NETASQ ACTIVE DIRECTORY INTEGRATION

Transcription

1 NETASQ ACTIVE DIRECTORY INTEGRATION NETASQ ACTIVE DIRECTORY INTEGRATION RUNNING THE DIRECTORY CONFIGURATION WIZARD 2 VALIDATING LDAP CONNECTION 5 AUTHENTICATION SETTINGS 6 User authentication 6 Kerberos authentication method 7 Validating authentication FILTER RULES BASED ON AUTHENTICATION 3 Redirecting unauthenticated users 3 User based rules 4 Example ruleset 4 ADVANCED LDAP CONFIGURATION 6 Backup domain controller 6 LDAP access via SSL 7

2 Running the directory configuration wizard In this chapter you will learn how to connect NETASQ to Active Directory to perform user and group based authentication for your filter and VPN services. You can start the wizard for connecting to Active Directory by selecting Users Directory Configuration in the web-based manegement site. Select Connect to a Microsoft Active Directory on this page. 2 NOTE If you have got a previosuly configured directory access (either Active Directory or LDAP), you won t see the wizard. You have to press the small wizard icon in the top right corner. WARNING Since you can t have multiple authentication sources at the same time, by finishing the wizard the content of your formal internal LDAP database will be deleted. Configurations for external directories will be also lost.

3 On the next page configure your connection settings for the domain controller.on this page you can t change to LDAPS or add a secondary domain controller. You will have the oppurtunity to configure them after finishing the wizard. 3 Field Server Port ID Setting Create a host object for the domain controller, with its internal IP. Set it to 389 (ldap) now. If you don t want to allow write access for your NETASQ firewall, you should choose a user with read-only access to the LDAP. For security reasons you are not supposed to connect with Administrator account. You have to use the DN of the user. If the user is in an Active Directory container, the right format is: cn=administrator,cn=users If the user is in an organizational unit, eg.: cn=testuser,ou=employees

4 NOTE Before setting up the connection, make sure that Windows firewall on the Domain Controller doesn t not block incoming LDAP access. You can allow it in Windows Firewall with Advanced Security Inbound rules Active Directory Domain Controller LDAP (TCP-In). For Kerberos authentication, you should also check the firewall rules. Enable access to the captive portal in third step. Captive portal will be used to authenticate the users. 4

5 Validating LDAP connection After the wizard successfully finished, you should check if the firewall can see your domain users. Please go to Configuration Users Users, and check the user list and attributes. 5

6 Authentication settings You can set the properties of captive portal at Configuration Users Authentication. User authentication For Active Directory please select authenticate directly on the directory with the user account at the General Advanced properties. 6

7 Kerberos authentication method The wizard by default configures LDAP authentication. For security reasons you should use Kerberos authentication. WARNING For Kerberos authentication the time on the firewall and on the domain controlles must be synchronized. More than five minutes delay results in authentication failures. Please make sure that the firewall s clock and the domain controller s clock is synchronized, and the same timezone is used on both devices. You can check time settings in Configuration System Configuration General configuration. As a best practice we advice to set the domain controller as an NTP server. 7

8 You can enable Kerberos authentication in Configuration Users Authentication Available methods. Please select Add an authentication method Kerberos. 8 After adding the authentication method, you should enable it for internal interfaces. You will need to enable it for external interfaces, if you would like to use SSL VPN later.

9 Field Domain name (FQDN) Access to server Backup server Setting The Kerberos realm name, usually equals to the Windows domain name. It must be in capital letters. Please select the primary domain controller s host object and kerberos_udp port for communication. Please select the secondary domain controller s host object and kerberos_udp port for communication. 9

10 Please make sure that the Kerberos method is configured as a default authentication. You can check it at Configuration Access Privileges Default access. 0

11 Validating authentication You can test authentication by going to the captive portal directly. You can access it on the internal IP address of the firewall via HTTPS. Please enter your username without the domain prefix or postfix. Please select the authentication period. After pressing login you will be asked for your password. NOTE By default the maximum authentication period is 8 hours. You can modify it at Configuration Users Authentication Internal interfaces Authentication periods allowed. If authentication was successful, please logout. Press Login/Logout, type again the username and press the Logout button.

12 If you have any problems during authentication, please refer to the authentication logs. You can follow authentication logs by using the CLI on the web interface. Go to Configuration System CLI and type the following command: monitor log auth. 2

13 Filter rules based on authentication You can create filter rules based on Active Directory users and groups. We will give a simple example for this way of using Active Directory integration. Redirecting unauthenticated users You can force your users to be authenticated. In a Filtering policy please select New rule Authentication rule. 3 In the wizard select from which network the users should be redirected to the authentication portal. In the example below, unauthenticated users from Network_OFFICE will be redirected to the authentication, if they want to reach a website on the Internet.

14 User based rules In the filtering and NAT rules you can configure users and group to be used as source. That way you can attach different security policies to different users or groups. Please double click on Source column in Filtering configuration. Example ruleset In the ruleset below you can see an example configuration of user based filter policies. 4 st rule: redirect all unauthenticated users to the captive portal, if they start a HTTP request on the internet 2 nd rule: Management has got full access to any web pages, without any restrictions. Antivirus is applied for their connections. 3 th rule: Employees have restricted access during workhours to internet using WorktimeURLs URL filtering list. 4 th rule: Employees out of work hours have different URL filtering slot, which is not so restrictive like during workhours.

15 NOTE In the filtering rules we have created rules only for HTTP traffic. For HTTPS connections, you need to use SSL filtering rules. If you wouldn t like to be redirected to the captive portal, you can use transparent authentication. In this case the users after logging in to the domain will be automatically authenticated. Please refer to our SSO SPNEGO technical note. 5

16 Advanced LDAP configuration Backup domain controller If you want to configure a secondary domain controller to be used, you can do it by going back to Configuration Users Directory configuration and selecting Advanced properties. Please add a host object for the secondary domain controller in the Backup server field. You should validate access by pressing the button Test access to the directory. 6

17 LDAP access via SSL NETASQ supports accessing Active Directory user database via SSL protocol. This is additional step, which can make your connection secure between the firewall and the domain controllers. Open the Configuration Users Directory configuration page, and select Secure Connection (SSL). Check Enable SSL access. In the Certificate authority field, please add the CA which issued the domain controller s certificate. You need to import this CA certificate at Configuration Objects Certificates. 7 NOTE You might need several changes on the domain controllers, to enable LDAP SSL access.