Infoblox Authenticated DHCP

Transcription

1 Infoblox Authenticated DHCP Unified Visitor Management amigopod Technical Note Revision July 2010 United States of America +1 (888) Europe, Middle East & Asia Australia & Pacific Copyright 2010 amigopod. All rights reserved.

2 Table of Contents Introduction...3 Audience...3 Document Overview...3 Disclaimer...3 About Authenticated DHCP...4 What is Authenticated DHCP?...4 Components...4 Network Diagram...5 Step 1 DHCP server...5 Step 2 DNS server...5 Step 3 Captive portal redirection...5 Step 4 Log in and RADIUS Access-Request...5 Step 5 DHCP authorization update...6 Step 6 DHCP lease renewal...6 Step 7 Visitor management...6 Configuring Authenticated DHCP...7 Check Plugin Versions...7 Accessing Infoblox Services...7 Review Tutorial...7 Configuring Authenticated DHCP...8 Configuring the Infoblox Server...8 Configure Infoblox DHCP Server...9 Configure Infoblox DNS Server...12 Configuring the amigopod Visitor Management Appliance...14 Configure Infoblox server settings...14 Configure RADIUS Web Login page...14 Configure secondary network interface...16 Configure captive portal...16 Restart system services...17 Configure other network equipment...17 Verifying Authenticated DHCP...18 Verify Infoblox connection...18 Verify DHCP client...19 Verify DNS wildcard host...19 Verify captive portal redirection...20 Verify web login page

3 Introduction Audience This technical note explains how to set up the Infoblox Services plugin to provide support for Infoblox Authenticated DHCP. With a network that uses Authenticated DHCP, you can separate authorized clients from unauthorized clients by putting them into separate networks, or separate network segments. Unauthorized clients are quarantined in one segment until they have successfully completed the authentication process, at which time they move to the authorized segment. This document is intended for network administrators and system integrators deploying an amigopod-based visitor management solution. Basic familiarity with the amigopod Visitor Management Appliance is assumed. For in-depth information about the features and functions of the amigopod appliance, refer to the amigopod Deployment Guide. Familiarity with the Infoblox DNS/DHCP infrastructure products is also assumed, including a working knowledge of Infoblox Grid Manager. Document Overview Disclaimer The first section of the document explains what authenticated DHCP is, and how it works The next section contains a detailed configuration guide for deploying a network using authenticated DHCP. The topics of network design, security architectures and visitor access are complex subjects, and no single document can hope to cover all of the possible combinations of network equipment, network design, deployment requirements, and device configurations, nor can all the possible security implications for a particular recommendation be covered. Therefore, while you read this document, it is best to consider it as a guide to developing your own understanding of the network design topics covered, and as a basis for further investigation. 3

4 About Authenticated DHCP What is Authenticated DHCP? Components Authenticated DHCP separates authorized from unauthorized clients by putting them into separate network segments. Unauthorized clients are quarantined in one segment until they have successfully completed the authentication process, at which time they move to the authorized segment. The identity of a client includes both the MAC (hardware) address of the client s network adapter and the username of that client. Authenticated DHCP relies on several different components, as explained below: Infoblox DHCP Server determines if a client is authorized by checking its MAC address against a list (MAC filter), and then issues an IP address for that client in the appropriate range. Infoblox DNS Server for unauthorized clients, used to answer all DNS requests with the address of a captive portal that will require the client to log in. amigopod Captive Portal handles a request by an unauthorized client for a web page, and redirects the client to the web login page. amigopod Web Login provides a customizable, branded interface for clients to log in with a username and password. amigopod Guest Manager management interface for operators to create guest accounts in the amigopod RADIUS server. amigopod Infoblox Services plugin provides access to the Infoblox server using the Infoblox API, so that authenticated clients can be added to the appropriate MAC filter. amigopod RADIUS Server provides user authentication, authorization and accounting for guest accounts. 4

5 Network Diagram Refer to the network diagram below for an explanation of authenticated DHCP. Step 1 DHCP server Step 2 DNS server The Infoblox DHCP server provides IP addresses to network clients. Unauthorized clients receive an IP address with restricted access, and are instructed to use the Infoblox DNS server as their name server. The Infoblox DNS server provides the IP address of the captive portal, for any DNS request made by an unauthorized client. Step 3 Captive portal redirection HTTP requests by an unauthorized client are captured by the captive portal, and are redirected to a web login page. Step 4 Log in and RADIUS Access-Request The client logs in using the web login page. An Access-Request is made to the amigopod RADIUS server to determine if the client is authorized to proceed. 5

6 Step 5 DHCP authorization update Authenticated clients are then authorized to use network resources by updating the MAC Filter rules defined in the Infoblox DHCP server. Step 6 DHCP lease renewal Because the client s MAC address is now authorized, upon renewal of the client s DHCP lease a new address will be provided to the client. The client now has authorized access to the network. Step 7 Visitor management Operators are able to manage visitor accounts in the RADIUS server using amigopod Guest Manager. 6

7 Configuring Authenticated DHCP Check Plugin Versions Authenticated DHCP requires the following plugin versions: Infoblox Services or later amigopod Kernel or later amigopod RADIUS Services or later amigopod Administrator or later To verify you have the correct plugin versions installed, navigate to Administrator > Plugin Manager > Manage Plugins and check the version number in the list. Use the Update Plugins link to download and install updated plugins. Accessing Infoblox Services To access the Infoblox Services plugin, navigate to RADIUS Services > Authentication > Infoblox. Alternatively, use the Infoblox Authenticated DHCP command link from the RADIUS Authentication page: Review Tutorial The built-in authenticated DHCP tutorial provides a step-by-step guide to configuring the components required for an authenticated DHCP network. Click the Authenticated DHCP Tutorial command link to open the tutorial. The tutorial will be displayed at the top of each screen of the user interface. 7

8 The tutorial remains open while you are using the administrative user interface. To quit or restart the tutorial, click More Options, and then click the Restart Tutorial or Quit Tutorial commands. NOTE The remainder of this technical note follows the structure of the tutorial closely. Configuring Authenticated DHCP The configuration is broken down into three parts: 1. Configuring the Infoblox Server 2. Configuring the amigopod Visitor Management Appliance 3. Configuring other network equipment Configuring the Infoblox Server Configuring the Infoblox server requires setting up the following components: DHCP Server including networks and/or network ranges for both unauthorized and authorized clients, MAC filters for authorized clients, and rules specifying how to apply the MAC filters. DNS Server to enable redirecting all requests by unauthorized clients to a web captive portal. NTP Server to enable time synchronization between the RADIUS server and the DHCP server. 8

9 Configure Infoblox DHCP Server The following items need to be configured on the Infoblox DHCP server: DHCP Service must be running in order to provide IP addresses to clients. MAC Filters a MAC filter must be created for each role to be used by authorized clients. Networks and DHCP Ranges different DHCP ranges must be defined for authorized and unauthorized clients, and the appropriate MAC filter rules and properties must be set on each range. Shared Networks if unauthorized and authorized clients are in different networks, rather than different ranges on the same network, then the networks must be configured to share the filtering rules. To ensure that the Infoblox server s DHCP service is running: Configure DHCP MAC Filters 1. Log into the Infoblox Grid Manager server administration interface. 2. Navigate to Grid > Grid Manager tab, and then click the DHCP service. 3. If the DHCP service is not running, select it in the list and then click the Start link. In a typical network environment, there may be several different classes of user sharing the same network infrastructure. Different classes of user are assigned different roles. Each RADIUS User Role that will be used for an authorized client corresponds to a MAC Filter defined in the Infoblox DHCP server. In this way, different types of client can be placed into different networks based on their assigned RADIUS User Role. The mapping from RADIUS User Role to the MAC Filter is performed using the Reply-Message attribute; the value of this attribute is used as the name of the MAC Filter for an authorized client. To set up or verify the MAC Filter configuration of the Infoblox DHCP server: 1. Log into the Infoblox Grid Manager server administration interface. 2. Navigate to Data Management > DHCP, and then click the Filters/Option Spaces tab. 3. Review the list of available filters and create new MAC Filter objects for each role that you intend to use for authenticated DHCP clients. 9

10 NOTE When creating a new MAC Filter, select the Enforce Expiration Times checkbox: This ensures that a guest account s expiration time will also be applied to the client s MAC Filter rules. NOTE Ensure that the Reply-Message attribute of each RADIUS User Role contains the name of the MAC Filter to use for a client using authenticated DHCP. If this RADIUS attribute is set incorrectly, guest accounts with this role will not be able to authenticate properly. Configure DHCP Networks and Ranges To set up or verify the configuration of the Infoblox DHCP server s networks: 1. Log into the Infoblox Grid Manager server administration interface. 2. Navigate to Data Management > DHCP, and then click the Networks tab. 3. Review the list of networks. o If authorized and unauthorized clients will share the same network, create different DHCP ranges on that network for authorized and unauthorized clients. o Otherwise, create different networks for authorized and unauthorized clients, and create a DHCP range on each network. 4. For the unauthorized client DHCP range, verify the following configuration items: o The default lease time should be set to a short interval (20 seconds is recommended). o The DNS server for DHCP clients should be set to the IP address of the Infoblox server. o Rules for MAC filters should be added to deny clients listed in any of the MAC Filters. 10

11 5. For each of the authorized client DHCP ranges, verify the following configuration items: o A MAC filter rule should be added to grant leases to the clients listed in the MAC Filter. o Each MAC filter should correspond to its own DHCP range. NOTE Ensure that unauthorized DHCP clients have both a short lease time and are configured to use the Infoblox DNS server. Both of these items are required for the authenticated DHCP process to work correctly. Configure Shared Networks This step is only required if authorized and unauthorized clients are configured on different networks. Setting up a shared network is required to ensure that all relevant MAC Filter rules are considered when a client requests a DHCP lease. 11

12 To set up or verify the configuration of the Infoblox DHCP server s shared networks: 4. Log into the Infoblox Grid Manager server administration interface. 5. Navigate to Data Management > DHCP, and then click the Networks tab. 6. Click the Shared Networks heading. 7. Verify that a shared network has been created that contains each network used for authenticated DHCP (including both the unauthorized and authorized client networks). NOTE Use a shared network name such as Authenticated DHCP to identify the shared network. Configure Infoblox DNS Server The following items need to be configured on the Infoblox DNS server: Root Zone a zone at the top of the domain name hierarchy must be created. Wildcard Host an A record for all domain names at the root zone must be set up to redirect clients to the captive portal. Configure DNS Root Zone The root zone is at the top of the domain name hierarchy; all DNS entries are implicitly within this zone. To set up or verify the configuration of the Infoblox DNS server s root zone: 1. Log into the Infoblox Grid Manager server administration interface. 2. Navigate to Data Management > DNS, and then click the Zones tab. 12

13 3. Create a new authoritative zone named. (a single dot). This represents the root zone. 4. Set the following properties for the root zone: o Refresh should be 10 seconds. o Retry should be 5 seconds. o Expire should be 10 seconds. o Default TTL should be 10 seconds. o Negative-caching TTL should be 10 seconds. 8. For the permissions of the root zone, define an allow rule that specifies only the IPv4 network for unauthenticated clients. o To do this, edit the properties of the zone, select the Queries option and define an Allow permission for the appropriate network address. NOTE Defining appropriate access permissions ensures that only unauthenticated clients will be redirected via DNS to the captive portal for login. Configure DNS Wildcard Host To set up or verify the configuration of the Infoblox DNS server s wildcard host entry: 1. Log into the Infoblox Grid Manager server administration interface. 2. Navigate to Data Management > DNS, and then click the Zones tab. 3. Select the root zone. The records defined within the zone will be displayed. 4. Add an A record to the zone, with the following properties: 13

14 o Name should be * this represents all hosts in the zone. o The IP address should be the secondary interface address of the amigopod Visitor Management Appliance used for the captive portal redirector. o TTL should be 10 seconds. Configuring the amigopod Visitor Management Appliance Configuring the amigopod Visitor Management Appliance requires setting up the following components: Infoblox Services set up external access to the Infoblox server. RADIUS Web Logins create a login page for clients to use. Secondary Interface used for HTTP requests made by unauthorized clients. Captive Portal enables redirecting all requests by unauthorized clients to the login page. Configure Infoblox server settings First, configure the Infoblox server settings using the Plugin Manager. To do this, navigate to Administrator > Plugin Manager > Manage Plugins, and then click the Configuration link for the Infoblox Services plugin. Configure RADIUS Web Login page Unauthorized clients will be redirected to a web login page when they make any HTTP request, for example opening their web browser s home page. The client is prompted for their username and password credentials, and if authenticated successfully, the appropriate MAC filter modifications are made. 14

15 To configure a web login page, navigate to RADIUS Services > Web Logins, and click the Create a new web login page link. Complete the fields for the web login as described below: Name Enter a name, for example Authenticated DHCP Login. This name is only used to identify the web login page. Page Name The page name forms part of the URL that the client will use to access the web login page. Type in a name such as infoblox_login. Remember this page name, as you will need the URL constructed from it a bit later. Vendor Settings For an authenticated DHCP login page, select Infoblox from the list. Secure Login Leave this option as the default ( Use vendor default ). Custom Form This option is only required if you are making advanced customizations. Leave it unselected for now. Custom Labels This option is only required if you are making advanced customizations. Leave it unselected for now. Pre-Auth Check It is recommended that this option be left unselected. Terms Select this to require clients to accept the terms and conditions of use when they log in. Enabling this option will add an extra checkbox to the login form. Default URL Leave this blank to redirect clients to their original URL after they have successfully authenticated. You can also enter a specific URL, and select the Force default destination for all clients checkbox, to redirect all clients to a specific URL when they log in. Skin The skin controls the basic look and feel of the login page. Select an appropriate skin from the drop-down list. Title Type an appropriate title for the web login page, for example Login. Header HTML This HTML template code is displayed to the user on the login page. If an error occurs during the authentication process, the client will be redirected back to the login page, and a page variable named $errmsg will be set with a description of the error. The default Infoblox configuration displays the error message, and a brief message about the login form. You should customize this message to suit the needs of your clients. Footer HTML This HTML template code is displayed to the user on the login page. You should customize this message to suit the needs of your clients. 15

16 Login Message This HTML template code is displayed to the user while the login attempt is in progress. Once the authentication is successful, the client will be redirected to their original destination after a short login delay. This allows for the client to renew their DHCP lease and obtain a new lease from the appropriate authorized network range. During the wait, this message will be displayed to the user, and a page variable named $_authorized will be set. You can use this to change the message displayed. Complete the fields marked as required on this page, and then click the Save Changes button. Configure secondary network interface A secondary network interface is required for use with the captive portal. Incoming HTTP requests on this interface will be captured and redirected to the web login page. To create a secondary network interface, navigate to Administrator > Network Setup > Network Interfaces, and then click the Create a secondary network interface link. Complete the fields for the secondary network interface as described below: Physical Interface Select the physical network interface here. Either this interface should be connected to the unauthorized network, or suitable network routing rules must exist to allow unauthorized clients access to the secondary IP address on this physical interface. IP Address Define the IP address to use for the secondary interface. This IP address must be set as the DNS wildcard host A record that is configured on the Infoblox DNS server. Doing this enables capturing all DNS requests from unauthorized clients and redirecting them to the captive portal. Netmask Define the network mask for the secondary network interface. Activate Select this option to enable the secondary interface immediately. Complete the fields marked as required on this page, and then click the Create Interface button. Configure captive portal The captive portal enables the automatic redirection of all HTTP requests by unauthorized clients to the web login page. To configure the captive portal, navigate to RADIUS Services > Authentication > Infoblox, and then click the Captive Portal Configuration command link. 16

17 Complete the fields for the captive portal as described below: Enable Select this option to enable the captive portal redirection functionality. Network Interface Select the secondary interface IP address that will be used for the captive portal. When the captive portal is enabled, all HTTP requests to this IP address will be redirected to the web login page. Login Page Enter the URL of the web login page that will be used to authenticate clients logging in through the captive portal. You should use the page name of the web login page you created. For example, if your login page has the page name infoblox_login, then you might enter a URL such as: Login Failed Message Leave this field blank while you are setting up the captive portal. Post-Authentication Delay The redirection delay must be at least half the DHCP lease time for unauthorized clients. Log Messages While you are setting up the captive portal, it may be useful to set the log level to a higher value. Log messages generated may be reviewed in the Application Log by navigating to Administrator > Plugin Manager > Application Log. Complete the fields marked as required on this page, and then click the Save Changes button. Restart system services If changes have been made to the captive portal configuration or other system settings, you may be prompted that System services need to be restarted on the amigopod Visitor Management Appliance. Configure other network equipment Use the following list to guide your configuration of any other network equipment that will be involved in delivering the authenticated DHCP service to clients: For the unauthorized network range: o Restrict access to all network resources unless specifically allowed o Allow access to the Infoblox DHCP server for DHCP requests 17

18 o Allow access to the Infoblox DNS server for DNS requests o Allow access to the amigopod Visitor Management Appliance both the secondary IP address (for the captive portal), as well as another IP address (for the login page) port 80 (HTTP) and/or 443 (HTTPS) o It is important that no network address translation takes place between the unauthorized client and the web login page the amigopod Visitor Management Appliance must have the client s DHCP lease address in order to perform authenticated DHCP. For each authorized network range: o Grant access to network resources required by clients of that type NOTE The topics of network design, security architectures and visitor access are complex subjects, and this tutorial cannot cover all of the possible combinations of network equipment, network design, deployment requirements, and device configurations. Use this list as a guide to help you identify the right combination of tools and techniques for your network environment. Verifying Authenticated DHCP Use the following steps to check each component of the authenticated DHCP network: Verify Infoblox server ensures that the Infoblox Services plugin has network connectivity to the Infoblox server, the Infoblox API is available, and that the username and password credentials are correct. Verify unauthorized DHCP client ensures that the Infoblox DHCP server is correctly configured, and that unauthorized clients can successfully connect to the network and obtain a DHCP lease. Verify DNS wildcard host ensures that the Infoblox DNS server is correctly configured, and that unauthorized clients can make DNS requests and receive back the correct IP address for the captive portal. Verify captive portal redirection ensures that unauthorized clients are redirected to the web login page for any HTTP request. Verify Infoblox connection Navigate to RADIUS Services > Authentication > Infoblox, and then click the Test Infoblox Server command link. 18

19 This form can be used to verify that Infoblox Services has network connectivity to the Infoblox server, and that the configured username and password credentials are correct. Select the Connection test and credential verification operation. Click the Run Test button to verify the connection to the Infoblox server. If you see the message Connection test was successful, then you have verified that the network details and credentials are correct. If you see an error message, review it carefully for details on what the problem might be. Verify DHCP client To verify the configuration of the Infoblox DHCP server, connect a client to the network that has been configured for DHCP. Verify that the client is granted an IP address from the unauthorized network range. Also verify that the client s DHCP lease time is very short 20 seconds is typical. Verify that the client has received a DNS server address that corresponds to the Infoblox DNS server. Troubleshooting: If the client does not get an IP address, or is granted an incorrect IP address, check the following: Are there any other DHCP servers between the client and the Infoblox server? Is the client able to reach the Infoblox DHCP server? Is the Infoblox DHCP server running? Is the Infoblox DHCP server configured correctly? Is the client s MAC address already listed in an authorized MAC Filter? Verify DNS wildcard host To verify the configuration of the Infoblox DNS server, and the root zone defined on that server, use a DNS testing tool such as nslookup or dig on an unauthorized DHCP client. Look up any domain name with the tool, and verify that the Infoblox DNS server responds with the secondary IP address of the amigopod Visitor Management Appliance. 19

20 Verify that all domain names are resolved to the same IP address even non-existent domain names. Troubleshooting: If the client is not able to contact the DNS server, or the DNS server does not return the correct IP address, check the following: Is the client able to reach the Infoblox DNS server using ping or a similar tool? Is the client receiving the correct DNS server address via DHCP? Is the Infoblox DNS server running? Is the Infoblox DNS server configured correctly? Are the permissions on the Infoblox DNS root zone configured correctly for the unauthorized client network? Is the wildcard host entry in the root zone configured with the correct IP address? Verify captive portal redirection To verify the configuration of the captive portal, open a web browser on an unauthorized DHCP client and browse to any URL. Verify that the captive portal responds and that the browser s address bar is updated with the URL of the web login page. Try browsing to another URL, and verify that the captive portal redirection remains in effect for the unauthorized client. Troubleshooting: If the client is not redirected to the captive portal, or the client web browser reports errors, check the following: Is the client successfully resolving all hostnames to the secondary IP address of the amigopod Visitor Management Appliance? Is the client able to reach the secondary IP address using ping or a similar tool? If the client and amigopod Visitor Management Appliance are on different networks, is there a suitable routing rule in place? o To configure static routes, navigate to Administrator > Network Setup > Network Interfaces, select the appropriate network interface in the list, and then click the Routes link. o To verify IP connectivity from the amigopod Visitor Management Appliance to a DHCP client, use the built-in Network Diagnostics feature, which provides standard network tools including ping and traceroute. Is the captive portal configured correctly? Have the system services been restarted? 20

21 Verify web login page To verify the web login page is working correctly, provide a username and password on the login page and click the Log In button. NOTE To create an account, navigate to Guest Manager > Create Account, or review the current list of accounts at Guest Manager > List Accounts. For additional details on guest account management, refer to the amigopod Deployment Guide. If the credentials supplied are incorrect, verify that you are returned to the same login page and an error message is displayed. If the credentials supplied are correct: Verify that a login message is displayed while the authentication is processed. Verify that the client s IP address changes to the authorized network range that corresponds to the appropriate user role (MAC Filter). Verify that the appropriate MAC Filter on the Infoblox DHCP server has been updated with the client s MAC address. Verify that after the captive portal redirection delay, the client is redirected to their original URL (e.g., home page). Troubleshooting: If the authentication fails, check the following: Certain errors may have additional details in the Application Log. Is the guest account enabled? Has the guest account expired? Is there a MAC Filter defined for the account s role? 21