GlobalSign Enterprise Solutions

Size: px

Start display at page:

Download "GlobalSign Enterprise Solutions"

Jane Chandler
9 years ago
Views:

1 GlobalSign Enterprise Solutions SonicWALL VPN User Guide Building a secure network using Enterprise PKI, SonicWALL Firewall, and Mobile Connect app for ios

2 TABLE OF CONTENTS Introduction... 3 About This Document... 3 Document Focus... 3 Settings for SonicWALL Firewall Device... 3 Obtain An SSL Certificate... 4 Import SSL Certificate into SonicWALL Security Appliance... 4 Enable SSL... 6 Create the User Account and Add to SSLVPN Services... 6 Settings for Enterprise PKI... 8 Create a Configuration Profile... 8 Upload Configuration Profiles Issuance of a Certificate Setting Up the End User Device Connecting to your VPN GlobalSign Contact Information

3 INTRODUCTION ABOUT THIS DOCUMENT In this document we will describe how using a digital certificate enabled Apple configuration profile delivered through GlobalSign s Enterprise PKI (epki) service for the iphone/ipad can be used to make a secure SSL VPN connection via the SonicWALL Mobile Connect app for ios to a SonicWALL Firewall device. Implementing certificate based two factor authentication on ios devices can help organizations protect sensitive resources stored on internal networks. The contents described in this material were confirmed in our verification environment and results may differ depending on exact organization environment. DOCUMENT FOCUS The procedures in this document have been tested in the following environments. SonicWALL TZ210 GlobalSign Enterprise PKI iphone4 (ios 5.1) SonicWALL Mobile Connect (Secure Mobility Client) SETTINGS FOR SONICWALL FIREWALL DEVICE The following steps are required to install the server certificate, enable the VPN connection, and install the client certificate that will access the VPN. Detailed instructions for each step are provided below. 1. Obtain an SSL Certificate Create an SSL certificate via your GlobalSign GCC Account. For this step, you should create a certificate using AutoCSR; this will give you a certificate in PKCS12 format for easy importing into the SonicWALL Security Appliance. 2. Import SSL Certificate into SonicWALL Security Appliance. 3. Enable SSL After your SSL Certificate is imported, enable the SSL VPN connection in the firewall. 4. SSL Server Configuration 5. Create the User Account and add to SSLVPN services 3

Implementing certificate based two factor authentication on ios devices can help organizations protect sensitive resources stored on internal networks.

4 OBTAIN AN SSL CERTIFICATEE To apply for a server certificate using the GlobalSign Certificate Center (GCC) panel, select the AutoCSR method of enrolling for an SSL certificate. Use your VPN URL as common name in your certificate request. After certificate issuance, it will be possible to retrieve the PKCS12 file (certificatee + private key) for importing into the SonicWALL Application. The file will be delivered in a.pfx format. IMPORT SSL CERTIFICATE INTO SONICWALL SECURITY APPLIANCE First, you will need to log into the SonicWALL Security Appliance. Navigate to System > Certificates. Click the Import button at the bottom of the screen. The following Import Certificate popup windoww will appear. 4

After certificate issuance, it will be possible to retrieve the PKCS12 file (certificatee + private key) for importing into the SonicWALL Application.

5 Choose the Import a local end user certificate with private key option. Enter a Certificate Name, the password of the PKCS12 file and browse to the location of the PKCS12 file. Click the Import button when finished. Back on the System > Certificates screen, you can view the certificate you just imported by selecting the Imported certificates and request view. 5

the PKCS12 file. Click the Import button when finished.

6 ENABLEE SSL This section allows you to enable or disable SSL and select the interface you wantt turned on. Within the SonicWALL Security Appliance, navigate to SSL VPN > Server Settings. Select (click) the zone(s) thatt your clients will be connecting from; on selection the zone(s) should turnn green. Here you can also change the VPN Port and SSL certificate used by the server. CREATE THE USER ACCOUNT AND ADDD TO SSLVPN SERVICES Within the SonicWALL Security Appliance, navigate to Users > Locall Users. 6

Select (click) the zone(s) thatt your clients will be connecting from; on selection the zone(s) should turnn green.

7 Click on the Add User button and enter user s username and password details. Repeat this procedure for each user who will have access to your VPN. On the Groups tab, Select SSLVPN Services from the list of User Groups. After selection, hit the arrow under the list to move this group to the Member Of list on the right hand side. Finally, click the OK button to complete the SonicWALL configuration for this user and repeat this procedure for each user requiring access. 7

On the Groups tab, Select SSLVPN Services from the list of User Groups.

8 SETTINGS FOR ENTERPR RISE PKI Use Enterprise PKI to send a configuration profile at the same time that you install the certificate on the device. Enter your Enterprise PKI account to upload the configuration profile that you created using the iphone Configuration Utility, and then start with the issuance of certificates. CREATE A CONFIGURATION PROFILE First you will need to create a new configuration profile in the iphone Configuration Utility, available as a free download on Apple s site. Click the SCEP section on the left side of the screen to begin. Add dummy values to the following fields. The actual values will be overwritten by the system. URL: input dummy value Name: input dummy value Subject: O= =input dummy value, OU=input dummy value Challenge: test Next Select VPN in the menu on the left. 8

9 Here you set the following values: Connection Name: Any name Connection type: SonicWALL Mobile Connect Server: SonicWALL Host name or IP address you connect to for VPN access Set Password as means of User Authentication and enter the user s password you created above. You will be required to create a separate profile for each user. At this point you can also add, via the Restrictions section, any security restrictions to the devices you wish implemented before they can enter your network. You can also adjust account settings via the section and exchange settings via the Exchange ActiveSync section.. 9

10 Export the profile you just created, either with or without signature. UPLOAD CONFIGURATION PROFILES In your GlobalSign GCC account click the Enterprise PKI tab. Click onn the Certificate Management item in the left hand menu. You will be prompted to present a certificate (you will need to obtain an administrator certificate during the first visit). 10

tab. Click onn the Certificate Management item in the left hand menu.

11 After presenting the certificate, you will see a menu item Edit iphone configuration at the bottom left menu, under the Useful Function section. Clicking that brings up the following screen. Click the Edit button next to the appropriate profile. This will bring up the following screen. Click Browse to select the configuration profile that you created with the iphone Configuration Utility. Click the Upload button and confirm the upload byy clicking the Next button. 11

12 The profile is now in place. ISSUANCE OF A CERTIFICATEE Issuance of certificates in Enterprise PKI can be carried out in two ways: New Certificate New Certificate Registration (BULK) Bulk Certificate Registration allows multiple certificate registrationss to be created concurrently via a CSV upload. For this example, we will use single certificate registration. Click New Certificatee in the Certificate Management section of the left hand menu. Select the appropriate profile and license and then click Next. Enter the Common Name and Address on the following screen. To ensuree the certificate can only be installed on one specific device, you can add the UDIDD or IMEI to the Device Authentication ID field. The Pickup Password will be used during installation of the certificate. Once you finish filling out the field, click the Next button. A certificate pickup will be sent to the user. 12

certificate registrationss to be created concurrently via a CSV upload. For this example, we will use single certificate registration.

13 SETTING UP THE END USER DEVICE In the end usebelow. device, certificate retrieval and VPN access is automatically set up by following the procedure Before installing the certificate, ensure SonicWALL Mobile Connect ios app is installed on the device. 13

set up by following the procedure Before installing the

14 Using the client on the device, click the URL in the pickup you will receive from GlobalSign. You will be redirected to the GlobalSign website and asked for the pickup password. Add the password, click the Get Cert button, and follow the instructions on the screen to installl the certificatee and VPN profile on the device. Click the Install button on the screen below to finish installing the certificate. The certificate installation process is now complete. 14

Add the password, click the Get Cert button, and follow the instructions on the screen to installl the certificatee

15 CONNEECTING T TO YOUR V VPN You can no ow connect to tthe VPN by opening the Mob bile Connect cl ient and hitting the Connect button. GLOBA ALSIGN CO ONTACT IINFORMA ATION GlobalSign Amer G ricas GlobalSign EEU GlobalSiggn UK Tel: T 562 Tel: Tel: w com sales [email protected] [email protected] [email protected] GlobalSign FR G GlobalSign D DE GlobalSiggn NL Tel: T Tel: Tel: w fr ventes@globalsig v gn.com verkauf@glo obalsign.com m 15

globalsign. w com www.globalssign.eu www.gloobalsign.co.uk sales us@globalssign.com sales@globaalsign.com sales@gllobalsign.

GlobalSign Enterprise Solutions

GlobalSign Enterprise Solutions Cisco VPN User Guide Building a secure network using Enterprise PKI, Cisco ASA, and AnyConnect app for ios TABLE OF CONTENTS Table of Contents... 2 Introduction... 3 About