NetMotion + YubiRADIUS Quick Start Guide

Introduction Disclaimer Yubico is the leading provider of simple, open online identity protection. The company s flagship product, the YubiKey, uniquely combines driverless USB hardware with open source software. More than a million users in 100 countries rely on YubiKey strong two-factor authentication for securing access to computers, mobile devices, networks and online services. Customers range from individual Internet users to e-governments and Fortune 500 companies. Founded in 2007, Yubico is privately held with offices in California, Sweden and UK. The contents of this document are subject to revision without notice due to continued progress in methodology, design, and manufacturing. Yubico shall have no liability for any error or damages of any kind resulting from the use of this document. The Yubico Software referenced in this document is licensed to you under the terms and conditions accompanying the software or as otherwise agreed between you or the company that you are representing. Trademarks Yubico and YubiKey are trademarks of Yubico Inc. Contact Information Yubico Inc 228 Hamilton Avenue, 3rd Floor Palo Alto, CA 94301 USA info@.com NetMotion + YubiRADIUS Quick Start Guide 2012 Yubico. All rights reserved. Page 2 of 7

Contents Introduction... 2 Disclaimer... 2 Trademarks... 2 Contact Information... 2 1 YubiRADIUS Setup... 4 1.1 General Configuration... 4 1.2 Domain Configuration... 4 2 NetMotion Mobility XE Setup... 5 NetMotion + YubiRADIUS Quick Start Guide 2012 Yubico. All rights reserved. Page 3 of 7

1 YubiRADIUS Setup Before starting, ensure YubiRADIUS 3.6.1 is configured correctly to communicate with the local Active Directory or LDAP domain, as well as with the validation service (either local validation or the YubiCloud). Full instructions on setting up YubiRADIUS can be found in the YubiRADIUS Configuration Guide, available on the Yubico Website here: http://www..com/products/services-software/yubiradius/download/ 1.1 General Configuration 1) Open the YubiRADIUS Webadmin interface and navigate to the Global Configuration Domain Tab. 2) In the General Configuration Tab, open the General Configuration menu. 3) In the General Configuration Menu, locate the option Authentication Profile. From the menu, select Profile-1 4) Save the new configuration. 1.2 Domain Configuration 1) Open the YubiRADIUS Webadmin interface and navigate to the YubiRADIUS Domain Tab. 2) Click the domain associated with your NetMotion Mobility XE Active Directory/LDAP. This domain should be set up during the initial configuration of YubiRADIUS. 3) In the Selected Domain page, click on the Configuration Tab 4) In the Selected Domain Configuration page, locate the Add Client Section. In the Add Client section, enter the following details about the NetMotion Mobility XE installation: a. Client IP enter in the IP address of the NetMotion Mobility XE. If you enter an IP address that ends with 0/24, (such as 192.168.1.0/24), YubiRADIUS will accept a request from client across the entire subnet on the selected port. b. Client Secret / Confirm Client Secret This is a symmetric shared secret between the YubiRADIUS Service and the RADIUS Client. Please follow best practice secure password policies when creating this shared secret. YubiRADIUS can hold a secret of up to 50 characters. 5) Click the Add button below the fields to add the NetMotion Mobility XE to YubiRADIUS. Once done, the details entered will appear below the Add Client section. 6) In the RADIUS Client section below the Add Client section, check the box next to the newly created NetMotion Mobility XE entry, then click the Enabled Selected button at the bottom. YubiRADIUS will be configured to accept and pass authentication requests to and from the NetMotion Mobility XE installation. NetMotion + YubiRADIUS Quick Start Guide 2012 Yubico. All rights reserved. Page 4 of 7

2 NetMotion Mobility XE Setup Before starting, ensure NetMotion Mobility XE is configured correctly using user credentials stored in an Active Directory / LDAP server. Full instructions on setting up NetMotion Mobility XE can be found at http://www.netmotionwireless.com/mobility-xe.aspx 1) Log into the NetMotion Mobility XE web interface. 2) In the Main Menu, locate and click on the Authentication:User Protocol option. 3) In the Authentication:User Protocol page, Global Settings, set the Protocol to RADIUS EAP (PEAP and EAP-TLS), then click Apply. NetMotion + YubiRADIUS Quick Start Guide 2012 Yubico. All rights reserved. Page 5 of 7

4) In the Main Menu, locate and click on the Authentication:User RADIUS Server List option. 5) In the Authentication:User RADIUS Server List page, Global Settings, Click the Add Button. This will open the RADIUS Server Entry Page. 6) In the RADIUS Server Entry Page, locate the field labelled IP Address and enter the IP address of the YubiRADIUS Virtual Application. 7) Locate the Port field and verify it is automatically populated with the default RADIUS port value, 1812. 8) Leave the NAD ID field blank 9) Locate the Shared Secret field and enter in the Client Secret used in YubiRADIUS. The Shared Secret must match the Client Secret exactly. NetMotion + YubiRADIUS Quick Start Guide 2012 Yubico. All rights reserved. Page 6 of 7

10) Confirm the Shared Secret by typing it in again in the Confirm Shared Secret Field. 11) Click the OK button. The Newly created RADIUS server profile should be displayed in the RADIUS Server menu. 12) In the main MobilityXE menu, locate and click on the Authentication:Device RADIUS Server List option 13) In the Authentication:Device RADIUS Server List page, Repeat steps 5-11 to add the YubiRADIUS Server in that section as well. The newly created YubiRADIUS server profile should be displayed in the RADIUS Server menu, and should be identical to the entry in the Authentication:User RADIUS Server List page. 14) For redundant or backup instances of YubiRADIUS, repeat steps 4-13 with the IP Address of each server. The Order (top to bottom) of the RADIUS servers in the menu will set the order in which the YubiRADIUS Servers are accessed for OTP Validation. 15) Users can now login with 2 factor authentication with their YubiKey by entering their YubiKey generated OTP after their password in the password field. NetMotion + YubiRADIUS Quick Start Guide 2012 Yubico. All rights reserved. Page 7 of 7