Section 4 Application Description - LDAP

Size: px

Start display at page:

Download "Section 4 Application Description - LDAP"

Milo Benson
8 years ago
Views:

1 Section 4 Application Description - LDAP This section describes the applications and configuration required for authentication utilizing Windows 2000 Server s Active Directory features and a NetScreen network security appliance via LDAP. User Authentication for Access to External Services NetScreen Security functionality provides a means to implement Access Policies that require users wishing to traversal the device, to gain access to network resources, ie.. the Internet first authenticate with a user name and password. Instead of utilizing the internal user database available in ScreenOS, the NetScreen device can be configured to use and external LDAP user database that multiple NetScreen devices can use or other network devices can use. LDAP authentication eliminates the need for device by device management of the access databases on each device. The user database resides on the LDAP server. Each device authenticates the user credentials, his user-name and password, from the LDAP server. This greatly simplifies management user administration for large number of network devices Win2K Server 1. Local network attached host attempts connection to an Internet located service Copyright 2002 NetScreen Technologies, INC. 16

User Authentication for Access to External Services NetScreen Security functionality provides a means to implement Access Policies that require users wishing to traversal the device, to gain access

2 2. NetScreen Appliance intercepts connection attempt prompts user for name and password then requests user authentication from Win2K Server s Active Directory. 3. Win2K Server s Active Directory verifies user name and password and responds accordingly. 4. NetScreen Appliance either permits the connection or rejects it based on response from Win2K Server. 5. If connection accepted user may open his connection to the external service. Copyright 2002 NetScreen Technologies, INC. 17

Win2K Server s Active Directory verifies user name and password and responds accordingly. 4.

3 Section 5 Installing and Configuring Win2k for LDAP Authentication Note: that it is assumed the Windows 2000 server has been configured to be a domain controller and is already running Active Directory. If you have not installed and configure the domain controller you can click on Configure Your Server in the Administrative Tools folder under Control Panel and use the Microsoft provided wizard to configure Active Directory. Configure Users to Authenticate via Active Directory Click on Start->Programs->Administrative Tools->Active Directory Users and Computers Copyright 2002 NetScreen Technologies, INC. 18

If you have not installed and configure the domain controller you can click on Configure Your Server in the Administrative Tools folder under Control

4 Click on Action->New->User then enter full name or first name and last name. Note: Microsoft Windows 2000 Active Directory does not implement the inetorgperson class, so binds cannot be made to the User Logon name. Binds are made to the Full name. The implication of this is the name entered at logon time must be the full name. In the above example Bob Smith would be the name entered when attempting LDAP authentication through a NetScreen network security appliance. The bind attempt will fail for bsmith. When you are finished entering the user information click next and proceed. Enter the user password and click finished. You are now finished configuring Windows 2000 Server for LDAP authentication. Copyright 2002 NetScreen Technologies, INC. 19

The implication of this is the name entered at logon time must be the full name.

5 Section 6 Configuring NetScreen ScreenOS and Testing Authentication Configure the NetScreen security appliance for LDAP authentication via the NetScreen WebUI The following illustrates ScreenOS 3.0 on a NetScreen-5XP. Configuration is similar on other model NetScreens running earlier versions of ScreenOS. Log into the NetScreen's web UI. Click on Configure and then the Authen tab. Click the LDAP Server radio button and configure the IP address of the server and port number. The Common Name Identifier must be set to cn. The Distinguished Name must be set to: cn=<name of user database>,dc=<domain name>,dc=<domain extension> Example where: Users is the name of the user database and test.com is the domain name and extension. cn=users,dc=test,dc=com Copyright 2002 NetScreen Technologies, INC. 20

Click the LDAP Server radio button and configure the IP address of the server and port number. The Common Name Identifier must be set to cn.

6 Create a policy that you ll use authentication with. In this case, an outgoing telnet policy, so the user must authenticate in order to telnet to hosts external to the trusted network. Copyright 2002 NetScreen Technologies, INC. 21

authenticate in order to telnet to hosts external to the

7 Test the Authentication When workstation on the inside is used to attempt a telnet connection to an external host. An authentication request appears on the users screen and if the user authenticates with a name/password of a user in the Active Directory the user will be able to make a telnet connection. The user must then log onto the external host with a user name and password locally administered by that external host. To verify a successful authentication, go to Log->Event Log. A log entry will exist for the authentication. Copyright 2002 NetScreen Technologies, INC. 22

user will be able to make a telnet connection.

8 Configure the NetScreen for LDAP authentication via the NetScreen CLI. Type the following CLI commands to set up user authentication for external access to http services: Command set auth type 3 set auth ldap server-name cn=users,dc=test,dc=com cn set policy outgoing any any http permit auth log Description Sets the authorization type to LDAP Sets the LDAP server IP address and required parameters Sets an outgoing policy for HTTP and logs events associated with it. Test the Authentication When workstation on the inside is used to attempt a telnet connection to an external host. An authentication request appears on the users screen and if the user authenticates with a name/password of a user in the Active Directory the user will be able to make a telnet connection. The user must then log onto the external host with a user name and password locally administered by that external host. To verify a successful authentication type: Command get log event Description A log entry will exist for the authentication. Note: User authentication can only be done via HTTP, FTP or Telnet. These protocols allow for NetScreen to send a request back to the user requesting user credentials. If other protocols are desired to be restricted, then the user would first have to authentic via one of the three listed protocols and then establish a connection using the other protocol. Copyright 2002 NetScreen Technologies, INC. 23

.10.1.75 cn=users,dc=test,dc=com cn set policy outgoing any any http permit auth log Description Sets the authorization type to LDAP Sets the LDAP server IP address and required parameters Sets an

9 Conclusion ScreenOS ability to use external user databases allows for the particle implementation of access policies requiring user authentication. Companies can leverage their user database from Microsoft s Windows 2000 Active Directory when using their NetScreen network security appliances. NetScreen supports both RADIUS and LDAP protocols to suit the network managers needs. Network managers can take advantage of centralized user databases provide by Active Directory to restrict access to external network resources from NetScreen products. Utilizing equipment and software they may already exist in the network will save significant capital expense. Authentication from a centralized source saves many man-hours of configuration time and prevents database divergence which is likely to happen using locally administered user databases. Together NetScreen s authentication and Windows 2000 provide add an additional layer of security to the network at an optimize operational and capital expense. Copyright 2002 NetScreen Technologies, INC. 24

NetScreen supports both RADIUS and LDAP protocols to suit the network managers needs.

Application Note. Using a Windows NT Domain / Active Directory for User Authentication NetScreen Devices 8/15/02 Jay Ratford Version 1.

Application Note. Using a Windows NT Domain / Active Directory for User Authentication NetScreen Devices 8/15/02 Jay Ratford Version 1. Application Note Using a Windows NT Domain / Active Directory for User Authentication NetScreen Devices 8/15/02 Jay Ratford Version 1.0 Page 1 Controlling Access to Large Numbers of Networks Devices to