the Authentication tab, click Authentication
Changing Password Labels
To change the password labels
Adding Local Users
To create a user on the Firebox SSL VPN Gateway
User Group Overview
To delete a user from the Firebox SSL VPN Gateway
To remove a user group
Creating User Groups
To create a local user group
To enable or disable Default group properties
Configuring Properties for a User Group
Default group properties
Forcing Users to Log on Again
Enabling domain logon scripts
Configuring Secure Access Client for single sign-on
To configure Secure Access Client for single sign-on
Left pane, right-click a group and then click Properties
Enabling session time-out
To enable logon scripts
To enable session time-out
Left pane, right-click a group and click Properties
Disabling Desktop Sharing
Configuring Web Session Time-Outs
Setting Application Options
Enabling IP Pooling
To configure IP pooling for a group
Enabling Split DNS
To allow failover to a user’s local DNS
To specify a portal page for a group
Client certificate criteria configuration
Choosing a portal page for a group
To create pre-authentication policies
Configuring Resources for a User Group
To specify client certificate configuration
Global policies
Group properties include
Group resources include
Adding Users to Multiple Groups
To remove a resource from a user group
To configure resource access control for a group
Defining network resources
To create and configure a network resource
22, 80
To add a network resource to a group
To configure an application policy
Application policies
To remove a network resource
To add an application policy to a group
Configuring file share resources
To deny one application network access
To create a file share resource
Configuring kiosk mode
To create and configure a kiosk resource
To remove a share
To create an end point resource
Configuring end point resources
End point resources and policies
Click Registry Rule
To create an end point policy for a group
Configuring an end point policy for a group
To delete an end point resource
If you selected Process Rule, do the following
Under End Point Scan Expression, select Auto-build
Setting the Priority of Groups
To build an end point policy expression
To view the group priorities for a user
Configuring Pre-Authentication Policies
To set the priority of groups
Click the Group Priority tab
108
Creating and Installing Secure Certificates
Overview of the Certificate Signing Request
Password-Protected Private Keys
Digital Certificates and Firebox SSL VPN Gateway Operation
Creating a Certificate Signing Request
To create a Certificate Signing Request
To upload a certificate using the Administration Portal
Installing Root Certificates on the Firebox SSL VPN Gateway
To install a certificate file using the Administration Tool
Locate the file you want to upload and click Open
Resetting the Certificate to the Default Setting
Installing Multiple Root Certificates
Creating Root Certificates Using a Command Prompt
To reset the default certificate
Client Certificates
To require client certificates
Selecting an Encryption Type for Client Connections
Installing Root Certificates on a Client Device
Obtaining a Root Certificate from a CertificateAuthority
To select an encryption type for client connections
Requiring Certificates from Internal Connections
Wildcard Certificates
Web Browsers
System Requirements
Operating Systems
Using the Access Portal
To connect using the default portal
To remove the Linux VPN client
Connecting from a Private Computer
Sbin/service net6vpnd start
Firebox SSL VPN Gateway operates as follows
Tunneling Private Network Traffic over Secure Connections
Establishing the Secure Tunnel
Administration Guide 121
Using the Secure Access Client Window
ActiveX Helper
To log on to the Firebox SSL VPN Gateway
To close the window, click Close
To use the Secure Access Client status properties
To disconnect the Secure Access Client
To view the Connection Log
Configuring Proxy Servers for the Secure Access Client
To manually configure a proxy server
Connecting from a Public Computer
Connections Using Kiosk Mode
To log on to the Firebox SSL VPN Gateway using kiosk mode
Creating a Kiosk Mode Resource
To enable kiosk mode
Enter your network logon credentials and click Login
Working with File Share Resources
To add a file share to a kiosk resource
To remove a file share
To enable client applications
Client Applications
To work with file share resources
SSH Client
Firefox Web Browser
Remote Desktop client
Gaim Instant Messenging
Telnet 3270 Emulator Client
VNC Client
Supporting Secure Access Client
To use Gaim
Managing Client Connections
Connection handling
Closing a connection to a resource
To disable a user at a particular MAC address
To enable a user at a particular MAC address
Disabling and enabling a user
Administration Guide 135
136
Viewing and Downloading System Message Logs
To view and filter the system log
Forwarding System Messages to a Syslog Server
Viewing the W3C-Formatted Request Log
Enabling and Viewing Snmp Logs
To enable logging of Snmp messages
Under Snmp Settings, select Enable Snmp
Multi Router Traffic Grapher Example
Monitoring Firebox SSL VPN Gateway Operations
Multi Router Traffic Grapher configuration file
Viewing System Statistics
Monitoring applications are as follows
Recovering from a Failure of the Firebox SSL VPN Gateway
To open the Firebox SSL VPN Gateway Administration Desktop
Apply the v 5.5 software update
Reinstalling v 4.9 application software
Backing up your configuration settings
Upgrading to SSL v
Troubleshooting the Web Interface
Troubleshooting
Launching the v 5.5 Administration Tool
Web Interface Appears without Typing in Credentials
Web Interface Credentials Are Invalid
Other Issues
Read/Write Access to the Firebox SSL VPN Gateway
License File Does not Match Firebox SSL VPN Gateway
Ldap Authentication
Defining Accessible Networks
Ping Command
VMWare
Certificate Signing
Administration Tool Is Inaccessible
Internal Failover
Certificate Revocation Lists
Secure Access Client Connections with Windows XP
Certificates Using 512-bit keypairs
Secure Access Client
DNS Name Resolution Using Named Service Providers
Client Connections from a Windows Server
Ntlm Authentication
Using Third-Party Client Software
Wins Entries
Appendix B Using Firewalls with Firebox SSL VPN Gateway
McAfee Personal Firewall Plus
To view Secure Access Client status properties
BlackICE PC Protection
Tiny Personal Firewall
Norton Personal Firewall
Sygate Personal Firewall Free and Pro Versions
ZoneAlarm Pro
Add
New column for those two entries, click Skip
To install Cygwin
Click Install from Internet and then click Next
To unencrypt the private key
To generate a CSR using the Cygwin Unix environment
Unencrypting the Private Key
Double-click the Cygwin icon on the desktop
To convert the certificate from PKCS7 to PEM format
Converting to a PEM-Formatted Certificate
Combining the Private Key with the Signed Certificate
Openssl verify -verbose -CApath /tmp certFile
To generate trusted certificates for multiple levels
Generating Trusted Certificates for Multiple Levels
To combine the private key with the signed certificate
Intermediate Certificate
158
Appendix D Examples of Configuring Network Access
Scenario 1 Configuring Ldap Authentication and Authorization
Administration Guide 161
Collecting the Ldap Directory Information
Ldap Server User Attributes Case Sensitive
If necessary, select Enable split tunneling
Configuring Accessible Networks
To configure accessible networks
10.10.0.0/24 10.60.10.0/24
Creating an Ldap Authentication and Authorization Realm
Realm Name, type Default
Creating and Assigning Network Resources to the User Groups
Creating and Assigning Network Resources to the Sales Users
To provide the Engineering users with access to the network
Creating an Application Policy for an Email Server
To implement the application policy for the email server
Administration Guide 169
Creating a Guest User Authentication Realm
To add the local users
To create a guest authentication realm for the guest users
Creating Local Users
Scenario 3 Configuring Local Authorization for Local Users
Appendix E Legal and Copyright Information
174
Administration Guide 175
176
No Warranty
END of Terms and Conditions
Administration Guide 179
180
Index
DNS
FTP
LiveSecurity Service activating 4 benefits of 2 broadcasts
Administration Guide 185
Connection to 28 service scanner 141 session timeout 15, 88
Wctp
188