Using different Security Policies on Group Level for AD within one Portal. SSL-VPN Security on Group Level. Introduction

Transcription

1 SSL-VPN Using different Security Policies on Group Level for AD within one Portal SSL-VPN Security on Group Level Introduction Security on the SSL-VPN is done via Policies which allows or denies access for every user via the Global Policies and for users / groups via the Local Users / Local Groups configuration. You can choose to authenticate using Local users or the authentication server within the company s network. Authenticating with local users will require the Administrator to configure every user within the SSL- VPN appliance. The SSL-VPN also allows you to authenticate also via Active Directory, LDAP and Radius. When using an external authentication server, user accounts will be automatically created within the Local User database. This prevents the administrator from creating different policies for authenticated groups like Administrators, Sales department, Management department, etc. These policies need to be set on every user. This will be time consuming when a number of users need adjustments to their security policy. For Group authentication, it is more convenient to use LDAP and have different Portals for every LDAP Group. Since every LDAP group requires its own portal, each group will require a different URL for its corresponding portal. This technote provides procedures on how to configure different policies for Active Directory authenticated users on group level within one Portal. For this we will use 2 different users adminssl and userssl who we are going to give different policies on group level for access, the adminssl user will have all services allowed but the userssl user will have only HTTP access allowed. Created by P. van Herten

2 Windows 2003 Active Directory Before setting up the SSL-VPN appliance it is necessary to have the users adminssl and userssl configured within the Active Directory Users and Computers. SonicWALL SSL-VPN Appliance The following steps will explain how to setup the SSL-VPN appliance with multiple user groups for one single Active Directory domain. The setup as mentioned will be done via one single Portal for an Active Directory Domain authentication. To log into the Portal it will be necessary to setup a Portal and an Active Directory Domain.

3 This setup as mentioned is to ensure the security of the Network; therefore it has been chosen for a setup where all possibilities for the users to create their own bookmarks and file shares within the created Portal are disabled. To do this go to Portal > Portal Layout and press the configure button. The following popup screen will appear: With the setup Portal SNWL-EMEA it will be difficult for the Users to create any vulnerability for the network; however with this setup it will be the task of the Administrator to manage the bookmarks and policies. Now that the Portal is created it will be necessary to create a Domain which handles the authentication for the users. For this document I have chosen an Active Directory Domain. To create a new domain go to Portal > Domains and press the Add Domain button. The illustration on the left is an example Active Directory setup within the SSL-VPN appliance. This allows the Active Directory users of the (in this case) snwl-emea.com domain to login to the portal SNWL-EMEA (via the Portal URL). The only problem with this is that every user of the domain can login onto the Portal and, as we have mentioned, we would like to narrow the allowed policies for the users adminssl and userssl. Creating an external domain will automatically create a Local Group with the name of the domain within the SSL- VPN appliance.

4 It is possible to setup the allowed policies per user as mentioned within the introduction but it will be time consuming and difficult to manage when there are a lot of users which are allowed to use the SSL-VPN Portal login. It will be more difficult when multiple company departments need to login via the SSL-VPN appliance. To illustrate that kind of setup we will consider the adminssl user to be a member of a different department as the user userssl. For this it is necessary to have the groups for the different departments created already within the SSL-VPN. These groups can be created at the SSL-VPN Local Groups and doesn t need to match the groups within the Active Directory group (it is advisable to use the same user group as what has been set within the Active Directory). To create a Local Group go to Users > Local Groups and press the Add Group button. The illustration on the right shows an example how such a group is created. As you can see the Domain has been set to the Active Directory Domain snwl-emea.com which has been entered within the SSL-VPN appliance. For our setup we create two groups snwladmin and snwl-user, the user adminssl will be set within the group snwl-admin and the user userssl will be set within the group snwl-user. By authenticating via Active Directory it creates automatically an External User within the Local User Database, unfortunately it doesn't allow the administrator to change the Group for this user. Therefore, when you want to specify different policies for every user group, then you need to create manually the users adminssl and userssl within the Local User Database. To create a Local User go to Users > Local Users and press the Add User button. The illustration on the left shows an example how such a local user is created. As you can see the Group/Domain has been set to the Local Group snwl-user which has been entered within the SSL-VPN appliance. After this local user is created it will have the user s adminssl and userssl login in on a single portal and within their own group. This provides the Administrator a bit more workload but also the capability to manage the bookmarks and policies for every member of a group (like Sales Department) on group level and not per user based.

5 By default it is set to have no restricted policies set on the SSL-VPN portal; therefore it is advisable to narrow the allowed users to the user groups that have been set within the SSL-VPN appliance. For this the Global Policy can be used to deny any access (make it the most restricted policy) and create allow policies on the groups which has been set on the SSL-VPN appliance. The automatically created group snwl-emea.com will not be used for any allow policies and bookmarks to avoid any other user than the users adminssl and userssl. To create a security policy within the SSL-VPN go to Users > Local Groups, and press the configure button behind the group where the policy needs to be created within. The following illustration shows a way to setup a policy to allow HTTP access to any IP address. For this setup we have set this policy on the snwl-user group. (keep in mind the restrictions as set on the policy for the group). For the group snwl-admin we need to create a similar policy but for All Services. This way we have specified the policies as mentioned within the Introduction to have the user adminssl with every service allowed and the user userssl with only HTTP access. Now that the security is set for all the portals, groups and users it will leave one more task to do for the administrator. This task is to create bookmarks for the users to use and access. These bookmarks can be done for the different departments on the Local Groups snwl-admin and snwl-user which is easier to manage for the Administrator.