Astaro Security Gateway UTM

Size: px

Start display at page:

Download "Astaro Security Gateway UTM"

Arnold Dennis
6 years ago
Views:

2 Trademarks Deepnet Unified Authentication, MobileID, QuickID, PocketID, SafeID, GridID, FlashID, SmartID, TypeSense, VoiceSense, MobilePass, DevicePass, RemotePass and Site Stamp are trademarks of Deepnet Security Limited. All other brand names and product names are trademarks or registered trademarks of their respective owners. Copyrights Under the international copyright law, neither the Deepnet Security software or documentation may be copied, reproduced, translated or reduced to any electronic medium or machine readable form, in whole or in part, without the prior written consent of Deepnet Security. Licence Conditions Please read your licence agreement with Deepnet carefully and make sure you understand the exact terms of usage. In particular, for which projects, on which platforms and at which sites, you are allowed to use the product. You are not allowed to make any modifications to the product. If you feel the need for any modifications, please contact Deepnet Security. Disclaimer This document is provided as is without warranty of any kind, either expressed or implied, including, but not limited to, the implied warranties of merchantability, fitness for a particular purpose, or non-infringement. This document could include technical inaccuracies or typographical errors. Changes are periodically made to the information herein; these changes will be incorporated in new editions of the document. Deepnet Security may make improvements of and/or changes to the product described in this document at any time. Contact If you wish to obtain further information on this product or any other Deepnet Security products, you are always welcome to contact us. Deepnet Security Limited Northway House 1379 High Road London N20 9LP United Kingdom Tel: +44(0) Fax: +44(0) Web: support@deepnetsecurity.com Copyright 2013, Deepnet Security. All Rights Reserved. Page 2

3 Table of Contents Overview... 4 Preparation... 5 DualShield Configuration... 6 Create a RADIUS logon procedure... 6 Create a RADIUS application... 6 Register the as a Radius client... 7 Configuration... 9 Register DualShield Radius Server... 9 Enable Auto User creation for the RADIUS users Allow RADIUS users to access the End-User Portal Allow RADIUS users to use the SSL VPN client Allow RADIUS users to use the HTML5 VPN portal Authentication Static Password Test Logon...14 One-Time Password Test Logon...16 Two-Factor Authentication Test Logon...17 Copyright 2013, Deepnet Security. All Rights Reserved. Page 3

Overview This implementation guide describes how to integrate appliance with the DualShield unified authentication platform in order to add two-factor authentication into the IPSec VPN and SSL VPN

4 Overview This implementation guide describes how to integrate appliance with the DualShield unified authentication platform in order to add two-factor authentication into the IPSec VPN and SSL VPN login process. supports external RADIUS server as its authentication server. DualShield unified authentication platform includes a fully compliant RADIUS server DualShield Radius Server. DualShield provides a wide selection of portable onetime password tokens in a variety of form factors, ranging from hardware tokens, software tokens, mobile tokens to USB tokens. These include: Deepnet SafeID Deepnet MobileID Deepnet GridID Deepnet CryptoKey RSA SecurID VASCO DigiPass Go OATH-compliant OTP tokens In addition to the support of one-time password, DualShield also supports on-demand password for RADIUS authentication. The product that provides on-demand password in the DualShield platform is Deepnet T-Pass. Deepnet T-Pass is an on-demand, token-less strong authentication that delivers logon passwords via SMS texts, phone calls, twitter direct messages or messages. The complete solution consists of the following components: Appliance DualShield Radius Server DualShield Authentication Server VPN Client Web Browser Astaro Security Gateway UTM Internet Internal Network DualShield RADIUS Server DualShield Authentication Server Active Directory Copyright 2013, Deepnet Security. All Rights Reserved. Page 4

5 Preparation Prior to configuring for two-factor authentication, you must have the DualShield Authentication Server and DualShield Radius Server installed and operating. For the installation, configuration and administration of DualShield Authentication and Radius servers please refer to the following documents: DualShield Authentication Platform Installation Guide DualShield Authentication Platform Quick Start Guide DualShield Authentication Platform Administration Guide DualShield Radius Server - Installation Guide You also need to have a RADIUS application created in the DualShield authentication server. The application will be used for the two-factor authentication in Astaro Security Gateway UTM. The document below provides general instructions for RADIUS authentication with the DualShield Radius Server: VPN & RADIUS - Implementation Guide Following outlines the key steps: In DualShield 1. Create a logon procedure for RADIUS authentication 2. Create an RADIUS application for 3. Register the as a RADIUS client In 1. Register the DualShield RADIUS authentication server 2. Enable RADIUS users for Remote Access Copyright 2013, Deepnet Security. All Rights Reserved. Page 5

DualShield Configuration Create a RADIUS logon procedure 1. Login to the DualShield management console 2. In the main menu, select Authentication Logon Procedure 3.

6 DualShield Configuration Create a RADIUS logon procedure 1. Login to the DualShield management console 2. In the main menu, select Authentication Logon Procedure 3. Click the Create button on the toolbar 4. Enter Name and select RADIUS as the Type 5. Click Save 6. Click the Context Menu icon of the newly create logon procedure, select Logon Steps 7. In the popup windows, click the Create button on the toolbar 8. Select the Static Password as the authenticator 9. Click Save Create a RADIUS application 1. In the main menu, select Authentication Applications 2. Click the Create button on the toolbar Copyright 2013, Deepnet Security. All Rights Reserved. Page 6

3. Enter Name 4. Select Realm 5. Select the logon procedure that was just created 6.

Click the context menu of the newly created application, select Agent 8.

Click the context menu of the newly created application, select Self Test Register

7 3. Enter Name 4. Select Realm 5. Select the logon procedure that was just created 6. Click Save 7. Click the context menu of the newly created application, select Agent 8. Select the DualShield Radius server, e.g. Local Radius Server 9. Click Save 10. Click the context menu of the newly created application, select Self Test Register the as a Radius client 1. In the main menu, select RADIUS Clients 2. Click the Register button on the toolbar Copyright 2013, Deepnet Security. All Rights Reserved. Page 7

8 3. Select the application that was created in the previous steps 4. Enter s IP in the IP address 5. Enter the Shared Secret which will be used in. 6. Click Save Copyright 2013, Deepnet Security. All Rights Reserved. Page 8

9 Configuration It is assumed that the is setup and operational. An existing domain user can authenticate using a Domain AD password and access applications, your users can access through IPSec VPN and/or SSL VPN using Domain accounts. Register DualShield Radius Server 1. Log in to the WebAdmin interface of the ASG via 2. Select Definitions & Users Authentication Servers 3. Select Servers Tab 4. Click New Authentication Server button Choose Backend: Radius Click on the + sign next to Server and enter Name: DualShield Type: Host Address: Your DualShield Radius Server IP Address In the Pop-Up, click Save Copyright 2013, Deepnet Security. All Rights Reserved. Page 9

Enter the Shared secret Click Test server

Now, click Authenticate example user Copyright

Enable Auto User creation for the RADIUS users 1. Select Definitions & Users Authentication Servers 2. Select Global Settings Tab 3. Enable Create users automatically 4. Click Apply. 5.

11 Enable Auto User creation for the RADIUS users 1. Select Definitions & Users Authentication Servers 2. Select Global Settings Tab 3. Enable Create users automatically 4. Click Apply. 5. Choose End-User Portal and SSL VPN 6. Click Apply Allow RADIUS users to access the End-User Portal In order to get their SSL VPN client and configuration, users have to initially log in to the End User portal. Make sure that RADIUS authenticated users are allowed to log in. 1. Select Management User Portal 2. Add the Radius Users group to the list of allowed users. You can choose this group by clicking on the Folder icon and drag and drop it from the list on the left. Copyright 2013, Deepnet Security. All Rights Reserved. Page 11

12 Allow RADIUS users to use the SSL VPN client 1. Select Remote Access SSL 3. Add the Radius Users group to the list of allowed users. You can choose this group by clicking on the Folder icon and drag and drop it from the list on the left. Copyright 2013, Deepnet Security. All Rights Reserved. Page 12

13 Allow RADIUS users to use the HTML5 VPN portal 2. Select Remote Access HTML 5 VPN Portal 4. Add the Radius Users group to the list of allowed users. You can choose this group by clicking on the Folder icon and drag and drop it from the list on the left. Copyright 2013, Deepnet Security. All Rights Reserved. Page 13

14 Authentication DualShield provides the flexibility that allows you to control how your users should be authenticated. Users can be authenticated with the Static Password (AD Password) only, or One-Time Password only or both the Static Password and One-Time Password (Two- Factor Authentication). In DualShield, how the users are authenticated is controlled by the Logon Procedure. Static Password Let us start with the simple Static Password authentication. In the beginning, we created a logon procedure for Astaro UTM with one logon step that contains just Static Password, as below: Test Logon Access your user portal by navigating to: Copyright 2013, Deepnet Security. All Rights Reserved. Page 14

Enter your username and AD password One-Time Password Let us now change the logon procedure so that users will be required to authenticate with One-Time Password only.

15 Enter your username and AD password One-Time Password Let us now change the logon procedure so that users will be required to authenticate with One-Time Password only. In the DualShield Management Console, edit the logon procedure for your Astaro Security Gateway UTM application and change the authenticator to One-Time Password as below: Copyright 2013, Deepnet Security. All Rights Reserved. Page 15

16 Test Logon You need to assign an One-Time Password token to the test user. Access your user portal. In the Password field, enter a One-Time Password generated from the user s token. Two-Factor Authentication Now, let us enable two-factor authentication. We will change the logon procedure so that users will be required to authenticate with Static Password followed by One-Time Password, i.e. Static Password + One-Time Password In the DualShield Management Console, edit the logon procedure for your Astaro Security Gateway UTM application and change the authenticator to One-Time Password as below: Copyright 2013, Deepnet Security. All Rights Reserved. Page 16

17 Test Logon Access your user portal. In the Password field, enter the user s AD password followed by an One-Time Password generated from the user s token. Copyright 2013, Deepnet Security. All Rights Reserved. Page 17

Implementation Guide VMWare View 5.1. DualShield. for. VMWare View 5.1. Implementation Guide

Implementation Guide VMWare View 5.1. DualShield. for. VMWare View 5.1. Implementation Guide DualShield for VMWare View 5.1 Implementation Guide Copyright 2012 Deepnet Security Limited Copyright 2012, Deepnet Security. All Rights Reserved. Page 1 Trademarks Deepnet Unified Authentication, MobileID,