WatchGuardFireboxSSL VPN Gateway Administration Guide
Address
Contents
Planning for Security with the Firebox SSL VPN Gateway
Installing the Firebox SSL VPN Gateway for the First Time
To download the portal page templates to your local computer
Configuring Authentication without Authorization
Configuring Firebox SSL VPN Gateway Network Connections
Configuring Ntlm Authentication and Authorization
Using Ldap Servers for Authentication and Authorization
Requiring Certificates from Internal Connections
Digital Certificates and Firebox SSL VPN Gateway Operation
Recovering from a Failure of the Firebox SSL VPN Gateway
Appendix B Using Firewalls with Firebox SSL VPN Gateway
Operating System Requirements
Audience
Threat responses, alerts, and expert advice
LiveSecurity Service Solutions
Easy software updates
Access to technical support and training
Information Alert
LiveSecurity Service Broadcasts
Activating LiveSecurity Service
LiveSecurity Service Self Help Tools
Click Register
WatchGuard Users Forum
To get access to the LiveSecurity Service Self Help Tools
Click Self Help Tools
Click your selection
Using the WatchGuard Users Forum
LiveSecurity Service technical support
Online Help
Product Documentation Technical Support
VPN Installation Service
Firebox Installation Service
Training and Certification
LiveSecurity Gold
Training and Certification
Overview
Introduction to Firebox SSL VPN Gateway
Overview
Network topology showing the TCP circuit
Authentication and one-time passwords
New Features
New versions of the Secure Access Client
Configurable symmetric encryption ciphers
Disable desktop sharing
Secure Access Client connections
Additional control over Secure Access Client connections
Disable kiosk mode
Ntlm authentication and authorization support
Features
Added challenge-response to Radius user authentication
Updated serial console menu
Authentication and Authorization
Firebox SSL VPN Gateway Settings
Following table maps the Firebox SSL VPN Gateway settings
User Groups, Local Users, and Resources
Feature FireboxSSL VPN Gateway Server Upgrade
User Experience
Feature Summary
Connecting to the Firebox SSL Access Portal
Deployment and Administration
Deploying the Firebox SSL VPN Gateway in the Network DMZ
Planning your deployment
Deploying the Firebox SSL VPN Gateway in a Secure Network
Authentication Support
Configuring Secure Certificate Management
Planning for Security with the Firebox SSL VPN Gateway
RSA SecurID
Getting Ready to Install the Firebox SSL VPN Gateway
Installing the Firebox SSL VPN Gateway for the First Time
Configuring TCP/IP Settings for the Firebox SSL VPN Gateway
Setting Up the Firebox SSL VPN Gateway Hardware
To physically connect the Firebox SSL VPN Gateway
To configure TCP/IP settings using a serial cable
Power on the Firebox SSL VPN Gateway
To configure TCP/IP Settings Using Network Cables
Redirecting Connections on Port 80 to a Secure Port
Using the Firebox SSL VPN Gateway
Firebox SSL VPN Gateway operates as follows
To redirect unsecure connections
To configure a proxy server
Starting the Secure Access Client
Operation through Firewalls and Proxies
Establishing the Secure Tunnel
Performance and Real-Time Traffic
Connecting to a Server Load Balancer
Using Kiosk Mode
Using the Firebox SSL VPN Gateway
Using the Firebox SSL VPN Gateway
Configuring Basic Settings
Using the Administration Portal
Firebox SSL VPN Gateway Administration Desktop
Downloads Tab
Admin Users Tab
Using the Serial Console
Maintenance Tab
To change the administrator password
To download and install the Administration Tool
Using the Administration Tool
To open the serial console
To publish Firebox SSL VPN Gateway settings
Publishing Settings to Multiple Firebox SSL VPN Gateways
Upgrading the tunnel and tunnel upgrade license
Product Activation and Licensing
To manage licenses on the Firebox SSL VPN Gateway
Managing Licenses
Testing Your License Installation
To install a license file
To test your configuration
Information about Your Licenses
Using Portal Pages
Blocking External Access to the Administration Portal
To block external access to the Administration Portal
Using the Default Portal
Downloading and Working with Portal Page Templates
Variable Content inserted by variable
Kiosk mode only
Using the ActiveX Control
To work with the templates for Windows and Linux users
Save the file
To enable portal page authentication
Enabling Portal Page Authentication
Linking to Clients from Your Web Site
To remove a portal file from the Firebox SSL VPN Gateway
Pre-Authentication Policy Portal
Multiple Log On Options using the Portal
To configure multiple log on options
On the Gateway Portal tab, select Redirect to URL
Connecting Using Secure Access Client
Connecting Using a Web Address
Double-source Authentication Portal
Double-source authentication portal
To save the Firebox SSL VPN Gateway configuration
Saving and Restoring the Configuration
To restore a saved configuration
To upgrade the Firebox SSL VPN Gateway
Shutting Down the Firebox SSL VPN Gateway
Restarting the Firebox SSL VPN Gateway
Firebox SSL VPN Gateway System Date and Time
To restart the Firebox SSL VPN Gateway
Allowing Icmp traffic
To enable Icmp traffic
To change the system date and time
Network Time Protocol
Configuring Network Information
Configuring Firebox SSL VPN Gateway Network Connections
Firebox SSL VPN Gateway located inside the firewall
General Networking
MTU
To enable split DNS
Name Service Providers
To edit the Hosts file
To add an entry to the Hosts file
Dynamic and Static Routing
Configuring Network Routing
To remove an entry from the Hosts file
Enabling RIP Authentication for Dynamic Routing
Configuring Dynamic Routing
To configure dynamic routing
To enable RIP authentication for dynamic routing
Changing from Dynamic Routing to Static Routing
Configuring a Static Route
To save dynamic routes to the static route table
To add a static route
To test a static route
Static Route Example
To remove a static route
Network topology showing a static route
Configuring Internal Failover
Configuring Firebox SSL VPN Gateway Failover
To set up the example static route
To enable internal failover
Configuring Network Access
Controlling Network Access
To give the Firebox SSL VPN Gateway access to a network
Specifying Accessible Networks
Enabling Split Tunneling
Click the Global Cluster Policies tab
To enable split tunneling
Denying Access to Groups without an ACL
Configuring User Groups
Improving Voice over IP Connections
To deny access to user groups without an ACL
Enabling Improving Voice over IP Connections
Specific ciphers used to encrypt the UDP traffic include
To improve latency for UDP traffic
Configuring Authentication and Authorization
Configuring Authentication Authorization
Configuring Authentication and Authorization
Default Realm
Configuring Authentication without Authorization
Using a Local User List for Authentication
On the Authentication tab, select an authorization realm
Changing Password for Users
Configuring Local Users
Adding Users to Multiple Groups
To add a user to a group
Using Ldap Authorization with Local Authentication
Changing the Authentication Type of the Default Realm
Configuring the Default Realm
Creating Additional Realms
Configure the settings for the realm and then click Submit
To create a realm
Do one of the following
Configuring Secure Computing SafeWord Authentication
Using SafeWord for Authentication
Configuring SafeWord Settings on the Access Gateway
Removing Realms
SafeWord PremierAccess Authorization
To disable Firebox SSL VPN Gateway authentication
To configure SafeWord on the Access Gateway
To configure the IAS Radius realm
Using Radius Servers for Authentication and Authorization
Server
Click Close and then click OK
Select Local computer and click Finish
Policy name, give the policy a name and click Next
Attribute value, type the attribute name and the groups
Attribute format, select String
To configure Radius authorization
To specify Radius server authentication
Choosing Radius Authentication Protocols
Complete the settings using the attributes defined in IAS
Ldap authentication
Using Ldap Servers for Authentication and Authorization
Realm Name, type a name for the authentication realm
To configure Ldap authentication
This table contains examples of the base dn
Following table contains examples of bind dn
Ldap Authorization
Group memberships from group objects working evaluations
Ldap authorization group attribute fields
To configure Ldap authorization
To install and set up the Ldap Browser
Using certificates for secure Ldap connections
Ldap Administrator Password, type the password
Determining Attributes in your Ldap Directory
To look up Ldap attributes
Using RSA SecurID for Authentication
For Agent type, select Unix Agent
Configuration Files
To enable RSA SecurID authentication
Resetting the node secret
Configuring RSA Settings for a Cluster
Configuring Gemalto Protiva Authentication
To reset the node secret on the RSA ACE/Server
To configure Ntlm authentication
Configuring Ntlm Authentication and Authorization
Configuring Authentication to use One-Time Passwords
Configuring Ntlm Authorization
To configure Ntlm authorization
Authorization type, select Ntlm authorization
To prevent caching of one-time passwords
Configuring Double-Source Authentication
Select Use the password one time and click Submit
On the Authentication tab, click Authentication
To change the password labels
Changing Password Labels
To create a user on the Firebox SSL VPN Gateway
Adding Local Users
To delete a user from the Firebox SSL VPN Gateway
User Group Overview
To create a local user group
Creating User Groups
To remove a user group
Default group properties
Configuring Properties for a User Group
To enable or disable Default group properties
Forcing Users to Log on Again
To configure Secure Access Client for single sign-on
Configuring Secure Access Client for single sign-on
Enabling domain logon scripts
Left pane, right-click a group and then click Properties
To enable session time-out
To enable logon scripts
Enabling session time-out
Left pane, right-click a group and click Properties
Setting Application Options
Configuring Web Session Time-Outs
Disabling Desktop Sharing
Enabling Split DNS
To configure IP pooling for a group
Enabling IP Pooling
To allow failover to a user’s local DNS
Choosing a portal page for a group
Client certificate criteria configuration
To specify a portal page for a group
To specify client certificate configuration
Configuring Resources for a User Group
To create pre-authentication policies
Global policies
Group resources include
Group properties include
Adding Users to Multiple Groups
Defining network resources
To configure resource access control for a group
To remove a resource from a user group
22, 80
To create and configure a network resource
Application policies
To configure an application policy
To add a network resource to a group
To remove a network resource
To deny one application network access
Configuring file share resources
To add an application policy to a group
To create and configure a kiosk resource
Configuring kiosk mode
To create a file share resource
To remove a share
End point resources and policies
Configuring end point resources
To create an end point resource
Click Registry Rule
To delete an end point resource
Configuring an end point policy for a group
To create an end point policy for a group
If you selected Process Rule, do the following
To build an end point policy expression
Setting the Priority of Groups
Under End Point Scan Expression, select Auto-build
To set the priority of groups
Configuring Pre-Authentication Policies
To view the group priorities for a user
Click the Group Priority tab
108
Creating and Installing Secure Certificates
Digital Certificates and Firebox SSL VPN Gateway Operation
Password-Protected Private Keys
Overview of the Certificate Signing Request
To create a Certificate Signing Request
Creating a Certificate Signing Request
To install a certificate file using the Administration Tool
Installing Root Certificates on the Firebox SSL VPN Gateway
To upload a certificate using the Administration Portal
Locate the file you want to upload and click Open
Creating Root Certificates Using a Command Prompt
Installing Multiple Root Certificates
Resetting the Certificate to the Default Setting
To reset the default certificate
To require client certificates
Client Certificates
Obtaining a Root Certificate from a CertificateAuthority
Installing Root Certificates on a Client Device
Selecting an Encryption Type for Client Connections
To select an encryption type for client connections
Wildcard Certificates
Requiring Certificates from Internal Connections
Operating Systems
System Requirements
Web Browsers
To connect using the default portal
Using the Access Portal
Sbin/service net6vpnd start
Connecting from a Private Computer
To remove the Linux VPN client
Firebox SSL VPN Gateway operates as follows
Establishing the Secure Tunnel
Tunneling Private Network Traffic over Secure Connections
Administration Guide 121
ActiveX Helper
Using the Secure Access Client Window
To log on to the Firebox SSL VPN Gateway
To disconnect the Secure Access Client
To use the Secure Access Client status properties
To close the window, click Close
To manually configure a proxy server
Configuring Proxy Servers for the Secure Access Client
To view the Connection Log
Connections Using Kiosk Mode
Connecting from a Public Computer
To enable kiosk mode
Creating a Kiosk Mode Resource
To log on to the Firebox SSL VPN Gateway using kiosk mode
Enter your network logon credentials and click Login
To add a file share to a kiosk resource
Working with File Share Resources
Client Applications
To enable client applications
To remove a file share
To work with file share resources
Remote Desktop client
Firefox Web Browser
SSH Client
VNC Client
Telnet 3270 Emulator Client
Gaim Instant Messenging
To use Gaim
Supporting Secure Access Client
Connection handling
Managing Client Connections
To enable a user at a particular MAC address
To disable a user at a particular MAC address
Closing a connection to a resource
Disabling and enabling a user
Administration Guide 135
136
To view and filter the system log
Viewing and Downloading System Message Logs
Viewing the W3C-Formatted Request Log
Forwarding System Messages to a Syslog Server
Under Snmp Settings, select Enable Snmp
To enable logging of Snmp messages
Enabling and Viewing Snmp Logs
Multi Router Traffic Grapher Example
Viewing System Statistics
Multi Router Traffic Grapher configuration file
Monitoring Firebox SSL VPN Gateway Operations
To open the Firebox SSL VPN Gateway Administration Desktop
Recovering from a Failure of the Firebox SSL VPN Gateway
Monitoring applications are as follows
Backing up your configuration settings
Reinstalling v 4.9 application software
Apply the v 5.5 software update
Upgrading to SSL v
Launching the v 5.5 Administration Tool
Troubleshooting
Troubleshooting the Web Interface
Web Interface Appears without Typing in Credentials
Read/Write Access to the Firebox SSL VPN Gateway
Other Issues
Web Interface Credentials Are Invalid
License File Does not Match Firebox SSL VPN Gateway
Ping Command
Defining Accessible Networks
Ldap Authentication
VMWare
Internal Failover
Administration Tool Is Inaccessible
Certificate Signing
Certificate Revocation Lists
Secure Access Client
Certificates Using 512-bit keypairs
Secure Access Client Connections with Windows XP
DNS Name Resolution Using Named Service Providers
Using Third-Party Client Software
Ntlm Authentication
Client Connections from a Windows Server
Wins Entries
Appendix B Using Firewalls with Firebox SSL VPN Gateway
BlackICE PC Protection
To view Secure Access Client status properties
McAfee Personal Firewall Plus
Sygate Personal Firewall Free and Pro Versions
Norton Personal Firewall
Tiny Personal Firewall
Add
ZoneAlarm Pro
Click Install from Internet and then click Next
To install Cygwin
New column for those two entries, click Skip
Unencrypting the Private Key
To generate a CSR using the Cygwin Unix environment
To unencrypt the private key
Double-click the Cygwin icon on the desktop
Combining the Private Key with the Signed Certificate
Converting to a PEM-Formatted Certificate
To convert the certificate from PKCS7 to PEM format
Openssl verify -verbose -CApath /tmp certFile
To combine the private key with the signed certificate
Generating Trusted Certificates for Multiple Levels
To generate trusted certificates for multiple levels
Intermediate Certificate
158
Appendix D Examples of Configuring Network Access
Scenario 1 Configuring Ldap Authentication and Authorization
Administration Guide 161
Collecting the Ldap Directory Information
Ldap Server User Attributes Case Sensitive
To configure accessible networks
Configuring Accessible Networks
If necessary, select Enable split tunneling
10.10.0.0/24 10.60.10.0/24
Realm Name, type Default
Creating an Ldap Authentication and Authorization Realm
Creating and Assigning Network Resources to the Sales Users
Creating and Assigning Network Resources to the User Groups
To provide the Engineering users with access to the network
To implement the application policy for the email server
Creating an Application Policy for an Email Server
Administration Guide 169
Creating a Guest User Authentication Realm
Creating Local Users
To create a guest authentication realm for the guest users
To add the local users
Scenario 3 Configuring Local Authorization for Local Users
Appendix E Legal and Copyright Information
174
Administration Guide 175
176
No Warranty
END of Terms and Conditions
Administration Guide 179
180
Index
DNS
FTP
LiveSecurity Service activating 4 benefits of 2 broadcasts
Administration Guide 185
Connection to 28 service scanner 141 session timeout 15, 88
Wctp
188