Manuals / WatchGuard Technologies / Household Appliance / Water Heater

WatchGuard Technologies SSL VPN manual Configuring Authentication and, Authorization

Models: SSL VPN

1 198

Download 198 pages 26.5 Kb

Page 71

CHAPTER 5 Configuring Authentication and

CHAPTER 5 Configuring Authentication and

Authorization

The Firebox SSL VPN Gateway supports several authentication types including LDAP, RADIUS, RSA Secu- rID, NTLM, and Secure Computing’s SafeWord products.

The following topics describe how to configure Firebox SSL VPN Gateway authentication:

•Choosing When to Configure Authentication on the Firebox SSL VPN Gateway

•Configuring Authentication on the Firebox SSL VPN Gateway

•Configuring Local Authentication

•Configuring Local Users

•Configuring LDAP Authentication and Authorization

•Configuring RADIUS Authentication and Authorization

•Configuring RSA SecurID Authentication

•Configuring Secure Computing SafeWord Authentication

•Configuring NTLM Authentication and Authorization

•Configuring Double-Source Authentication

Configuring Authentication and Authorization

By default the Firebox SSL VPN Gateway authenticates users against a user list stored locally on the Fire- box SSL VPN Gateway. You can configure the Firebox SSL VPN Gateway to use LDAP, RADIUS, RSA SecurID, SafeWord, or NTLM (Windows NT 4.0) authentication servers. The Firebox SSL VPN Gate- way supports realm-based authentication to accommodate sites with more than one LDAP or RADIUS server or with a combination of SafeWord, LDAP, RADIUS, NTLM, and/or RSA SecurID authentication servers.

Administration Guide

61

Image 71

WatchGuard Technologies SSL VPN manual Configuring Authentication and, Authorization

Contents

Firebox SSL VPN Gateway ABOUT WATCHGUARD ADDRESSSUPPORT SALESContents The Firebox SSL VPN Gateway operates as follows Configuring Secure Certificate ManagementSetting Up the Firebox SSL VPN Gateway Hardware Firebox SSL VPN Gateway Administration DesktopUsing the Serial Console Configuring Authentication and Authorization Using SafeWord for Citrix or SafeWord RemoteAccess for Authentication Generating a Secure Certificate for the Firebox SSL VPN Gateway APPENDIX A Firebox SSL VPN Gateway Monitoring and Troubleshooting Combining the Private Key with the Signed Certificate Operating System Requirements CHAPTER 1 Getting Started with Firebox SSLVPN Gateway AudienceAccess to technical support and training LiveSecurity Service SolutionsThreat responses, alerts, and expert advice Easy software updatesThreat Response LiveSecurity Service BroadcastsSoftware Update Information AlertNew from WatchGuard LiveSecurity Service Self Help ToolsActivating LiveSecurity Service Basic FAQsFireware “How To”’s Advanced FAQsKnown Issues WatchGuard Users ForumProduct Documentation LiveSecurity Service technical supportUsing the WatchGuard Users Forum Online HelpTraining and Certification Firebox Installation ServiceVPN Installation Service Service timea certification exam. The training materials include links to books and web sites with more information about network security Overview CHAPTER 2 Introduction to Firebox SSL VPN GatewayOverview Network topology showing the TCP circuitConfigurable symmetric encryption ciphers New FeaturesAuthentication and one-timepasswords New versions of the Secure Access ClientAutomatic port redirection Secure Access Client connectionsDisable desktop sharing Disable kiosk modeAdministration Tool FeaturesNTLM authentication and authorization support Updated serial console menuUser Groups, Local Users, and Resources Firebox SSL VPN Gateway SettingsAuthentication and Authorization Saving and RestoringServerConfiguration FeatureServer Upgrade Enable External AdministrationThe User Experience Feature SummaryConnecting to the Firebox SSL Access Portal Deployment and AdministrationPlanning your deployment Planning your deploymentAuthentication Support Configuring Secure Certificate Management•A cross-overcable and a Windows computer To physically connect the Firebox SSL VPN Gateway Setting Up the Firebox SSL VPN Gateway HardwareTo configure TCP/IP settings using a serial cable Firebox SSL VPN Gateway Administration Tool To configure TCP/IP Settings Using Network CablesTo configure TCP/IP settings using network cables 2Click the General Networking tab Using the Firebox SSL VPN GatewayThe Firebox SSL VPN Gateway operates as follows To redirect unsecure connectionsTo configure a proxy server Starting the Secure Access ClientOperation through Firewalls and Proxies Establishing the Secure TunnelAdministration Guide Performance and Real-TimeTrafficUsing the Firebox SSL VPN Gateway Connecting to a Server Load Balancer Using Kiosk ModeAdministration Guide Using the Firebox SSL VPN GatewayFirebox SSL VPN Gateway Using the Firebox SSL VPN GatewayCHAPTER 3 Configuring Basic Settings Downloads Tab Firebox SSL VPN Gateway Administration DesktopUsing the Administration Portal To change the administrator password Using the Serial ConsoleAdmin Users Tab Maintenance TabTo open the serial console Using the Administration ToolTo download and install the Administration Tool In Sync To publish Firebox SSL VPN Gateway settingsUpgrading the tunnel and tunnel upgrade license Product Activation and LicensingTo manage licenses on the Firebox SSL VPN Gateway Managing LicensesInformation about Your Licenses To install a license fileTesting Your License Installation To test your configuration1Click the VPN Gateway Cluster tab Using Portal PagesUsing the Default Portal Page 7Click My own computer and then click ConnectVariable Content inserted by variableUsing the ActiveX Control Linking to Clients from Your Web Site Enabling Portal Page AuthenticationTo enable portal page authentication Secure Application Access Multiple Log On Options using the Portal PagePre-AuthenticationPolicy Portal Page Secure Desktop AccessDouble-sourceauthentication portal page Connecting Using a Web AddressConnecting Using Secure Access Client Double-sourceAuthentication Portal PageTo upgrade the Firebox SSL VPN Gateway Saving and Restoring the ConfigurationTo save the Firebox SSL VPN Gateway configuration To restore a saved configurationTo restart the Firebox SSL VPN Gateway Restarting the Firebox SSL VPN GatewayShutting Down the Firebox SSL VPN Gateway Firebox SSL VPN Gateway System Date and TimeNetwork Time Protocol To enable ICMP trafficAllowing ICMP traffic To change the system date and timeGateway Network Connections CHAPTER 4 Configuring Firebox SSL VPNConfiguring Network Information General Networking General NetworkingIP address External Public FQDNDuplex mode VPN portDNS Server 1, DNS Server 2, DNS Server Name Service ProvidersTo enable split DNS To edit the HOSTS fileTo remove an entry from the HOSTS file Configuring Network RoutingEnable Dynamic Gateway Dynamic and Static RoutingTo enable RIP authentication for dynamic routing Configuring Dynamic RoutingEnabling RIP Authentication for Dynamic Routing To configure dynamic routingTo add a static route Configuring a Static RouteChanging from Dynamic Routing to Static Routing To save dynamic routes to the static route tableNetwork topology showing a static route Static Route ExampleTo test a static route To remove a static routeTo enable internal failover Configuring Firebox SSL VPN Gateway FailoverConfiguring Internal Failover To set up the example static routeConfiguring Network Access Controlling Network Access1Click the Global Cluster Policies tab Specifying Accessible NetworksEnabling Split Tunneling 1Click the Global Cluster Policies tab Denying Access to Groups without an ACLTo enable split tunneling Configuring User Groups1Click the Global Cluster Policies tab To deny access to user groups without an ACLImproving Voice over IP Connections Enabling Improving Voice over IP Connections1Click the Global Cluster Policies tab To improve latency for UDP trafficConfiguring Authentication and Authorization CHAPTER 5 Configuring Authentication andAuthorization Configuring Authentication and Authorization Using a Local User List for Authentication Configuring Authentication without AuthorizationThe Default Realm To add a user to a group Configuring Local UsersChanging Password for Users Adding Users to Multiple Groups4In Authorization Type, select LDAP Authorization Configuring the Default RealmTo change a user’s password To remove and create a Default realm3On the Action menu, select Remove Default realm Creating Additional RealmsTo create a realm Using SafeWord for Authentication To configure SafeWord on the Access Gateway To disable Firebox SSL VPN Gateway authenticationSafeWord PremierAccess Authorization Server To configure the IAS RADIUS realm1Click the Authentication tab 5Select Local computer and click Finish 23In Attribute format, select String default RADIUS=Standard22Under Vendor-assignedattribute number, type 1Click the Authentication tab To specify RADIUS server authenticationTo configure RADIUS authorization Choosing RADIUS Authentication ProtocolsCase Sensitive LDAP authenticationLDAP Server User Attribute5Click the Authentication tab To configure LDAP authentication1Click the Authentication tab LDAP Authorization 4Click the Authentication tab LDAP authorization group attribute fieldsTo configure LDAP authentication 1Click the Authentication tabTo configure LDAP authorization To upload a secure client certificate for LDAP Using certificates for secure LDAP connectionsTo install and set up the LDAP Browser Determining Attributes in your LDAP DirectoryBase DN Using RSA SecurID for AuthenticationHost Port5 For Agent type, select UNIX Agent 1Click the Authentication tab To enable RSA SecurID authenticationConfiguration Files To reset the node secret on the RSA ACE/Server Configuring RSA Settings for a ClusterResetting the node secret Configuring Gemalto Protiva Authentication5Click the Authentication tab Configuring NTLM Authentication and AuthorizationTo configure NTLM authentication 1Click the Authentication tab3In Authorization type, select NTLM authorization Configuring NTLM AuthorizationTo configure NTLM authorization 1On the Authentication tab, click Authentication Configuring Double-SourceAuthenticationTo prevent caching of one-timepasswords To change the password labels Changing Password Labels1Click the Access Policy Manager tab Adding Local UsersTo create a user on the Firebox SSL VPN Gateway To delete a user from the Firebox SSL VPN Gateway User Group Overview1Click the Access Policy Manager tab Creating User GroupsTo create a local user group To remove a user groupForcing Users to Log on Again Configuring Properties for a User GroupDefault group properties To enable or disable Default group properties1Click the Access Policy Manager tab Enabling domain logon scripts1Click the Access Policy Manager tab To enable logon scriptsTo enable session time-out Enabling session time-outTo disable desktop sharing Configuring Web Session Time-OutsSetting Application Options To enable Web session time-outsTo allow failover to a user’s local DNS To configure IP pooling for a groupEnabling Split DNS Enabling IP Pooling3In Use this custom portal page, select the page Client certificate criteria configurationChoosing a portal page for a group To specify a portal page for a groupGlobal policies Configuring Resources for a User GroupTo specify client certificate configuration To create pre-authenticationpoliciesGroup resources include Group properties includeAdding Users to Multiple Groups 1Click the Access Policy Manager tab To configure resource access control for a groupDefining network resources To remove a resource from a user group1Click the Access Policy Manager tab To create and configure a network resourceTo remove a network resource To configure an application policyApplication policies To add a network resource to a groupTo deny applications without policies Configuring file share resourcesTo deny one application network access To add an application policy to a groupTo remove a share Configuring kiosk modeTo create and configure a kiosk resource To create a file share resource1Click the Access Policy Manager tab Configuring end point resourcesEnd point resources and policies To create an end point resource1Click the Access Policy Manager tab Configuring an end point policy for a groupTo delete an end point resource To create an end point policy for a group1Click the Access Policy Manager tab Setting the Priority of GroupsTo build an end point policy expression To create pre-authenticationpolicies Configuring Pre-AuthenticationPoliciesTo set the priority of groups To view the group priorities for a userFirebox SSL VPN Gateway Setting the Priority of GroupsCertificates CHAPTER 7 Creating and Installing SecureOverview of the Certificate Signing Request Password-ProtectedPrivate KeysTo create a Certificate Signing Request Creating a Certificate Signing Request1Click the VPN Gateway Cluster tab To reset the default certificate Installing Multiple Root CertificatesCreating Root Certificates Using a Command Prompt Resetting the Certificate to the Default Setting1Click the Global Cluster Policies tab Client CertificatesTo require client certificates Installing Root Certificates Wildcard Certificates Requiring Certificates from Internal ConnectionsWeb Browsers CHAPTER 8 Working with Client ConnectionsSystem Requirements Operating SystemsTo connect using the default portal page Using the Access Portalsbin/service net6vpnd start Connecting from a Private ComputerTo remove the Linux VPN client The Firebox SSL VPN Gateway operates as followsipconfig/all or route print Establishing the Secure TunnelOperation through Firewalls and Proxies Connecting from a Private ComputerAdministration Guide ActiveX Helper Using the Secure Access Client WindowAdministration Guide To log on to the Firebox SSL VPN GatewayConnecting from a Private Computer To disconnect the Secure Access Client To use the Secure Access Client status propertiesTo disconnect the Secure Access Client To manually configure a proxy serverTo view the Connection Log Connections Using Kiosk Mode Connecting from a Public Computercomputer To enable kiosk modeCreating a Kiosk Mode Resource 1Click the Access Policy Manager tab Working with File Share ResourcesTo add a file share to a kiosk resource To create and configure a kiosk resourceTo work with file share resources To enable client applicationsClient Applications To remove a file shareRemote Desktop client To configure FirefoxTo configure Remote Desktop Firefox Web BrowserTo use the SSH client Telnet 3270 Emulator ClientVNC Client Gaim Instant MessengingTo use Gaim Supporting Secure Access ClientConnection handling Managing Client ConnectionsDisabling and enabling a user To disable a user at a particular MAC addressTo enable a user at a particular MAC address Closing a connection to a resource4Click OK Firebox SSL VPN Gateway Managing Client ConnectionsTo view and filter the system log Monitoring and TroubleshootingAPPENDIX A Firebox SSL VPN Gateway Viewing and Downloading System Message Logs4Under Gateway Log, click Display Logging Window Forwarding System Messages to a Syslog ServerViewing the W3C-FormattedRequest Log 3Click Logging/Settings2 Under SNMP Settings, select Enable SNMP To enable logging of SNMP messagesEnabling and Viewing SNMP Logs Multi Router Traffic Grapher ExampleMonitoring Firebox SSL VPN Gateway Operations Viewing System StatisticsTraceroute Firebox SSL Real-timeMonitorEthereal Network Analyzer xNetToolsUpgrading to SSL v Reinstalling v 4.9 application softwareBacking up your configuration settings Upgrading to SSL vApplications do not Appear after Logging On TroubleshootingLaunching the v 5.5 Administration Tool Troubleshooting the Web InterfaceWeb Interface Credentials Are Invalid Other IssuesRead/Write Access to the Firebox SSL VPN Gateway VMWare Defining Accessible NetworksPing Command LDAP AuthenticationCertificate Revocation Lists The Administration Tool Is InaccessibleInternal Failover Certificate SigningDNS Name Resolution Using Named Service Providers Certificates Using 512-bitkeypairsSecure Access Client Secure Access Client Connections with Windows XPWINS Entries NTLM AuthenticationUsing Third-PartyClient Software Client Connections from a Windows ServerVPN Gateway APPENDIX B Using Firewalls with Firebox SSLMcAfee Personal Firewall Plus To view Secure Access Client status propertiesBlackICE PC Protection Services Norton Personal FirewallSygate Personal Firewall Free and Pro Versions Tiny Personal FirewallZoneAlarm Pro 4Click Install from Internet and then click Next APPENDIX C Installing Windows CertificatesTo install Cygwin To unencrypt the private key Unencrypting the Private Keyopenssl verify -verbose -CApath /tmp certFile Converting to a PEM-FormattedCertificateBEGINRSA PRIVATE KEY <Unencrypted Private Key> Intermediate Certificate Administration GuideIntermediate Certificate Intermediate Certificate Firebox SSL VPN Gateway Administration Guide APPENDIX D Examples of Configuring Network Access•Global Cluster Policies •Authentication Collecting the LDAP directory information Collecting the LDAP Directory Information ou=Users,dc=ace,dc=com cn=Users,dc=ace,dc=com 2Click the Global Cluster Policies tab Configuring Accessible NetworksTo configure accessible networks 5In Realm Name, type Default 1Click the Access Policy Manager tab 1Click the Access Policy Manager tab10.10.0.0/24 10.60.10.0/24 10.10.25.50/32 Administration Guide Creating a Guest User Authentication Realm 1Click the Access Policy Manager tab Creating Local UsersTo add the local users 2Expand User Groups and then expand Local Users 1Click the Access Policy Manager tabAPPENDIX E Legal and Copyright Information GNU GENERAL PUBLIC LICENSE change be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or NO WARRANTY END OF TERMS AND CONDITIONS Administration Guide Firebox SSL VPN Gateway Index Page Page Page Page Page Page Firebox SSL VPN Gateway