FortiNAC Citrix XenMobile Device Integration

Transcription

1 FortiNAC Citrix XenMobile Device Integration Version: 8.x Date: 09/07/2018 Rev: B

2 FORTINET DOCUMENT LIBRARY FORTINET VIDEO GUIDE FORTINET KNOWLEDGE BASE FORTINET BLOG CUSTOMER SERVICE & SUPPORT FORTINET COOKBOOK FORTINET TRAINING AND CERTIFICATION PROGRAM NSE INSTITUTE FORTIGUARD CENTER FORTICAST END USER LICENSE AGREEMENT Friday, September 7, 2018

3 Contents Citrix XenMobile Integration 1 Implementation 1 Citrix XenMobile 1 FortiNAC 1 Mobile Devices 2 Citrix XenMobile Host/Device Registration Process 4 Enable / Disable Authentication 6 MDM Services 8 Portal Content Editor 11 Allowed Domains 20 Enable And Disable Events 22 Events For The System 22 Events For A Specific Group 22 Map Events To Alarms 22 Add or Modify Alarm Mapping 27 User/Host Profiles 32 Add/Modify A User Or Host Profile 35 Network Access Policies 38 Manage Network Access Policies 40 Add/Modify A Network Access Policy 43 Network Access Configurations 44 Add/Modify A Network Access Configuration 46 Citrix XenMobile Integration i

4 Table Of Contents ii Citrix XenMobile Integration

5 Citrix XenMobile Integration When a connection is established between FortiNAC and Citrix XenMobile Mobile Device Management (MDM) mobile devices connecting to the network can be registered in FortiNAC incorporating some information stored in the Citrix XenMobile database. FortiNAC periodically polls Citrix XenMobile to update records for those devices that are registered in FortiNAC. This integration speeds up the registration process and eliminates the need to install both the FortiNAC agent and the Citrix XenMobile Agent on a mobile device. Implementation This implementation list assumes that Citrix XenMobile is in place and managing mobile devices. The list below outlines the requirements for integrating Citrix XenMobile and FortiNAC. Citrix XenMobile Configure a System Administrator user in Citrix XenMobile to be used by FortiNAC for authentication when requesting data. FortiNAC Connecting hosts can be registered to a user or as a device. To register hosts to a user you must enable Forced Authentication in FortiNAC. User information cannot be retrieved from Citrix XenMobile for registration and is retrieved from the authentication directory during the registration process. See Enable / Disable Authentication on page 6. Configure a MDM Service to establish a connection with the Citrix XenMobile server. See MDM Services on page 8. Navigate to the Content Editor and modify the Portal Configuration content to redirect mobile devices to Citrix XenMobile if the device does not have an MDM Agent installed. The MDM settings are under Content Editor > Global > Settings > Use Configured MDM and Content Editor > Registration > MDM Registration. See Portal Content Editor on page 11. You must configure links to the web sites where users can download the appropriate MDM agent for their device. For example, if the user is connecting to the network with an iphone, you must have a link to the page in the itunes store where the Apple MDM agent can be downloaded. Devices that have a Citrix XenMobile Agent would never reach the captive portal. Citrix XenMobile Integration 1

6 Implementation If a user needs to download an MDM agent they must have access to the appropriate web site. Confirm that the necessary web sites are listed in the Allowed Domains view. Unregistered hosts can only navigate to sites listed in Allowed Domains. See Allowed Domains on page 20. Events associated with the MDM integration can be enabled and mapped to alarms. See Enable And Disable Events on page 22 and Map Events To Alarms on page 22. Events include: - MDM Host Created - MDM Host Destroyed - MDM Poll Failure - MDM Poll Success - MDM Host Compliance Failed - MDM Host Compliance Passed Hosts can be marked "at risk" when the host is not in Compliance with an Citrix XenMobile policy by using an Alarm mapped to the MDM Host Compliance Failed event. Configure a User/Host Profile for each type of Network Access. For example, you may want to place all Apple devices on VLAN 10 and all Android devices on VLAN 11. To do this you must create two User/Host Profiles, one for Apple and one for Android. See User/Host Profiles on page 32. Configure a Network Access Policy for each VLAN you wish to configure and associated it with a User/Host Profile to determine who is placed in each VLAN. See Network Access Policies on page 38. Mobile Devices Note: Hosts cannot register or connect to the network via VPN using the Citrix XenMobile Agent. Hosts that need to connect via VPN must have a FortiNAC Agent installed. Each managed device must have the Citrix XenMobile Agent installed. Refer to the Citrix XenMobile documentation for instructions. If a device connects to the network and no MDM Agent is detected, the FortiNAC captive portal displays a message indicating that no MDM agent has been detected. Links to the appropriate site to download the agent are displayed. Some sample links are preconfigured, however, you must go to the Portal Content Editor and add the links that allow the different device types and operating systems to download the appropriate agent. Mobile devices registered using the Citrix XenMobile database are registered to a user if Forced Authentication is enabled in FortiNAC and the user authenticates to a directory during the registration process. If Forced Authentication is not enabled in FortiNAC, the device is registered as a device. 2 Citrix XenMobile Integration

7 Implementation Additional fields that are specific to MDM Services have been added to the host record and can be used as a filter in User/Host Profiles. See Host View And Search Field Definitions. Mobile devices registered from Citrix XenMobile are assigned NAC-Default as the role unless the user has a different role set. If the user has a role, the device inherits the users role. Citrix XenMobile Integration 3

8 Citrix XenMobile Host/Device Registration Process Citrix XenMobile Host/Device Registration Process When Citrix XenMobile and FortiNAC are integrated the registration process for hosts is as follows: 1. A host connects to the network and is detected by FortiNAC. 2. If the host is running an operating system, that is not supported by Citrix XenMobile it becomes a rogue and goes through the regular registration process, either through the captive portal or Device Profiler or any other registration method configured in FortiNAC. 3. If the host is running one of the operating systems listed below, FortiNAC checks to see if the Citrix XenMobile MDM Agent is installed. This requires that On-Demand registration be enabled in the MDM Service record for the Citrix XenMobile integration with FortiNAC. See MDM Services on page 8. - Apple ios - Android - Windows Phone 8 - Windows 8 - Windows Mobile - Symbian 4. Hosts without an MDM Agent are sent to the captive portal where the user is asked to download and install an MDM agent before connecting to the production network. Links to the sites where agents can be downloaded must be configured by an Admin user under Content Editor > Global > Settings > Use Configured MDM and Content Editor > Registration > MDM Registration. See Portal Content Editor on page If the host has the Citrix XenMobile MDM Agent installed FortiNAC connects to Citrix XenMobile, retrieves the host data from the Citrix XenMobile database and registers the host in FortiNAC. See Host View And Search Field Definitions. 6. If Forced Authentication is enabled in FortiNAC and the user authenticates to a directory, then the host is registered to that user. See Enable / Disable Authentication on page If Forced Authentication is not enabled FortiNAC, the host is registered as a device. 8. Based on the User/Host Profile that matches the host, a Network Access Policy is applied and the host is placed in the appropriate VLAN. 9. Settings selected for the MDM Service that controls the connection between Citrix XenMobile and FortiNAC determine when Citrix XenMobile is polled for updated information. 4 Citrix XenMobile Integration

9 Citrix XenMobile Host/Device Registration Process Note: Application inventory cannot be retrieved for devices registered based on information from Citrix XenMobile. Citrix XenMobile Integration 5

10 Citrix XenMobile Host/Device Registration Process Enable / Disable Authentication Enable / Disable Authentication is used to determine whether or not authentication is enforced on the network. To exclude users from the Authentication process, add them to the Forced User Authentication Exceptions Group. See Add Users To Groups. To enforce authentication the ports on which users connect to the network must be in a Forced Authentication port group. See System Groups and 1. Click System > Settings. Figure 1: Enable / Disable Authentication 2. Expand the Authentication folder. 3. Select Enable/Disable from the tree. 4. Use the table of field definitions below the steps for detailed information on each field. 5. Click Save Settings. 6 Citrix XenMobile Integration

11 Citrix XenMobile Host/Device Registration Process Table 1: Authentication Field Definitions Field Enable Authentication Definition Disabled = Unchecked Enabled = Checked (default) When enabled, the user is authenticated against a directory, the FortiNAC database, or a RADIUS server when logging on to access the network. Time reserved for login before switching user to Authentication (minutes) Enable Persistent Agent Authentication Window Default = 10 When a user is waiting to authenticate, the host remains in the production VLAN until this time expires. If the user fails to authenticate within the time specified, the host is moved to the Authentication VLAN. Disabled = Unchecked (default) Enabled = Checked If enabled, this activates authentication using a Persistent Agent window. Default = 12 Time for user to Authenticate through Persistent Agent before switching VLANs (minutes) Enable Reauthentication When a user is waiting to authenticate, the host remains in the production VLAN until this time expires. If the user fails to authenticate within the time specified, the host is moved to the Authentication VLAN. Any time a user needs to authenticate, there may be a delay displaying the authentication window based on the timing of the Persistent Agent's communication cycle with FortiNAC. Disabled = Unchecked (default) Enabled = Checked When reauthentication is enabled the user is required to reauthenticate after the specified time has elapsed. Time before user is required to authenticate. (hours) The Time the user stays authenticated when the machine is offline. (minutes) Default = 12 When set, this forces users to re-authenticate every X hours since the last authentication regardless of the host's state. The host is moved to the authentication VLAN. Default = 10 Once the machine is offline, the user remains authenticated for this period of time. If the machine comes back online before the time period ends the user does not have to reauthenticate. If the machine comes back online after the time period ends, the user is required to re-authenticate. Citrix XenMobile Integration 7

12 Citrix XenMobile Host/Device Registration Process MDM Services MDM Services allows you to configure the connection or integration between FortiNAC and a Mobile Device Management (MDM) system. FortiNAC and the MDM system work together sharing data via an API to secure the network. FortiNAC leverages the data in the MDM database and registers hosts using that data as they connect to the network. Important: Proxy communication is not supported. See Navigation and Filters for information on common navigation tools and data filters. MDM Vendors Supported Figure 2: MDM Services MDM Vendors that can be integrated with FortiNAC include: Vendor AirWatch Additional Documentation AirWatch Integration AirWatch Host/Device Registration Process MaaS360 MaaS360 Integration MaaS360 Host/Device Registration Process MobileIron Citrix XenMobile MobileIron Integration MobileIron Host/Device Registration Process Citrix XenMobile Integration on page 1 Citrix XenMobile Host/Device Registration Process on page 4 8 Citrix XenMobile Integration

13 Citrix XenMobile Host/Device Registration Process MDM Services Field Definitions Field MDM Vendor Name Request URL Identifier User ID Password Definition Name of the vendor of the MDM system. Name of the connection configuration for the connection between an MDM system and FortiNAC. The URL for the API to which FortiNAC must connect to request data. This will be a unique URL based on your MDM system. A type of key used to identify FortiNAC to the MDM server. This field is not required for all MDM products. In the case of AirWatch, this is the API Key generated during the AirWatch Configuration. An API key is a unique code that identifies the FortiNAC server to AirWatch and is part of the authentication process for AirWatch. User name of the account used by FortiNAC to log into the MDM system when requesting data. Password for the account used by FortiNAC to log into the MDM system when requesting data. This field displays only when adding a new MDM connection configuration. It is not displayed in the table of MDM servers. Poll Interval Last Poll Last Successful Poll Create Date On Demand Registration Indicates how often FortiNAC should poll the MDM system for information. Date and time of the last poll. Date and time of the last poll that successfully retrieved data. Date that this connection configuration was set up. If enabled, when an unknown host reaches the captive portal, FortiNAC queries the MDM server for information about that host. If the host exists in the MDM server, it is registered in FortiNAC using the data from the MDM server. Revalidate Health Status On Connect Remove Hosts Update Applications If enabled, when the host connects to the network FortiNAC queries the MDM server to determine if the host is compliant with MDM policies. NOTE: This setting is disabled by default. When enabled, the MDM may not be able to manage the rate of queries from FortiNAC, causing performance issues. If enabled, when FortiNAC polls the MDM server it deletes hosts from the FortiNAC database if they have been removed or disabled on the MDM server. If enabled, when FortiNAC polls the MDM server it retrieves and stores the Application Inventory for hosts that are in the FortiNAC database. NOTE: This setting is disabled by default. When enabled, the MDM may not be able to manage the rate of queries from FortiNAC, causing performance issues. Buttons Export Exports the data displayed to a file in the default downloads location. File types include CSV, Excel, PDF or RTF. See Export Data. Citrix XenMobile Integration 9

14 Citrix XenMobile Host/Device Registration Process Field Test Connection Poll Now Definition Tests the connection between the selected MDM server and FortiNAC. Error messages indicate which fields are missing or incorrect. Polls the MDM server immediately. Add/Modify MDM Service 1. Click System > Settings. Figure 3: Add MDM Service 2. Expand the System Communication folder. 3. Select MDM Service from the tree. 4. To modify a record: Select a MDM Service record from the table and click Modify. 5. To add a new record: Click Add at the bottom of the window. 6. Use the field definitions for the MDM Services topic to enter the MDM Service information. See MDM Services on page Click OK to save. 10 Citrix XenMobile Integration

15 Citrix XenMobile Host/Device Registration Process Portal Content Editor The Content Editor tab on the Portal Configuration window allows you to edit the portal pages distributed with FortiNAC. If you have existing portal pages and you prefer not to use the ones distributed with FortiNAC, simply leave the Use Portal Version 1 option enabled on this window. Note: Use a separate browser to test Portal Pages. Testing pages in the same browser logs the Admin user out of the user interface. Note: In a High Availability environment, portal pages are copied every 10 minutes. The Content Editor is navigated using the tree control on the left side. The top level of the hierarchy represents the scope, such as Registration or Remediation. The Global scope contains common items that apply to all portal pages including the Styles Editor. Within each scope are individual pages. When a page is selected the properties it contains are displayed on the right. Each page contains properties that can be edited such as Window titles or login text. See Portal Page Content Fields for definitions of the scopes, pages and properties that are configurable using the Content Editor. See Edit Portal Page Content on page 14 for instructions on using the Content Editor. The Images tab displays the images used in Portal Pages, such as the banner. Images can also be uploaded from the Images tab. Multiple portals can be created and managed from the Content Editor. Portals can be copied and then modified. For the Content Editor the information you display and modify pertains to the set of portal pages selected in the Portal drop-down at the bottom of the view. The images stored in and uploaded to the Images tab are global across all portals. See Multiple Portals. Citrix XenMobile Integration 11

16 Citrix XenMobile Host/Device Registration Process Figure 4: Portal Configuration - Content Editor Tab HTML can be used to format text that will display in the captive portal web pages. Some characters are reserved for HTML and must be entered using special character combinations, such as the & or ampersand symbol, which must be entered as & to display correctly. If you enter one of these characters, a warning is displayed reminding you that it may cause issues when rendered on the web page shown to the user. For a complete list of reserved characters and charts for replacement options, see Using Special Characters Or Foreign Characters In Portal Pages. Note: You may see the same warnings when using a character in the course of formatting with HTML, such as <b>bold</b>. This would trigger a warning because < and > are reserved characters. 12 Citrix XenMobile Integration

17 Citrix XenMobile Host/Device Registration Process Content Editor Option Definitions Option Use Portal Version 1 Definition This option is enabled by default. Indicates that the system should use the custom portal pages you created by hand. In addition, portal pages that can be modified with the Content Editor are provided with FortiNAC. This option can be enabled and disabled as needed. When enabled the original custom portal pages are used. When disabled the portal pages associated with the Content Editor are used. Important: It is recommended that you configure the new pages first, then disable the Use Portal Version 1 option to begin using the new pages. If you disable the Use Portal Version 1 option before configuring your new pages, network users may not be able to access your network. Adjust Width Portal Copy Reset to Defaults Refresh Export Import Images Tab Modifies the space available to display field titles. Slide to the right to expand the titles and contract the fields. Slide to the left to expand the fields and contract the titles. Drop-down list of all of the existing portals. The portal selected in this field is the portal that is currently being edited. Use the Create New Portal Configuration option to add a new set of portal pages. Copy the elements of one set of portal pages to another set. There are options to copy all elements or just the styles to create a new portal or to overwrite an existing portal. See Copy A Portal. Resets all pages and page properties to their original factory defaults for the selected portal. This includes all user specified text. Refreshes the window and discards any unsaved changes. Allows you to export all portals with page properties, style sheets and images to a zip file that can be imported on another FortiNAC appliance or can be used as a backup of your portal page configuration. Each set of portal pages is stored as a single XML file within the Zip file. The Zip file can be edited to remove unwanted portals prior to importing on another appliance. See Export Portal Page Content. Allows you to select a previous export file for import. See Import Portal Page Content. Displays the images for the selected portal. Uploads new images to the appropriate location for use in the selected portal.see Portal Page Images. Citrix XenMobile Integration 13

18 Citrix XenMobile Host/Device Registration Process Edit Portal Page Content The Content Editor allows you to modify the content of the portal pages seen by your network users. This editor only modifies portal pages distributed with FortiNAC in version or higher. Legacy portal pages cannot be edited using this tool. See Portal Content Editor on page 11 for additional information. If you are familiar with HTML, you can add formatting within the content fields for your pages. Test each page carefully because your formatting may conflict with something that is in the default settings for the page. Make sure to test portal pages in a separate browser of a different brand. If you test in the same browser you will be logged out of the Admin user interface. For example, if you are running the Admin user interface in Google Chrome, test the portal pages in Internet Explorer. For information on each Scope, Page and Property, see Portal Page Content Fields. 1. Select System > Portal Configuration. 2. Click on the Content Editor tab. 3. If you have created more than one portal, select the portal to be edited from the drop-down list at the bottom of the view. 4. Click on a Scope in the left hand pane to expand it. 5. Click on a Page within the selected Scope. The properties for that page are displayed in the right pane. 6. Modify the properties as needed and click Apply to save your changes. When changes are made to the portal pages there is a delay before the changes are displayed. Edit Portal Page Style Sheets The Style Sheet Editor allows you to modify the look and feel of the portal pages seen by your network users. This editor only modifies portal pages distributed with FortiNAC in version or higher. Legacy portal pages cannot be edited using this tool. See Portal Content Editor on page 11 for additional information. When the Style Sheet Editor is accessed it displays a sample portal page. This gives you a way to preview your changes as you make them. There are two methods for editing your style sheets. The first method is to click on an item in the sample page to pop-up a window of options that can be modified. The second method allows you to enter custom rules for different items in the sample page. This option requires knowledge about cascading style sheets and elements within those style sheets. Note: Some mobile devices may automatically interpret any text resembling a phone number as a hyperlink. As a result, all rules relative to hyperlinks, including text color, are applied and may cause unexpected results. You may need to supply custom rules in the Style Editor to correct any unexpected issues. 14 Citrix XenMobile Integration

19 Citrix XenMobile Host/Device Registration Process Modify Styles Using The Sample Portal Page 1. Select System > Portal Configuration. 2. Click on the Content Editor tab. 3. If you have created more than one portal, select the portal to be edited from the drop-down list at the bottom of the view. 4. In the tree on the left, select Global > Styles to display the style editor. Citrix XenMobile Integration 15

20 Citrix XenMobile Host/Device Registration Process Figure 5: Style Editor - Edit By Element 5. As you pass the mouse over the page, a hand is displayed for items that can be edited. For example, if you pass the mouse over the word REGISTRATION on the right side of the window, a hand is displayed and you may see a blue block that reads "editable". Click on the word REGISTRATION to open a properties 16 Citrix XenMobile Integration

21 Citrix XenMobile Host/Device Registration Process window. Options contained within the window will vary depending on the item selected. Figure 6: Style Editor - Properties Window 6. Make changes as needed and click Preview to return to the Style Editor. Your changes display on the sample portal page. 7. When all of the necessary changes have been made,click the Apply button. Citrix XenMobile Integration 17

22 Citrix XenMobile Host/Device Registration Process Modify Styles Using The Custom Rules Definitions Note: In order to use Custom Rules you must have a working knowledge of CSS. 1. Select System > Portal Configuration. 2. Click on the Content Editor tab. 3. If you have created more than one portal, select the portal to be edited from the drop-down list at the bottom of the view. 4. In the tree on the left, select Global > Styles to display the style editor. 5. Scroll to the Custom Rules Definitions section at the bottom of the window. Using the Custom Rules option you can add multiple rules and each rule can contain multiple properties. Figure 7: Style Editor - Custom Rules Definitions 6. To add a rule, click in the Selector field and enter the selector and name of the element you wish to configure. The selector indicates the type of element being modified. For example a period (.) indicates that you are adding a 18 Citrix XenMobile Integration

23 Citrix XenMobile Host/Device Registration Process property to a class in the style sheet. In the screen shot shown above,.pagetitle represents the banner at the top of the sample window. 7. Click in the Property field and enter the name of the property you wish to set. In the example above, the color property is being set. 8. Click in the Value field and enter the value of the property, such as blue for color or bold for font-weight. 9. To add another property to the rule, click the Add Property button and an addition set of fields is displayed. 10. To add another rule, click the Add Rule button and a new rule section is displayed. 11. The Preview button allows you to see your changes on the sample page. 12. The Reset button discards all changes and returns the sample page and the custom rules to the state they were in when the Style Editor was first opened. 13. To save, click Apply at the bottom of the Content Editor View. This saves changes both in the rules section and in the sample page section. Citrix XenMobile Integration 19

24 Citrix XenMobile Host/Device Registration Process Allowed Domains Use the Allowed Domains View to specify the domains and Production DNS Server that isolated hosts use to gain access to network locations. For example, if hosts are in isolation because they do not have the latest virus definitions for their virus software, they would need to be able to access the web site for their virus software to download virus definitions. Note: If you have used a valid SSL certificate to secure the portal, add the domain of the certificate authority to the Domains list, such as verisign.com. This allows the host's browser to validate the certificate. Field IP Address Proxy Auto Config Definition The IP Address(es) of the Production DNS Server(s). Optional. If you use a Proxy server, this populates the wpad.dat file with the information that allows a host to learn about the Proxy server. This also adds the Domains listed to allow hosts in Isolation to reach sites related to Anti-Virus, Anti- Spyware or Operating System updates required. See Web Proxy Integration for additional information. Domains Revert To Defaults A list of authorized domains that an isolated host is permitted to access, such as microsoft.com. Reset the values to the factory settings. 20 Citrix XenMobile Integration

25 Citrix XenMobile Host/Device Registration Process Figure 8: Domains Citrix XenMobile Integration 21

26 Enable And Disable Events Enable And Disable Events Use the Event Management window to select which events will be logged. Events For The System 1. Click Logs > Event Management. The Event Management view appears. 2. Use the Filters to locate the appropriate event. Refer to Event Management for Filter field definitions. 3. To enable an event, select one or more events and click the Options button. Select one of the following: a. Internal Logs only to an internal events database. b. External Logs only to an external host. c. Internal & External Logs both to an internal events database and an external host. Note: Any event that is logged is enabled. 4. To disable an event, select one or more events and click the Options button. Select Disable Logging. Note: To log events on an external log host, you must first add the log host to FortiNAC. See Log Events To An External Log Host for instructions. Events For A Specific Group Logging events for a specific group limits the number of times the event is generated. The event will only be generated for members of the selected group. 1. Click Logs > Event Management. The Event Management view appears. 2. Use the Filters to locate the appropriate event. Refer to Event Management for Filter field definitions. 3. Select one or more events and click the Options button. Choose one of the logging options to enable the event. 4. Click the Modify Group button. 5. Click in the Group drop-down box and select the Group for which this event will be enabled. 6. Click OK. Map Events To Alarms An event indicates that something significant has happened within FortiNAC. All events that are generated are logged in the event log. If an event is mapped to an alarm, you are immediately informed by the alarm notification system. Some events are mapped to alarms by default. 22 Citrix XenMobile Integration

27 Map Events To Alarms To view events that are mapped to alarms select Logs > Event to Alarm Mappings. For a list of possible alarms see Events And Alarms List. Note: If an event is disabled, the associated Alarm Mapping is grayed out and has a line through it. To enable the event, right click on the Alarm Mapping and select one of the Enable options. See Navigation and Filters for information on common navigation tools and data filters. Enable/Disable Alarm Mappings When mapping events to alarms, you have the option to disable an alarm mapping to prevent the generation of alarms when the selected event occurs. This may be useful during periods you know will generate many events. An example of this is during the repair of a modeled network device. You may want to block the Device Contact Lost and Established events from getting to the system since they will be expected. Another example is to block the Rogue User Detected event during an Open House when many rogues will be detected. Use the Enable and Disable buttons at the top of the view to enable and disable selected Alarm Mapping records. Alarm Mapping Field Definitions Figure 9: Event To Alarm Mappings Refer to Add or Modify Alarm Mapping on page 27 for additional information on each field. Citrix XenMobile Integration 23

28 Map Events To Alarms Field Enable Buttons Enabled Event Alarm Clear Event Severity Definition Enables or disables the selected Alarm Mappings. Disabled mappings do not trigger an alarm when the associated event is generated. A green check mark indicates that the mapping is enabled. A red circle indicates that the mapping is disabled. Name of the Event that triggers this alarm. Name of the Alarm that is mapped to the event. Name of the event that must be generated to clear the alarm mapped in this Alarm and Event combination. Critical - Minor - Warning - Informational - Only the text of the severity is displayed. Severity icons do not display in the Alarm Mappings table. Notify Users Indicates who will be notified if this alarm is triggered, such as, All Management Group. Rules that determine when the alarm is triggered. Options include: One Event to One Alarm Every occurrence of the event generates a unique alarm. Trigger Rule All Events to One Alarm The first occurrence of the event generates a unique alarm. Each subsequent occurrence of the event does not generate an alarm, as long as the alarm persists when subsequent events occur. When the alarm clears, the next occurrence of the event generates another unique alarm. Event Frequency Number of the occurrences of the event generated by the same element within a user specified amount of time determines the generation of a unique alarm. Event Lifetime Duration of an alarm event without a clearing event within a specified time, determines the generation of a unique alarm. Apply To Elements to which this alarm mapping applies. Options include: All Applies this mapping to all elements. Group Applies this mapping to a single group of elements. Specific Applies this mapping to an element that you select from a list. 24 Citrix XenMobile Integration

29 Map Events To Alarms Field Action Definition If an Action is enabled in the mapping, displays the action that will be taken when this alarm is triggered. Options include: Host Access Action Host is disabled and then re-enabled after the specified time has passed. Host Role The host's role is changed and then set back to the original role after the specified time has passed. Host Security Action Host is set At Risk and then set to Safe after the specified time has passed. Command Line Script You can specify a particular command line script to be executed as an alarm action. User Action An is sent to the user associated with the host. SMS User Action An SMS Message is sent to the user associated with the host. Port State Action Port is disabled and then re-enabled after the specified time has passed. Send Message to Desktop Send a text message to the desktop of a host(s) with the Persistent Agent or Fortinet Mobile Agent for Android installed. Send To External Log Hosts Send To Custom Script Event Logging Indicates whether this alarm is sent to an external log host when the trigger event occurs, select this check box. Default = No. Name of the command line script to be executed when this alarm is triggered. These command line scripts are for advanced use, such as administrator-created Perl scripts. Scripts are stored on the server in the following directory: /home/cm/scripts Indicates where the event is being logged or if logging has been disabled. Options include: Disabled Event is disabled and will not be generated or logged anywhere. Internal Logs only to an internal events database. External Logs only to an external host. Internal & External Logs both to an internal events database and an external host. Event Logging Group Group name of a group of elements, such as, port group, device group or user group used to limit generation of the selected event to the items in the group. If set to All Groups, then the event is generated for all items, such as ports, devices, hosts or users. Right Mouse Click Menu Options & Buttons Bulk Modify Delete Displays only when multiple mappings are selected. Opens a limited Modify dialog and allows you to modify Severity and Notification settings. See Bulk Modify Alarm Mappings. Deletes selected mappings from the database. Citrix XenMobile Integration 25

30 Map Events To Alarms Field Modify Enable Disable Event Logging - Disable Event Logging - Internal Event Logging - External Event Logging - Internal & External Export Definition Opens the Modify dialog and allows you to modify the selected mapping. Enables the selected mappings. Disables the selected mappings. Disables the events associated with the selected mappings. Enables the events associated with the selected mappings and logs to an internal events database. Enables the events associated with the selected mappings and logs to an external host. Enables the events associated with the selected mappings and logs to both an internal events database and an external host. Exports data to a file in the default downloads location. File types include CSV, Excel, PDF or RTF. See Export Data. 26 Citrix XenMobile Integration

31 Add or Modify Alarm Mapping Add or Modify Alarm Mapping Figure 10: Add Mapping 1. Select Logs > Event to Alarm Mappings. 2. Click Add or double-click on an existing mapping to modify it. 3. Refer to the field definitions table below for detailed information about each field. 4. The new mapping is enabled by default. If you wish to disable it, remove the check mark from the Enabled check box. 5. In the Apply To section, select the element affected by this mapping. You can apply mappings to all elements, a single group of elements, or specific elements. Note: Available selections vary depending upon the selected Trigger Event. Citrix XenMobile Integration 27

32 Add or Modify Alarm Mapping 6. Click the box and select an element from the drop-down list. 7. If you choose to Apply To a Group, you can select a group from the list or use the icons next to the group field to add a new group or modify the group shown in the drop-down list. Note that if you modify a group, it is modified for all features that make use of that group. See Add Groups for additional information. 8. Select the Notify Users settings. 9. If you choose to Notify Users, you can select an Admin Group from the list or use the icons next to the Group field to add a new group or modify the group shown in the drop-down list. Note that if you modify a group, it is modified for all features that make use of that group. See Add Groups for additional information. 10. Select the Trigger Rule for the event from the drop-down list. Rules determine when an Event triggers the creation of an Alarm. 11. If you enable the Action option, select the Action to take when the event occurs and the alarm is asserted. These are basic actions that FortiNAC executes on a given alarm. 12. Action parameters display. Select the Primary Task from the drop-down list. 13. For some actions there is a secondary task. If desired, click the Enable box in the Run Secondary Task section, select Min, Hr, or Day and enter the corresponding value. 14. Click OK. The new mapping is saved and appears in the Event/Alarm Map View. Table 2: Add/Modify Alarm Mapping Field Definitions Field Definition Alarm Definition Enabled Trigger Event Alarm to Assert Severity Clear on Event If checked, the alarm mapping is enabled. Default = Enabled. Event that causes the alarm. Whenever this event occurs, its associated alarm is generated. The alarm is automatically listed when you select the event. The alarm generated when the event occurs. Sets the severity of the alarm. Select one of the values from the drop-down list: Critical, Informational, Minor, and Warning. This value may be changed for existing Alarm and Event mappings. To automatically clear the alarm when a specific event occurs, select this check box. Select the event that, when generated, causes this alarm to be removed. If you leave the check box unchecked, you must manually clear the alarm. Default = Unchecked (Disabled) 28 Citrix XenMobile Integration

33 Add or Modify Alarm Mapping Field Send Alarm to External Log Hosts Definition The alarm is sent to an external log host when the trigger event occurs, select this check box. See Properties Log Hosts for details on configuring an external log host. Default = Unchecked (Disabled) You can specify a particular command line script to be executed when this alarm is triggered. These command line scripts are for advanced use, such as administrator-created Perl scripts. First, write the script that is to be used as the alarm action. Store the script in this directory: /home/cm/scripts Send Alarm to Custom Script Apply To If there are no scripts in the directory, this field is not available. Click the check box to enable the option and select the correct script from the drop-down list. The arguments that are automatically passed to the script are as follows: type EndStation. User or Network Device name name of element ip IP address mac MAC address user userid msg message from alarm All Applies this mapping to all elements. Group Applies this mapping to a single group of elements. Specific Applies this mapping to the element that you select from a list. Notify Users Notify Send Send SMS If checked, the administrators in the selected group are notified when an alarm occurs. If checked, the administrators in the selected group are sent an when the alarm occurs. Administrators must have an address configured in the Modify User dialog to receive this . If checked, the administrators in the selected group are sent an SMS message when an alarm occurs. Administrators must have a Mobile Number and Mobile Provider configured to receive this SMS message. Trigger Rules One Event to One Alarm Every occurrence of the event generates a unique alarm. All Events to One Alarm The first occurrence of the event generates a unique alarm. Each subsequent occurrence of the event does not generate an alarm, as long as the alarm persists when subsequent events occur. When the alarm clears, the next occurrence of the event generates another unique alarm. Citrix XenMobile Integration 29

34 Add or Modify Alarm Mapping Field Event Frequency Event Lifetime Definition The number of the occurrences of the event generated by the same element within a user specified amount of time determines the generation of a unique alarm. Settings are updated when the Action is configured. Example: Assume the Host Connected event is mapped to an alarm and the frequency is set to 3 times in 10 minutes. Host A connects 3 times in 10 minutes and the alarm is triggered. Host A connects 2 times and host B connects 2 times, there are 4 connections in 10 minutes. No alarm is generated because the hosts are different. Host A connects at minutes 1, 8 and 12. No alarm is triggered because the host did not connect 3 times in 10 minutes. Host A connects at minutes 1, 8, 12, and 14. An alarm is triggered because connections at minutes 8, 12 and 14 fall within the 10 minute sliding window. The duration of an alarm event without a clearing event within a specified time, determines the generation of a unique alarm. Example: Event A occurs. If Event B (clear event) does not occur within the specified time, an alarm is generated. Actions Action Host Access Action Host Role If checked, the selected action is taken when the alarm mapping is active and the alarm is asserted. Host is disabled and then re-enabled after the specified time has passed. The host's role is changed and then set back to the original role after the specified time has passed. Roles are attributes of the host and are used as filters in User/Host Profiles. Those profiles determine which Network Access Policy, Endpoint Compliance Policy or Supplicant EasyConnect Policy to apply. Note: If roles are based on a user's attribute from your LDAP or Active Directory, this role change is reversed the next time the directory and the FortiNAC database resynchronize. Host Security Action Host is set At Risk and then set to Safe after the specified time has passed. You can specify a particular command line script to be executed as an alarm action. These command line scripts are for advanced use, such as administratorcreated Perl scripts. Command Line Script First, write the script that is to be used as the alarm action. Store the script in this directory: /home/cm/scripts The IP and MAC address arguments that are automatically passed to the script are in the format shown in this example: User Action SMS User Action /home/cm/scripts/testscript :00:00:00:00:00 An is sent to the user associated with the host. The text of the is entered in the Host Action dialog box. An SMS Message is sent to the user associated with the host. The text of the message is entered in the SMS User Action dialog box. The recipient must have a Mobile Number and Mobile Provider configured. 30 Citrix XenMobile Integration

35 Add or Modify Alarm Mapping Field Port State Action Send Message to Desktop Definition The port is disabled and then re-enabled after the specified time has passed. Send a text message to the desktop of a host(s) with the Persistent Agent or Fortinet Mobile Agent for Android installed. Citrix XenMobile Integration 31

36 User/Host Profiles User/Host Profiles User/Host Profiles are used to map sets of hosts and users to Network Access Policies, Endpoint Compliance Policies, Supplicant EasyConnect Policies or Portal Polices. User/Host Profiles can be reused across many different policies. For example, Network Access Policies are used to assign the VLAN in which a host is placed. Each Network Access Policy has a specific User/Host profile and a Network Access Configuration containing a VLAN, CLI Configuration or VPN Group. When a host requires network access, FortiNAC looks at the Network Access Policies starting with the first policy in the list and checks that the User/Host profile is a match. If it is not, the next Network Access Policy is checked until a match is found. User/Host Profiles are combinations of User/Host data. A host's or user's profile is not fixed but can change based on the user/host being moved to a different group, having a new attribute applied, connecting to the network in a different place or the current time of day. Users/hosts are only classified at the time that they need a service, such as a Network Access Policy. When FortiNAC evaluates a host connection, the data for the user and host are prioritized as follows: Logged in User and Host Registered User and Host Registered Host Important: If you create a User/Host Profile with fields Where (Location) set to Any, Who/What by Group set to Any, Who/What by Attribute left blank and When set to always, it matches ALL users and hosts. This is essentially a Catch All profile. If this User/Host Profile is used in a policy, all policies below that policy are ignored when assigning a policy to a user or a host. To highlight this, policies below the policy with the catch all profile are grayed out and have a line through the data. The best way to use a Catch All profile is to create a general policy with that profile and place it last in the list of policies. User/Host Profiles can be accessed from Policy > Policy Configuration > User/Host Profiles or from System > Quick Start > Policy Configuration, however configuration steps point you to Policy > Policy Configuration > User/Host Profiles. See Navigation and Filters for information on common navigation tools and data filters. 32 Citrix XenMobile Integration

37 User/Host Profiles Figure 11: User/Host Profiles View User/Host Profiles View Field Definitions Field Name Where (Location) Who/What By Group Who/What By Attribute When Note Last Modified By Last Modified Date Definition Each profile must have a unique name. Location on the network where the host is connected. This field lists groups of ports, SSIDs or devices. Hosts are checked to determine whether they have connected to the network via one of the selected devices, ports or SSIDs. Host must connect on one of the items contained within one of the selected groups to match this profile. When set to Any, this field is a match for all hosts or users. Host or User groups where the host or user must be a member to match this profile. Host or user must be in at least one of the groups listed. When set to Any, this field is a match for all hosts or users. Indicates whether or not attribute filters have been created for this Profile. Filters are based on Adapter, Host and User data. A host or user must meet all parameters within a single filter, but is only required to match one filter in the list. See User/Host Profile Filter Example. If the host is on the network during the specified time frame, it matches this profile. Time options include Always or a specific set of days of the week and times of the day. User specified note field. This field may contain notes regarding the data conversion from a previous version of FortiNAC. User name of the last user to modify the profile. Date and time of the last modification to this profile. Right Mouse Click Menu - Options Button Menu Copy Delete Copy the selected Profile to create a new record. Deletes the selected Profile. Profiles that are currently in use cannot be deleted. Citrix XenMobile Integration 33

38 User/Host Profiles Field In Use Modify Definition Indicates whether or not the selected Profile is currently being used by any other FortiNAC element. See User/Host Profiles In Use. Opens the Modify Profile window for the selected Profile. Buttons Export Exports the data displayed to a file in the default downloads location. File types include CSV, Excel, PDF or RTF. See Export Data. 34 Citrix XenMobile Integration

39 User/Host Profiles Add/Modify A User Or Host Profile You are not required to complete all of the fields when creating a User/Host Profile. If you leave a field blank, it is set to Any or is left blank. When set to Any or blank, the field is a match for all hosts or users. You can create a profile with only location, only a group, only an attribute filter, only a time range or any combination of those options. Figure 12: Add User/Host Profile Citrix XenMobile Integration 35

40 User/Host Profiles Figure 13: Specify Time 1. Select Policy > Policy Configuration. 2. In the menu on the left, User/Host Profiles should be selected. 3. Click the Add button or select an existing Profile and click Modify. 4. Click in the Name field and enter a name for this Profile. 5. Click the Select button next to the Where (Location) field. Choose one or more device, port or SSID groups by clicking on the names in the All Groups column and clicking the right arrow to move them to the Selected Groups column. Click OK to continue. 6. Click the Select button next to the Who/What by Group field. Choose one or more user or host groups by clicking on the names in the All Groups column and clicking the right arrow to move them to the Selected Groups column. Click OK to continue. 7. To add a filter, click the Add button next to the Who/What by Attribute field. These filters narrow the number of hosts to which this Profile applies. The Adapter, Host, User Filter window displays allowing you to select one or more pieces of data to use as a filter. See Host View And Search Field Definitions, Adapter View And Search Field Definitions and User View And Search Field Definitions for detailed descriptions of the fields on the Filter window. 8. Click in the drop-down menu next to the When field. Select either Always or select Specify Time. Always indicates that there is no time criteria to match 36 Citrix XenMobile Integration

41 User/Host Profiles this Profile. Specify Time allows you to choose days and times to be used as criteria for connecting hosts. Hosts must connect to the network during the selected times to match this profile. 9. To specify a time, select Specify Time in the drop-down to display the Specify Time dialog. In the Time Range section enter the From and To times for the time of day that devices should be able to access the network. In the Days of the Week section select the days during which these devices should be allowed to access the network. Click OK. 10. Click OK to save your data. Citrix XenMobile Integration 37

42 Network Access Policies Network Access Policies A Network Access Policy consists of one User/Host Profile and one Network Access Configuration. The User/Host Profile is used to determine the users and hosts to which this policy might apply. The Network Access Configuration assigns the treatment those users and hosts receive when they connect to the network. Figure 14: Network Access Policy Components The Network Access Configuration specifies the VLAN, CLI Configuration or VPN Group Policy that apply to a host that requires network access. If the user or host matches the selected User/Host Profile they are given the network access defined in the configuration. Network Access Policies follow a pattern, such as, when anyone in group X of people connects to a device in group Y of devices only put those users on VLAN 10. Devices that are end-stations, such as a gaming device, a printer or a medical device can be treated as if they were people. For example, if a gaming device that matches the specified User/Host Profile is connected to a switch that also matches the User/Host Profile it can be moved to a special VLAN for gaming devices defined in the Network Access Configuration. Network Access Policies are very flexible and can be used in more complex situations. For example, Network Access Policies can be created for medical devices that are end stations. When a medical device is connected to any port in the hospital, FortiNAC can use a Network Access Policy that contains a CLI configuration to reduce the rate of data transfer on those ports. Network Access Policies can also be used to pass a group policy to a user connecting through a VPN concentrator. When a user connects through a VPN you do not want to disconnect him in order to move him from one VLAN to another. However, when the user is authenticated and the authentication is returned to the VPN concentrator, FortiNAC can also send a group policy for that user. The policy can then restrict the user's network access to certain areas. Group policies are configured on the VPN 38 Citrix XenMobile Integration

43 Network Access Policies concentrator. When the name of the Group policy is entered into the Access Value/VLAN field on the Network Access Configuration window, that VPN group policy is then enforced for the connecting user. Policies are assigned based on matching data when a host requires network access. The host/user and the connection location are compared to each Network Access Policy starting with the first policy in the list. When a policy is found where the host and user data and the connection location match the selected User/Host Profile, that policy is assigned. Policy assignments are not permanent. Hosts are re-evaluated frequently, such as when a switch is polled or the Persistent Agent contacts the server. When host and user data are re-evaluated a different Network Access Policy may be selected. Note: There may be more than one Network Access Policy that is a match for this host/user, however, the first match found is the one that is used. Important: If you create a User/Host Profile with fields Where (Location) set to Any, Who/What by Group set to Any, Who/What by Attribute left blank and When set to always, it matches ALL users and hosts. This is essentially a Catch All profile. If this User/Host Profile is used in a policy, all policies below that policy are ignored when assigning a policy to a user or a host. To highlight this, policies below the policy with the catch all profile are grayed out and have a line through the data. The best way to use a Catch All profile is to create a general policy with that profile and place it last in the list of policies. Citrix XenMobile Integration 39

44 Network Access Policies Manage Network Access Policies Create Network Access Policies to assign a VLAN, implement a CLI Configuration or assign a VPN Group Policy when a host requires network access. Policies are selected for a connecting host by matching host and user data to the criteria defined in the associated User/Host Profile. The first policy that matches the host and user data is assigned. Note: If the host does not match any policy, it is assigned the default VLAN configured on the switch. Important: If you create a User/Host Profile with fields Where (Location) set to Any, Who/What by Group set to Any, Who/What by Attribute left blank and When set to always, it matches ALL users and hosts. This is essentially a Catch All profile. If this User/Host Profile is used in a policy, all policies below that policy are ignored when assigning a policy to a user or a host. To highlight this, policies below the policy with the catch all profile are grayed out and have a line through the data. The best way to use a Catch All profile is to create a general policy with that profile and place it last in the list of policies. Network Access Policies can be accessed from Policy > Policy Configuration > Network Access or from System > Quick Start > Policy Configuration, however configuration steps point you to Policy > Policy Configuration > Network Access. See Navigation and Filters for information on common navigation tools and data filters. Figure 15: Network Access Policies View 40 Citrix XenMobile Integration

45 Network Access Policies Network Access Policies Field Definitions An empty field in a column indicates that the option has not been set. Field Rank Buttons Set Rank Button Definition Moves the selected policy up or down in the list. Host connections are compared to Policies in order by rank. Allows you to type a different rank number for a selected policy and immediately move the policy to that position. In an environment with a large number of policies this process is faster than using the up and down Rank buttons. Table Columns Rank Name Network Access Configuration User/Host Profile Where (Location) Who/What by Group Who/What by Attribute When Note Last Modified By Last Modified Date Policy's rank in the list of policies. Rank controls the order in which host connections are compared to Policies. User defined name for the policy. Contains the configuration for the VLAN, CLI Configuration or VPN Group Policy that will be assigned if this Access Policy matches the connecting host. See Network Access Configurations on page 44. Contains the required criteria for a connecting host, such as connection location, host or user group membership, host or user attributes or time of day. Host connections that match the criteria within the User/Host Profile are assigned the associated Network Access Configuration. See User/Host Profiles on page 32. The connection location specified in the User/Host Profile. The host must connect to the network on a device, port or SSID contained within one of the groups shown here to be a match. When set to Any, this field is a match for all hosts or users. User or Host group or groups specified in the User/Host Profile. These groups must contain the connecting user or host for the connection to be a match for this policy. When set to Any, this field is a match for all hosts or users. User or Host attributes specified in the selected User/Host Profile. The connecting host or user must have the attributes to be a match. See User/Host Profile Filter Example. The time frame specified in the selected User/Host Profile. The host must be on the network within this time frame to be a match. When set to Always this field is a match for all hosts or users. User specified note field. This field may contain notes regarding the data conversion from a previous version of FortiNAC. User name of the last user to modify the policy. Date and time of the last modification to this policy. Right Mouse Click Menu Options Delete Modify Deletes the selected Network Access Policy. Opens the Modify Network Access Policy window for the selected policy. Buttons Citrix XenMobile Integration 41

46 Network Access Policies Field Export Definition Exports the data displayed to a file in the default downloads location. File types include CSV, Excel, PDF or RTF. See Export Data. 42 Citrix XenMobile Integration

47 Network Access Policies Add/Modify A Network Access Policy Figure 16: Add Network Access Policy 1. Select Policy > Policy Configuration. 2. In the menu on the left select Network Access. 3. Click the Add button or select an existing Policy and click Modify. 4. Click in the Name field and enter a name for this Policy. 5. Select a User/Host Profile from the drop-down menu. You can use the icons next to the User/Host Profile field to add a new profile or modify the profile shown in the drop-down menu. Note that if you modify this profile, it is modified for all features that make use of the profile. Connecting hosts must match this User/Host Profile to be assigned the Network Access Configuration specified in the next step. See Add/Modify A User Or Host Profile on page 35 for additional information. 6. Select a Network Access Configuration from the drop-down menu. You can use the icons next to the Network Access Configuration field to add a new configuration or modify the configuration shown in the drop-down menu. Note that if you modify this configuration, it is modified for all features that make use of it. See Add/Modify A Network Access Configuration on page The Note field is optional. 8. Click OK to save your Policy. Citrix XenMobile Integration 43

48 Network Access Configurations Network Access Configurations Network Access Configurations define access treatments for connecting hosts and users. Hosts can be placed in a particular VLAN, have a CLI configuration applied or be passed a VPN Group Policy. The Network Access Configuration that is assigned to a particular host is determined by the pairing of a Network Access Configuration and a User/Host Profile within a Network Access Policy. When a host requires network access, the host and user are compared to the User/Host Profile in each Network Access Policy starting with the first policy in the list. When a policy is found where the host and user data match the User/Host Profile in the policy, that policy is assigned. The Network Access Configuration contained within that policy specifies the treatment received by the host. See Navigation and Filters for information on common navigation tools and data filters. Figure 17: Network Access Configurations 44 Citrix XenMobile Integration