SecureW2 and Wi-Fi Cloud. Integration Guide

SecureW2 and Wi-Fi Cloud Integration Guide

SecureW2 and Wi-Fi Cloud Integration Guide Deployment Overview This guide demonstrates how to integrate a WatchGuard Wi-Fi Cloud Captive Portal with SecureW2 authentication for users to authenticate, and receive certificates, for WPA2 Enterprise EAP-TLS Wi-Fi access, and an HTTPS proxy certificate deployed for HTTPS content inspection on a WatchGuard Firebox. WPA2 Enterprise EAP-TLS wireless communication is secured by a certificate pair that requires no password, and the client certificate is unique to the client. Integration Summary These tools are used to secure wireless communication and HTTPS Proxy traffic: SecureW2: o SecureW2 JoinNow MultiOS Management Portal WatchGuard: o o o WatchGuard AP420 WatchGuard Wi-Fi Cloud Account WatchGuard Firebox Microsoft Server 2016 o Active Directory o Certificate Services Test Topology SecureW2 JoinNow MultiOS Management Portal interacts with the WatchGuard AP420 through policies to push certificates to end users. SecureW2 and Wi-Fi Cloud Integration Guide 1

SecureW2 Network Profile, Redirect URL, and RADIUS Use the Device Onboarding section in the SecureW2 console to acquire the RADIUS information and portal redirect URL. 1. Open the SecureW2 JoinNow MultiOS Management Portal and select Device Onboarding > Getting started. 2. In the Quickstart Network Profile Generator section, from the Profile Type drop-down list, select Wireless. 3. From the Profile Type drop-down list, select Wireless. 4. In the SSID text box, type the SSID for the network to be secured by TLS. 5. From the Security Type drop-down list, select WPA2-Enterprise. 6. From the EAP Method drop-down list, select EAP-TLS. 7. From the Policy drop-down list, select Default. 8. Click Create. The Network Profiles page appears. 9. In the Functions column, click View, and copy the URL. This is the Redirect Portal URL for deployment in WatchGuard Wi-Fi Cloud. 10. Return to the SecureW2 JoinNow MultiOS Management Portal and select AAA Management > AAA configuration. 11. Note the RADIUS Port, Primary and Secondary IP Address, and the Shared Secret. WatchGuard Wi-Fi Cloud Basic Configuration This integration guide covers only the basic configuration of the WatchGuard Wi-Fi Cloud AP. To complete the configuration of your AP, you must: Upgrade your AP device software Add the AP device to a location in your organization tree Create SSID profiles for your AP device Create a device template to apply common device, radio, and SSID settings to your AP device Create and apply an authorized WLAN security policy for your SSID 2 WatchGuard Technologies, Inc.

Configure WatchGuard Wi-Fi Cloud with the SecureW2 RADIUS Information for EAP-TLS 1. Log in to your WatchGuard account. 2. Select My WatchGuard > Managed Wi-Fi Cloud > Manage. 3. Select Configuration > Device Configuration > RADIUS Profiles. 4. On the RADIUS Profiles tab, click Add RADIUS Profile. 5. In the Profile Name text box, type a friendly description for the profile. 6. In the IP Address text box, type the Primary IP address of the RADIUS server from SecureW2. This IP address requires outbound access in your firewall rules. This is open in the default outgoing policy. 7. In the Authentication Port text box, type the port number listed for the RADIUS server from SecureW2. This port requires outbound access in your firewall rules. This is open in the default outgoing policy. 8. Leave the Accounting Port, in the default setting. 9. In the Shared secret text box, type the shared secret from the SecureW2 RADIUS server. 10. Click Save. 11. Repeat these steps for the second SecureW2 RADIUS server. SecureW2 and Wi-Fi Cloud Integration Guide 3

Configure WatchGuard Wi-Fi Cloud with the SSID Profile for EAP-TLS 1. In WatchGuard Wi-Fi Cloud, open Manage. 2. Select Configuration > Device Configuration > SSID Profiles. 3. Select Add New Wi-Fi Profile. 4. Type the Profile Name and SSID name for secure EAP-TLS client connections. 5. Expand the Security section, from the Security Mode drop-down list select WPA2 and select 802.1X. 6. From the RADIUS Authentication drop-down list, select the two configured RADIUS servers. 7. Expand the Network section and set the VLAN IDto 30. You will use this VLAN ID n your firewall configuration. 8. Click Save. 4 WatchGuard Technologies, Inc.

Configure WatchGaurd Wi-Fi Cloud with the SSID Profile for Splash Page Redirection 1. In WatchGuard Wi-Fi Cloud, open Manage. 2. Select Configuration > Device Configuration > SSID Profiles. 3. Select Add New Wi-Fi Profile. 4. Type the Profile Name and SSID name for client connections. 5. Expand the Security section and verify the Security Mode is set to Open. 6. Expand the Network section and set the VLAN ID to 20. This VLAN ID is used in your firewall configuration. 7. Expand the Captive Portal section and select Enable Captive Portal. 8. Select External Splash Page for Sign-in/Click-through. 9. In the Splash Page URL text box, type the View URL from the SecureW2 configuration. SecureW2 and Wi-Fi Cloud Integration Guide 5

10. To configure the Walled Garden Sites, click Add and add these four SecureW2 URLs: cloud.securew2.com, service.securew2.com, pki-services.securew2.com auth.securew2.com. 11. Click OK when finished. 6 WatchGuard Technologies, Inc.

12. Add other Walled Garden Sites as required by your operating systems to provide access to their respective App Store or prevent certificate issues. Operating System Mac Windows Walled Garden Sites *.akamaiedge.net *.akamaitechnologies.com *.apple.com *.apple.com.edgekey.net apple.com captive.apple.com gsp1.apple.com urs.microsoft.com urs.smartscreen.microsoft.com airport.us appleiphonecell.com ibook.info itools.info thinkdifferent.us apple.com/library/test/success.html Android *.play.google.com *.store.google.com android.clients.google.com lh3.googleusercontent.com lh6.ggpht.com lh5.ggpht.com lh4.ggpht.com lh6.googleusercontent.com lh3.ggpht.com googleapis.com google-analytics.com cache.google.com 172.217.0.0/16 216.58.192.0/19 74.125.0.0/16 Kindle 54.224.0.0/12 72.21.192.0/19 176.32.96.0-176.32.103.255 207.171.160.0/19 SecureW2 and Wi-Fi Cloud Integration Guide 7

13. Expand Captive Portal, and on the right, in the Redirect URLtext field, type the URL to which to send users after they access the portal. 14. Click Save. 8 WatchGuard Technologies, Inc.

Configure the WatchGuard Firebox for SecureW2 Access to Active Directory SecureW2 connects to Active Directory at the public IP address 52.41.166.6. This connection uses port 636 for secure access. Active Directory and Certificate Services are required on Windows Server 2016. 1. Log in to your WatchGuard Firebox. 2. From Fireware Web UI, select Firewall > SNAT > Add. 3. Type a Name and Description for the SNAT. 4. Under SNAT Members, click Add. 5. From the External/Optional IP Address drop-down list, select Any-External, External, or an IP address that is public facing. 6. Set the Internal IP Address to the private address of the Active Directory server. 7. Click OK and Save. 8. Select Firewall > Firewall Policies > Add Policy. 9. Select Custom. Click Add. SecureW2 and Wi-Fi Cloud Integration Guide 9

10. Type a Name, Description, and add TCP port 636. 11. Click Save. 12. You are redirected to the Select a policy type page with your new custom policy selected in the drop-down list. Click Add Policy to continue with the policy creation. 13. In the From field, remove Any-Trusted. Click Add. 14. From the Member type drop-down list, select Host IPv4. 15. Type the SecureW2 public IP address of 52.41.166.6. Click OK. 16. In the To field, remove Any-External. Click Add. 17. From the Member type drop-down list, select Static NAT. 18. Select the SNAT you created in an earlier step. Click OK. 10 WatchGuard Technologies, Inc.

19. Confirm the configuration. Click Save. SecureW2 and Wi-Fi Cloud Integration Guide 11

Configure the WatchGuard Firebox with the Access Point VLANs 1. Log in to your WatchGuard Firebox. 2. From Fireware Web UI, select Network > Interfaces. 3. Select the interface, click Edit. 4. Type an Interface Name (Alias) and Interface Description. 5. From the Interface Type drop-down list, select VLAN. 6. Click Save. 7. Select Network > VLAN. 8. Click Add. 9. Type a Name, Description, VLAN ID, Security Zone, and an IP Address for the interface. 12 WatchGuard Technologies, Inc.

10. Select the desired VLAN interface and from the Select Traffic drop-down list, select Untagged Traffic. This configuration employs a direct connection to the firewall for the access point. Untagged VLAN management for the access point can also be deployed on a switch. 11. Click Save. 12. Select Network > VLAN. 13. Click Add. 14. Use VLAN ID 10 and type the configuration for the On-Boarding VLAN. 15. Set the VLAN tagging to Tagged Traffic. SecureW2 and Wi-Fi Cloud Integration Guide 13

16. Click Save. 17. Repeat the procedure for tagged traffic on a EAP-TLS VLAN. 18. The final VLAN configuration should appear as shown here: 14 WatchGuard Technologies, Inc.

Configure the WatchGuard Firebox Policies for Access Point VLANs 1. Log in to your WatchGuard Firebox. 2. From Fireware Web UI, select Firewall > Firewall Policies. 3. Click Add Policy. 4. Select Packet Filter and from the drop-down, select the Any. 5. Click Add Policy. 6. In the From field, remove the Any-Trusted alias. 7. In the From field, click Add. SecureW2 and Wi-Fi Cloud Integration Guide 15

8. Select the AP Management VLAN. Click OK. 9. Repeat the steps to add the On-Boarding VLAN. 10. Change the Name of the policy. Click Save. 11. Select Firewall > Firewall Policies. Click Add Policy. 12. Select Proxies. From the drop-down list select HTTPS-Proxy. 13. From the --Select a Proxy action -- drop-down list, select HTTPS-Client Standard. 14. Click Add Policy. 15. Type a new Name for the HTTPS-Proxy policy. 16. In the From field, remove the Any-Trusted alias. 17. In the From field, click Add. 18. In the Add Member page, from the Member type drop-down list, select Alias. 19. From the list, select the interface alias. Click OK. 16 WatchGuard Technologies, Inc.

20. Select the Proxy Action tab. 21. From the Proxy Action drop-down list, select Clone the current proxy action. 22. In the Content Inspection Summary, click Edit. 23. Select the option for Enable Content Inspection. SecureW2 and Wi-Fi Cloud Integration Guide 17

24. Click OK. 25. Click Save to save the policy. 18 WatchGuard Technologies, Inc.

Retrieve the HTTPS-Proxy Certificate from the WatchGuard Firebox For more detailed information about content inspection for the HTTPS Proxy, see HTTPS-Proxy: Content Inspection. 1. Log in to your WatchGuard Firebox. 2. From Fireware Web UI, select System > Certificates. 3. Highlight the Proxy Authority certificate from the list. Click Export. 4. Browse to the location where you want save the certificate. Click Save. SecureW2 and Wi-Fi Cloud Integration Guide 19

Retrieve the Certificate for Active Directory Communication 1. From Windows 2016 Server, open the Certificate Authority application. Or, right-click Start > Run. Type certsrv.msc in the dialog box. Click OK. 2. Right-click the domain in the Certificate Authority (Local) section and select Properties. 20 WatchGuard Technologies, Inc.

3. Click View Certificate. 4. Select the Details tab. 5. Click Copy to File... 6. The Certificate Export Wizard appears. Click Next. SecureW2 and Wi-Fi Cloud Integration Guide 21

7. Select DER encoded binary X.509 (.CER). Click Next. 22 WatchGuard Technologies, Inc.

8. Provide a File name, browse to a location, and click Save. 9. Click Next. 10. Click Finish. SecureW2 and Wi-Fi Cloud Integration Guide 23

Create a Wi-Fi Authentication Group in Active Directory A Security Group is created in the Active Directory to attach the user to SecureW2 Authentication Policies, User Role Policies, and Enrollment Policies. 1. From Windows Server 2016, open Server Manager. 2. Select Tools > Active Directory Users and Computers. 3. Right-click the domain and select New > Group. 4. In the Group nametext box, type the name of the security group associated with users. 5. In the Group name (pre-windows 2000)text box, type the same name if it is not already pre-populated. 6. In the Group scopesection, select Global. 7. In the Group type section, select Security. 8. Click OK. 9. Double-click the name of the new security group created. 10. Select the Members tab. 11. Click Add. 12. Type the full name of each user. Select Check Names to verify and click OK to submit. 24 WatchGuard Technologies, Inc.

13. Click OK. SecureW2 and Wi-Fi Cloud Integration Guide 25

Configure SecureW2 for Active Directory Queries Communication to Active Directory is encrypted with the certificate retrieved from the server on port 636 through the restrictive policy created on the WatchGuard Firebox. 1. From the SecureW2 Management Portal, select Identity Management > Identity Providers. 2. Click Add Identity Provider. 3. Type a Name and Description. 4. From the Type drop-down list, select LDAP. 5. Click Save. 6. In the Subject Name Attribute text box: samaccountname is used if you deploy a simple user name login. userprincipalname is used for the format username@example.com. 7. In the Group Map Attribute text box, type memberof. 6. Select the Connections tab. 7. Click Add Connection. 26 WatchGuard Technologies, Inc.

8. Type the connection information for your Active Directory connection. 9. In the Name text box, type the name of the IDP connection. 10. In the Descriptiontext box, describe the IDP connection. 11. In the Hostname text box type the hostname that resilves to a public IP Address. This must match the configured name of the server and the issuer listed in the certificate. 12. In the Port text box, set to port number to 389, if the connection is unsecured. If the connection is secured with the certificate, set the port number to 636. Select the use TLS/SSL check box to change the value to 636. 13. To add a Certificate, click Choose File and upload the self-signed certificate you obtained for use in LDAP communication over SSL. 14. Select Anonymous/Admin to specify whether the connection type is anonymous or Administrator. For the anonymous connection, no information is retrieved from Active Directory while testing the connection. 15. Or select Admin DN. This parameter is enabled only if you have selected the connection type as admin. Use the distinguished name format. For example: CN=Administrator, CN=users, DC=example, DC=com. 16. In the Admin Password text box, type the password of the administrator. This is enabled only if you have select the Admin connection type. 17. To retrieve and select a Subject Base DN from the Active Directory, click Naming Context. 18. To retrieve and select a Group Base DN from the Active Directory, click Naming Context. 19. Set the Server Timeout in seconds for the Active Directory query to timeout. 20. To confirm the Active Directory settings, click Test Connection. SecureW2 and Wi-Fi Cloud Integration Guide 27

21. Click OK. Click Update to return to the Identity Provider settings. 28 WatchGuard Technologies, Inc.

Configure the SecureW2 Network Profile for the HTTPS Proxy Decryption Certificate 1. From the SecureW2 JoinNow MultiOS Management Portal, select Device Onboarding > Network Profiles. 2. Click Edit for the new profile. The existing certificate is for encryption of wireless client traffic through EAP-TLS. 3. Click Add/Remove Certificate. SecureW2 and Wi-Fi Cloud Integration Guide 29

4. Click Choose File and browse to the location of the HTTPS Proxy Certificate. 5. Select the certificate file. Click Open. 6. Clear any check marks present in the Install column. 7. Click Upload. Click OK to confirm. 8. Click Cancel. Re-open the Add/Remove Certificate page. 9. Leave the Install check mark selected on the EAP-TLS certificate and find the uploaded HTTPS Proxy Certificate. 10. Select the check mark for Installfor the private HTTPS Proxy Certificate. 11. Click Update. The Certificates section should now contain both the ESP-TLS Certificate and the HTTPS Proxy Certificate. 12. Return to the Device Onboarding > Network Profiles page. 13. In the configured Network Profile, click Publish/Re-publish. 14. Repeat the Publish/Re-publish action for the new Network Profile Group. 30 WatchGuard Technologies, Inc.

Configure the SecureW2 Authentication Policy The SecureW2 Authentication Policy defines the protocols that the JoinNow MultiOS uses to communicate with the devices and assigns the Identity Provider. 1. From the SecureW2 JoinNow MultiOS Management Portal, select Policy Management > Authentication. 2. Click Edit on the auto-created Authentication Policy. 3. Select the Settings tab. 4. From the Identity Provider drop-down list, select the Identity Provider you created. 5. Click Update. Configure the SecureW2 User Role Policy 1. From the SecureW2 JoinNow MultiOS Management Portal select Policy Management > User Roles. 2. Click Edit on the Default Role Policy. 3. Select the Conditions tab. 4. From the Identity Provider drop-down list, select the configured provider. 5. Click Update. SecureW2 and Wi-Fi Cloud Integration Guide 31

Configure the SecureW2 Enrollment Policy 1. From the SecureW2 JoinNow MultiOS Management Portal, select Policy Management > Enrollment. 2. Select Edit on the Default Enrollment Policy. 3. On the Conditions tab, from the User Role and Device Role drop-down list, select the default policies. 4. Click Update. Test a Wireless Client 1. Connect to the On-Boarding Wi-Fi SSID. 2. The client will be redirected to the JoinNow configured view URL. 32 WatchGuard Technologies, Inc.

3. Click JoinNow. 4. From the download dialog box, click Run. 5. Type the Username and Password. Click Next. The user is automatically redirected to the EAP-TLS wireless connection. SecureW2 and Wi-Fi Cloud Integration Guide 33

About This Guide Guide Type Documented Integration WatchGuard or a Technology Partner has provided documentation demonstrating integration. Guide Details WatchGuard provides integration instructions to help our customers configure WatchGuard products to work with products created by other organizations. If you need more information or technical support about how to configure a third-party product, see the documentation and support resources for that product. Information in this guide is subject to change without notice. Companies, names, and data used in examples herein are fictitious unless otherwise noted. No part of this guide may be reproduced or transmitted in any form or by any means, electronic or mechanical, for any purpose, without the express written permission of WatchGuard Technologies, Inc. Guide revised: 3/5/2018 Copyright, Trademark, and Patent Information Copyright 1998 2018 WatchGuard Technologies, Inc. All rights reserved. All trademarks or trade names mentioned herein, if any, are the property of their respective owners. Complete copyright, trademark, patent, and licensing information can be found in the Copyright and Licensing Guide, available online at http://www.watchguard.com/wgrd-help/documentation/overview. About WatchGuard WatchGuard Technologies, Inc. is a global leader in network security, providing best-in-class Unified Threat Management, Next Generation Firewall, secure Wi-Fi, and network intelligence products and services to more than 75,000 customers worldwide. The company s mission is to make enterprisegrade security accessible to companies of all types and sizes through simplicity, making WatchGuard an ideal solution for Distributed Enterprises and SMBs. WatchGuard is headquartered in Seattle, Washington, with offices throughout North America, Europe, Asia Pacific, and Latin America. To learn more, visit WatchGuard.com. For additional information, promotions and updates, follow WatchGuard on Twitter, @WatchGuard on Facebook, or on the LinkedIn Company page. Also, visit our InfoSec blog, Secplicity, for real-time information about the latest threats and how to cope with them at www.secplicity.org. Address 505 Fifth Avenue South Suite 500 Seattle, WA 98104 Support www.watchguard.com/support U.S. and Canada +877.232.3531 All Other Countries +1.206.521.3575 Sales U.S. and Canada +1.800.734.9905 All Other Countries +1.206.613.0895 SecureW2 and Wi-Fi Cloud Integration Guide 34