DualFence. Implementation Guide. Copyright 2013 Deepnet Security Limited. Copyright 2013, Deepnet Security. All Rights Reserved.

Size: px

Start display at page:

Anna Parks
5 years ago
Views:

2 Trademarks Deepnet Unified Authentication, MobileID, QuickID, PocketID, SafeID, GridID, FlashID, SmartID, TypeSense, VoiceSense, MobilePass, DevicePass, RemotePass and Site Stamp are trademarks of Deepnet Security Limited. All other brand names and product names are trademarks or registered trademarks of their respective owners. Copyrights Under the international copyright law, neither the Deepnet Security software or documentation may be copied, reproduced, translated or reduced to any electronic medium or machine readable form, in whole or in part, without the prior written consent of Deepnet Security. Licence Conditions Please read your licence agreement with Deepnet carefully and make sure you understand the exact terms of usage. In particular, for which projects, on which platforms and at which sites, you are allowed to use the product. You are not allowed to make any modifications to the product. If you feel the need for any modifications, please contact Deepnet Security. Disclaimer This document is provided as is without warranty of any kind, either expressed or implied, including, but not limited to, the implied warranties of merchantability, fitness for a particular purpose, or non-infringement. This document could include technical inaccuracies or typographical errors. Changes are periodically made to the information herein; these changes will be incorporated in new editions of the document. Deepnet Security may make improvements of and/or changes to the product described in this document at any time. Contact If you wish to obtain further information on this product or any other Deepnet Security products, you are always welcome to contact us. Deepnet Security Limited Comer Business Innovation Centres North London Business Park Oakleigh Road South London N11 1GN United Kingdom Tel: +44(0) Web: support@deepnetsecurity.com Copyright 2013, Deepnet Security. All Rights Reserved. Page 2

3 Table of Contents 1. Overview Preparation Configuration Interfaces DHCP IP Pools DHCP Group Options DualShield Configuration RADIUS Server Create Realms Create Logon Procedure Create Application Register Radius Client Server Create Guest Logon Procedure Create Guest Application Create Staff Logon Procedure Create Staff Application Create VLANs Register WIFI AP/AC as NAC Access Point Configure Server Configure NAC Policies Authentication Connect to Guest Network Connect to Staff Network Copyright 2013, Deepnet Security. All Rights Reserved. Page 3

4 1. Overview Deepnet is a Wireless Network Access Control (NAC) server empowered with multi-factor authentication. Working with the Deepnet DualShield authentication server, adds a layer of multi-factor authentication to the logon process of wireless devices connecting to the corporate networks, providing IT security managers an easy way to reduce BYOD risks. Deepnet verifies the identity of the connecting mobile devices as well as the identity of their users, provides real-time visibility of mobile devices connected to your network, controls the network access of those devices, and keep corporate networks safe from data loss and malicious threats. Once the identity of both the device and its user are successfully verified, through twofactor authentication, Deepnet automatically enforces access rights, roles, privileges and policies within the network. If you wish to ban all guests and unknown mobile devices from your network, Deepnet can do that. If you wish to allow guests and their wireless devices to access the Internet, Deepnet can do that too. This document describes how to configure server, DualShield Authentication Server and Wi-Fi AP/AC devices in order to implement multi-factor authentication in a corporate wireless network. The complete solution consists of the following components: Server DualShield Radius Server DualShield Authentication Server Wi-Fi Access Point 2. Preparation In order to install and configure Server, you must have the DualShield Authentication Server and DualShield Radius Server installed and operating. For the installation, configuration and administration of DualShield Authentication Server and Radius Server please refer to the following documents: DualShield Authentication Platform Installation Guide DualShield Authentication Platform Quick Start Guide DualShield Authentication Platform Administration Guide DualShield Radius Server - Installation Guide Meanwhile, we need to setup the network VLAN 1 is the management VLAN VLAN 2 is the registration VLAN for guest (unregistered guest devices will be put in this VLAN) VLAN 3 is the registration VLAN for staff (unregistered staff devices will be put in this VLAN) VLAN 4 is the staff VLAN VLAN 5 is the guest VLAN Copyright 2013, Deepnet Security. All Rights Reserved. Page 4

Please refer to the following table for IP and Subnet information: VLAN ID VLAN Name SSID IP subnet 1 Management DHCP 2 GuestRegisterVLAN DeepnetOpen 192.168.2.0/24 3 StaffRegisterVLAN DeepnetSecure 192.

5 Please refer to the following table for IP and Subnet information: VLAN ID VLAN Name SSID IP subnet 1 Management DHCP 2 GuestRegisterVLAN DeepnetOpen /24 3 StaffRegisterVLAN DeepnetSecure /24 4 StaffVLAN DeepnetSecure /24 5 GuestVLAN DeepnetOpen /24 Also we need to configure the following components: DualShield Wi-Fi AP 3. Configuration Firstly, let us launch the browser and navigate to the Console: e.g. We will need to configure the following data: System interfaces IP Pools 3.1 Interfaces provides the following three different interfaces: Management Interface that with works with the DualShield Authentication Server, manages traffic with AP/AC, such as de-authentication, RADIUS messages, etc. VLAN Interface that provides the interface for the guest and staff VLAN, and the VLAN for DHCP Listener DHCP Listener that captures the DHCP traffic. Copyright 2013, Deepnet Security. All Rights Reserved. Page 5

By default, Server has created the following 4 VLANS: eth0.1, the management interface eth0.2, VLAN 2 interface, guest register VLAN eth0.3, VLAN 3 interface, staff register VLAN eth0.

6 By default, Server has created the following 4 VLANS: eth0.1, the management interface eth0.2, VLAN 2 interface, guest register VLAN eth0.3, VLAN 3 interface, staff register VLAN eth0.4, VLAN 4 interface, staff VLAN eth0.5, VLAN 5 interface, guest VLAN 3.2 DHCP IP Pools 3.3 DHCP Group Options 4. DualShield Configuration In order to provide the Network Access Control (NAC) service in the DualShield authentication server, we need to configure the following components: Radius Server Server 4.1 RADIUS Server Create Realms In order to run the service, we need to create the following three different realms: Staff Realm where the staff identity information will be stored. Guest Realm where the guest identity information will be stored. You may create an internal identity source in DualShield for storing the guest accounts. Radius Realm which normally includes the same domain as that in the Staff Realm. Please refer to the following document to create staff and guest realms: DualShield Authentication Platform Administration Guide Copyright 2013, Deepnet Security. All Rights Reserved. Page 6

4.1.2 Create Logon Procedure Select Authentication Logon Procedure and click the Create button on the toolbar: Enter the Name, Description and select RADIUS

Click the Create button on the toolbar and then select the Static Password, MAC address and IEEE 802.1x as the authenticators.

7 4.1.2 Create Logon Procedure Select Authentication Logon Procedure and click the Create button on the toolbar: Enter the Name, Description and select RADIUS from the Type list. Click Save to create the logon procedure. Click the context menu icon of the newly created logon procedure and select Logon Steps. Click the Create button on the toolbar and then select the Static Password, MAC address and IEEE 802.1x as the authenticators. Note: The RADIUS logon supports only the above authenticators Create Application Select Authentication Application Create Copyright 2013, Deepnet Security. All Rights Reserved. Page 7

Use the Self-Test function to verify that application is ready. 4.1.

8 Enter the Name, select the realm and logon procedure that the application is linked to. Click on the context menu of the newly created application, select Agent and assign it to the RADIUS agent. Use the Self-Test function to verify that application is ready Register Radius Client You need to register your AP/AC as a RADIUS client. Select Radius Radius Client in the main menu, click Register button in the tool bar. Copyright 2013, Deepnet Security. All Rights Reserved. Page 8

Enter the Name, select the Radius server and assign it to the Radius application which was created in the previous step. Enter the IP Address of your Wi-Fi AP/AC device and shared secret key. 4.

9 Enter the Name, select the Radius server and assign it to the Radius application which was created in the previous step. Enter the IP Address of your Wi-Fi AP/AC device and shared secret key. 4.2 Server We need to configure the following components for the server: Guest logon procedure and application Staff logon procedure and applications VLANs configuration Register WIFI AP/AC radius client as a NAC access point Configure Server Configure NAC policies Create Guest Logon Procedure Select Authentication Logon Procedure and click the Create button on the toolbar: Enter the Name, Description and select Guest from the Type list. Click Save to create the logon procedure. Click the context menu icon of the newly create logon procedure and select Logon Steps. Click the Create button on the toolbar and select the authenticator Static Password. Copyright 2013, Deepnet Security. All Rights Reserved. Page 9

10 4.2.2 Create Guest Application Select Authentication Application Create : Enter the Name, select the realm and logon procedure that the application is linked to. Click on the context menu of the newly created application, select Agent and assign it to the agent. Use the Self-Test function to verify that application is ready. Copyright 2013, Deepnet Security. All Rights Reserved. Page 10

4.2.3 Create Staff Logon Procedure Select Authentication Logon Procedure and click the Create button on the toolbar: Enter the Name, Description and select Staff from the Type list.

11 4.2.3 Create Staff Logon Procedure Select Authentication Logon Procedure and click the Create button on the toolbar: Enter the Name, Description and select Staff from the Type list. Click Save to create the logon procedure. Click the context menu icon of the newly create logon procedure and select Logon Steps. Click the Create button on the toolbar and select the methods that you would like to authenticate your users. Note: You can set multiple steps in the Staff logon procedure Create Staff Application Select Authentication Application Create : Copyright 2013, Deepnet Security. All Rights Reserved. Page 11

Once you have completed the above configuration, you can find that Agent links to two applications: QA Staff & QA Guest, and DualShield Radius Agent links to

12 Enter the Name, select the realm and logon procedure that the application is linked to. Click on the context menu of the newly created application, select Agent and assign it to the agent. Use the Self-Test function to verify that application is ready. Once you have completed the above configuration, you can find that Agent links to two applications: QA Staff & QA Guest, and DualShield Radius Agent links to Radius application. See the following screen shots: Create VLANs Create Guest Register VLAN To create VLAN, select NAC VLANs, click the Create button on the toolbar: Copyright 2013, Deepnet Security. All Rights Reserved. Page 12

Enter the Name, Identifier and Detect Url. Note: The identifier has to be the same as VLAN s interface. 4.2.5.

13 Enter the Name, Identifier and Detect Url. Note: The identifier has to be the same as VLAN s interface Create Staff Register VLAN Select NAC VLANs, click the Create button on the toolbar: Enter the Name, Identifier and Detect Url Create Staff VLAN Select NAC VLANs click the Create button on the toolbar: Copyright 2013, Deepnet Security. All Rights Reserved. Page 13

Enter the Name, Identifier and Detect Url. 4.2.5.4 Create Guest VLAN Select NAC VLANs, click the Create button on the toolbar: Enter the Name, Identifier and Detect Url. 4.2.6 Register WIFI AP/AC as NAC Access Point 1.

14 Enter the Name, Identifier and Detect Url Create Guest VLAN Select NAC VLANs, click the Create button on the toolbar: Enter the Name, Identifier and Detect Url Register WIFI AP/AC as NAC Access Point 1. To register the WIFI AP/AC as NAC Access Point, select NAC Access Points, click Create button on the tool bar: 2. Enter Name for Access Point device. 3. Check Enable option. 4. Select the Vendor from the drop down list, e.g. cisco-ap Select the Deauth Methods from the list, e.g. webservice, update the deauthentication method parameters: Copyright 2013, Deepnet Security. All Rights Reserved. Page 14

Click Save. 10. Assign the VLANs to the Access Points, select the newly create Access Points, e.g. Cisco Access Point, right click VLANs.

15 (Note: Enter the username and password for Wi-Fi AC/AP device) 6. Select MAC Address Format, for cisco-ap1200, the MAC format is AABB.CCDD.EEFF. 7. Select the Radius Client which was registered before, e.g. Cisco Access Point. 8. Select the Server, e.g. -Demo. 9. Click Save. 10. Assign the VLANs to the Access Points, select the newly create Access Points, e.g. Cisco Access Point, right click VLANs Configure Server 1. Select NAC Server from main menu and Click Edit. Copyright 2013, Deepnet Security. All Rights Reserved. Page 15

Select NAC Servers, click the Server context menu and select the Access Points, select the Access Point that you want to use. 4.2.

16 2. Enter the Url. 3. By default, management port for is 8077, you are able to change the port. 4. Enter the DualShield Authentication Server SSO Logon Url, e.g Select captive portal SSL certificate. 6. Click Save 7. Select NAC Servers, click the Server context menu and select the Access Points, select the Access Point that you want to use Configure NAC Policies 1. Select NAC Policy from the main menu, click the Access Points from context menu and then bind to the Access Points, e.g. Cisco Access point Copyright 2013, Deepnet Security. All Rights Reserved. Page 16

17 2. Select the Servers from the context menu and bind to the Servers, e.g. -Demo 5. Authentication 5.1 Connect to Guest Network 1. Turn on the device Wi-Fi and choose the guest network, e.g. DeepnetOpen Copyright 2013, Deepnet Security. All Rights Reserved. Page 17

2. Check the device status on the DualShield

Launch the browser and enter the url (e.g. www.google.

registration is completed, you should be able to use

After login successfully, the device status will be

18 2. Check the device status on the DualShield Management Console, select NAC Device Management 3. Launch the browser and enter the url (e.g. it will redirect to the Guest Logon page, once registration is completed, you should be able to use the newly create account to login. 4. After login successfully, the device status will be changed to Authenticated. Copyright 2013, Deepnet Security. All Rights Reserved. Page 18

Check the device status on DualShield Management

19 5.2 Connect to Staff Network 1. Connect to the staff network, e.g. DeepnetSecure, enter the AD username & password, and accept the Certificate. 2. Check the device status on DualShield Management Console 3. Enter the login credential: Copyright 2013, Deepnet Security. All Rights Reserved. Page 19

DualShield Windows Logon Agent Installation Guide (Version 5.7)

DualShield Windows Logon Agent Installation Guide (Version 5.7) DualShield Installation Guide (Version 5.7) Copyright 2013 Deepnet Security Limited Copyright 2013, Deepnet Security. All Rights Reserved. Page 1 Trademarks Deepnet Unified Authentication, MobileID, QuickID,