DIGIPASS Authentication for WatchGuard Firebox With Vasco VACMAN Middleware 3.0 DIGIPASS Authentication for WatchGuard Firebox - Integration Guideline V1.0 © 2007Integration VASCO Data Security. All rights reserved.
Disclaimer Disclaimer of Warranties and Limitations of Liabilities This Report is provided on an 'as is' basis, without any other warranties, or conditions. No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, electronic, mechanical, photocopying, recording, or otherwise, without the prior written permission of VASCO Data Security. Trademarks DIGIPASS & VACMAN are registered trademarks of VASCO Data Security.
Table of Contents DIGIPASS Authentication for WatchGuard Firebox ......................................... 1 Disclaimer ...................................................................................................... 2 Table of Contents............................................................................................ 3 1 Overview ................................................................................................... 5 2 Problem Description......................................
9 8.2.2 Import DIGIPASS ........................................................................... 41 8.2.3 DIGIPASS assignment .................................................................... 43 Firebox Authentication Test .................................................................... 45 9.1 Response Only .................................................................................. 46 9.2 Challenge/Response ..........................................................................
1 Overview The purpose of this document is to demonstrate how to configure VACMAN Middleware (VM) to work with the WatchGuard Firebox. The Firebox will be deployed as the companies firewall in the DMZ zone, connecting and protecting different internal networks. 2 Problem Description The basic working of the Firebox is based on authentication to an existing media (LDAP, Radius, local authentication …). To use the VACMAN Middleware with the Firebox, its RADIUS settings need to be changed or added manually.
4 Technical Concept 4.1 General overview The main goal of the WatchGuard Firebox is to perform authentication to secure all kind of firewall connections. As the WatchGuard Firebox can do authentication to an external service with RADIUS, we will place the VACMAN Middleware as middleware or as back-end service, to secure the authentication with our proven VACMAN Middleware software.
5 WatchGuard Firebox 5.1 WatchGuard Firebox configuration To change the settings on the Firebox you need to connect to the Firebox through the WatchGuard System Manager. Click on the Connect to device button. Figure 2: WatchGuard Firebox configuration (1) Enter the hostname or IP address of the WatchGuard Firebox and the read/status passphrase of the device. Click Login to continue.
Once connected, you can view the status of the Firebox. Click on the Policy Manager button to view the policy details. Figure 4: WatchGuard Firebox configuration (3) The following screen (Figure 5) shows you an overview of the policies already present in the firebox. A more detailed view is available by right clicking the window and selecting Detailed View. Figure 5: WatchGuard Firebox configuration (4) DIGIPASS Authentication for WatchGuard Firebox - Integration Guideline V1.
This way you get a better insight of all the rules present in the Firebox. To view the network settings, you can open Network – Configuration … Figure 6: WatchGuard Firebox configuration (5) Make sure all network elements are configured correctly as the rules rely on the names you gave your network elements. Figure 7: WatchGuard Firebox configuration (6) DIGIPASS Authentication for WatchGuard Firebox - Integration Guideline V1.0 © 2007 VASCO Data Security. All rights reserved.
5.2 Authentication Servers Click on the Authentication servers button to open the authentication options. Here we will be able to add the RADIUS server details. Figure 8: Authentication Servers (1) Go to the RADIUS tab and fill in the details of the VACMAN Middleware server. IP address, Port (default 1812), (shared) secret and confirmation. The timeout and Retry fields are optional. The Group Attribute must contain value 11. This will be the field that receives information about the group name by IAS.
5.3 Authentication Policy To authenticate on the Firebox, it is necessary you are allowed to see the authentication page. Find the rule WatchGuard Authentication. Check if the permissions are: FROM: Any TO: Firebox PORT: tcp:4100. If they do not match, please follow the steps below to change them. Right-click the WatchGuard Authentication rule and select Modify Policy… .
In the From: field add Any and in the To: field add Firebox. Click OK to complete. Figure 12: Authentication Policy (3) 5.4 Website Proxy Policy The actual event we want secure, is when a user requests a website that may not be visited by other people then your own employees. So we will create a rule for this. Click the Add Policies button. Figure 13: Website Proxy Policy (1) DIGIPASS Authentication for WatchGuard Firebox - Integration Guideline V1.0 © 2007 VASCO Data Security. All rights reserved.
Select HTTP-proxy under the proxies folder and click Add… to continue. Figure 14: Website Proxy Policy (2) Click the Add… button below the From: field to add a new allowed source. Figure 15: Website Proxy Policy (3) DIGIPASS Authentication for WatchGuard Firebox - Integration Guideline V1.0 © 2007 VASCO Data Security. All rights reserved.
Click the Add User… button. Figure 16: Website Proxy Policy (4) Select Firewall as Type and RADIUS as Auth. Server. Make sure you type in the username as it is known in the back-end authentication service (Active Directory, VACMAN Middleware, …). Click OK to finish. Figure 17: Website Proxy Policy (5) Make sure you remove all unnecessary members and addresses from list. So you only keep a list of people who are allowed to access the corporate website.
Note: It might be a though job to add a lot of users this way. This job can also be done by manually editing the configuration *.xml file. Click the Add… button below the To: field to configure the internal website that has to be protected. Figure 19: Website Proxy Policy (7) Click the NAT… button to add a new link to an internal website. Figure 20: Website Proxy Policy (8) DIGIPASS Authentication for WatchGuard Firebox - Integration Guideline V1.0 © 2007 VASCO Data Security. All rights reserved.
If you have more then one IP Address pointing to the Firebox, you will have a choice of which External IP Address to use for the connection to the website. Also add the Internal IP Address of the web server hosting your corporate website. Click OK to finish. Figure 21: Website Proxy Policy (9) If you have chosen NAT as To: address, all other fields are automatically removed from the list. You should only have kept the NAT address in the list.
The next screen gives you an overview of the changes made. We only allow some authenticated users to use a NAT mapping to the corporate website. Click OK to finish. Figure 23: Website Proxy Policy (11) Click the Close button in the Add Policies window to get back to the overview window. Here your newly created rule now should show up. Figure 24: Website Proxy Policy (12) DIGIPASS Authentication for WatchGuard Firebox - Integration Guideline V1.0 © 2007 VASCO Data Security. All rights reserved.
5.5 Saving Changes When all changes are performed, you must save the current configuration back to the Firebox. This is done by clicking the Save To Firebox button. The program will ask you to store the current configuration locally to an *.xml file. Answer with Yes or No, depending you want to save it or not. Now your have to give the write/configuration passphrase. This passphrase enables you to save changes to the Firebox. When this is done, the current configuration will be live on the Firebox.
6 VACMAN Middleware 6.1 Configure VACMAN Middleware Setting up the VM only requires you to set up a policy to go to the right back-end and to add an extra Radius component pointing to the Firebox. To add a new policy, right-click Policies and choose New Policy. Figure 25: VM configuration (1) DIGIPASS Authentication for WatchGuard Firebox - Integration Guideline V1.0 © 2007 VASCO Data Security. All rights reserved.
There are a few policies available by default. You can also create new policies to suit your needs. Those can be independent policies or inherit their settings from default or other policies. Fill in a policy name and choose the option most suitable in your situation. If you want the policy to inherit setting from another policy, choose the inherit option. If you want to copy an existing policy, choose the copy option and if you want to make a new one, choose the create option.
In the policy options configure it to use the right back-end server. This could be the local database, but also active directory or another radius server. This is probably the same that was in your Default Firebox authentication options before you changed it. Or you use the local database, Windows or you go further to another radius server. In our example we select our newly made Firebox Policy and change it like this: Main Settings • Local auth.: • Back-End Auth.
Now create a new component by right-clicking the Components and choose New Component. Figure 30: VM configuration (5) As component type choose RADIUS Client. The location is the IP address of the Firebox. In the policy field you should find your newly created policy. Fill in the shared secret you entered also in the Firebox in the RADIUS options. Click Create. Figure 31: VM configuration (6) DIGIPASS Authentication for WatchGuard Firebox - Integration Guideline V1.0 © 2007 VASCO Data Security.
As last we will add the back-end RADIUS authentication server settings. Right-click Back-End Servers and select New Back-End Server… Figure 32: VM configuration (7) Fill in all fields according to the server where IAS is configured. Server ID: Protocol: Domain: Priority: Auth. IP: Acc. IP: Secret: Timeout: Retries: Name of this element RADIUS leave empty 100 IAS Server + port IAS Server + port the same as on IAS 15 3 Figure 33: VM configuration (8) The Firebox and the VM are set up.
7 Microsoft IAS In this chapter we will explain how to use IAS as a back-end authentication server. The reason for doing this is because in IAS we can do an AD Group check. We will setup IAS to check if the users are in a certain AD group. If they are, we will send a group string back in the Filter-Id attribute, which is an attribute of the standard RADIUS message. Open the IAS administration window, right-click RADIUS Clients and select New RADIUS Client.
There are no vendor specific attributes we need for this message, so select RADIUS Standard as client vendor. Type in the same Shared Secret as you entered in the Back-End authentication server in VACMAN Middleware. Figure 36: IAS configuration (3) To create the policy that will check for user groups, go to Remote Access Policies, right-click this folder and select New Remote Access Policy. Figure 37: IAS configuration (4) DIGIPASS Authentication for WatchGuard Firebox - Integration Guideline V1.
Select to Set up a custom policy and type in a friendly name for this policy. As you may want to check different groups, it could be appropriate to reference the name of the group in your friendly name. For each group you will need a different policy. Figure 38: IAS configuration (5) Next, you are able to set the policy conditions. These conditions will have to be fulfilled before an authentication can be done. So here we will specify the group the user will have to belong to. Click the Add… button.
Click the Add… button to add an AD group to the list. Figure 41: IAS configuration (8) Search for the group the user has to belong to and click OK. In our example we use the firebox_users group. Figure 42: IAS configuration (9) Click OK when the group shows up in the list. Figure 43: IAS configuration (10) DIGIPASS Authentication for WatchGuard Firebox - Integration Guideline V1.0 © 2007 VASCO Data Security. All rights reserved.
Click Next to continue the wizard. Figure 44: IAS configuration (11) Select the Grant remote access permission and click Next. Figure 45: IAS configuration (12) This far the policy is set up. But we also wanted to send a group name back to the Firebox. Click Edit Profile… Figure 46: IAS configuration (13) DIGIPASS Authentication for WatchGuard Firebox - Integration Guideline V1.0 © 2007 VASCO Data Security. All rights reserved.
Go to the Authentication tab and select Unencrypted authentication (PAP, SPAP) in the list. Figure 47: IAS configuration (14) On the Advanced tab, click the Add… button. Figure 48: IAS configuration (15) DIGIPASS Authentication for WatchGuard Firebox - Integration Guideline V1.0 © 2007 VASCO Data Security. All rights reserved.
Select Filter-Id from the list and click Add… Figure 49: IAS configuration (16) Click Add… to enter a new filter string. Figure 50: IAS configuration (17) Make sure String is selected and enter the group name as you used it on the Firebox. The group name you enter here and like it is used in AD does not have to match. Click OK to go on. Figure 51: IAS configuration (18) DIGIPASS Authentication for WatchGuard Firebox - Integration Guideline V1.0 © 2007 VASCO Data Security. All rights reserved.
Click OK when the group name is shown in the attribute list. Figure 52: IAS configuration (19) Click Close to go back. Figure 53: IAS configuration (20) Click OK to save the changes you made to the profile and to go back to the wizard. Figure 54: IAS configuration (21) DIGIPASS Authentication for WatchGuard Firebox - Integration Guideline V1.0 © 2007 VASCO Data Security. All rights reserved.
You will receive a warning stating you selected different authentication methods. Click No as we don’t need to see additional help topics. Figure 55: IAS configuration (22) Click Next. Figure 56: IAS configuration (23) The wizard is now complete and our policy is created. We will now be able to return a group object to the firebox. Click Finish. Figure 57: IAS configuration (24) DIGIPASS Authentication for WatchGuard Firebox - Integration Guideline V1.0 © 2007 VASCO Data Security. All rights reserved.
8 User configuration The user creation steps you will find in this chapter are optional when you didn’t activate the option Dynamic User Registration (DUR) and/or Password Autolearn in your policy settings. The assignment of a DIGIPASS can happen manually as explained in the steps below. The user creation and DIGIPASS assignment steps depend on which database backend you installed VACMAN Middleware. Either you installed it with an ODBC back-end or with an Active Directory back-end. 8.1 8.1.
Fill in the username and password fields. Optionally choose the right domain and Organizational Unit and click the Create button. Figure 59: ODBC User Creation (2) The user will now show up in the Users list of you DIGIPASS Administration MMC. At this point it will be exactly the same as when Dynamic User Recognition (DUR) was enabled. Figure 60: ODBC User Creation (3) DIGIPASS Authentication for WatchGuard Firebox - Integration Guideline V1.0 © 2007 VASCO Data Security. All rights reserved.
8.1.2 Import DIGIPASS Right-click the DIGIPASS folder and select Import DIGIPASS... . Figure 61: Import DIGIPASS (1) Browse for your *.DPX file, fill in the Transport Key and look at your available applications by pushing the Show Applications button. You can either import all applications or only the ones you selected, by the Import … buttons above and below the Show Applications button. Figure 62: Import DIGIPASS (2) DIGIPASS Authentication for WatchGuard Firebox - Integration Guideline V1.
When the DIGIPASS is imported successfully you will receive a confirmation message. Figure 63: Import DIGIPASS (3) DIGIPASS Authentication for WatchGuard Firebox - Integration Guideline V1.0 © 2007 VASCO Data Security. All rights reserved.
8.1.3 DIGIPASS Assignment There are two possible ways to assign a DIGIPASS to a user. You can search for a DIGIPASS and assign it to a user or you can search for a user and assign it to a DIGIPASS. You can see the difference in the following two figures. Right-click a user and select Assign DIGIPASS... or ... Figure 64: DIGIPASS assignment (1) … you can right-click a DIGIPASS and select Assign … .
If you leave the User ID blank and press the Find button, you will get a list of all the available users in the same domain as the DIGIPASS. The usernames are partly searchable too. Notice: If no users show up, make sure the domains of the DIGIPASS and the user match. Figure 66: DIGIPASS assignment (3) When assigning a DIGIPASS to a user the same procedure will be applicable. You can either select the desired option to search for a DIGIPASS or search through serial number.
8.2 8.2.1 Active Directory installation User creation User creation, while using an Active Directory back-end, will happen in the Active Directory Users and Computers MMC. Right-click a user and select Properties. This can happen automatically when the Dynamic User Registration (DUR) option in the policy settings is active. Figure 68: Active Directory User Creation (1) DIGIPASS Authentication for WatchGuard Firebox - Integration Guideline V1.0 © 2007 VASCO Data Security. All rights reserved.
In the DIGIPASS User Account tab you will see a field to manually add a password. This can also be automatically filled by enabling the Password Autolearn option in the policy settings. Figure 69: Active Directory User Creation (2) After clicking the Apply button you will see the Update History fields being filled with the current date and time. When these fields are filled it means the DIGIPASS account exists and can be used.
8.2.2 Import DIGIPASS To make sure you can see the DIGIPASS folders in the MMC, go to View and select the Advanced Features. This way you will see the DIGIPASS folders. Figure 71: Import DIGIPASS (1) Right-click the DIGIPASS-Pool folder and select Import DIGIPASS … . Figure 72: Import DIGIPASS (1) DIGIPASS Authentication for WatchGuard Firebox - Integration Guideline V1.0 © 2007 VASCO Data Security. All rights reserved.
Browse for your *.DPX file, fill in the Transport Key and look at your available applications by pushing the Show Applications button. You can either import all applications or only the ones you selected, by the Import … buttons above and below the Show Applications button. Figure 73: Import DIGIPASS (1) When the DIGIPASS is imported successfully you will receive a confirmation message. Figure 74: Import DIGIPASS (1) DIGIPASS Authentication for WatchGuard Firebox - Integration Guideline V1.
8.2.3 DIGIPASS assignment There are two possible ways to assign a user to a DIGIPASS. You can search for a DIGIPASS and assign it to a user or you can search for a user and assign it to a DIGIPASS. You can see the difference in the following two figures. Right-click a User and select Assign DIGIPASS... or ... Figure 75: DIGIPASS Assignment (1) … right-click a DIGIPASS and select Assign DIGIPASS … .
If you leave the User ID blank and press the Find button, you will get a list of all the available users in the same domain as the DIGIPASS. The usernames are partly searchable too. Figure 77: DIGIPASS Assignment (4) When assigning a DIGIPASS to a user the same procedure will be applicable. You can either select the desired option to search for a DIGIPASS or through serial number. Leaving all options blank will show you all possibilities. Remember to check the “Search upwards …” checkbox.
9 Firebox Authentication Test Before you will be able to logon with a known AD user, you will have to create the right global security group in AD. Also make sure the users you are trying to authenticate have Allow access enabled on the Dial-in tab of their user properties set. Figure 78: User properties We will first try to gain access to the corporate website without authenticating to the Firebox. Point your browser to the corporate website. In our example this is http://62.58.226.
9.1 Response Only To authenticate, point your web browser to the authentication service of the Firebox. In our example this is https://62.58.226.225:4100/ Login with username: testuser and password: a One Time Password (OTP). Select RADIUS as authentication domain and click Login to continue. Figure 80: Response Only (1) You will receive a message stating that the authentication was successful. The firebox remembers your IP address and username until you logout or until the session has timed out.
When we now try accessing the corporate website, you will see access is granted. In our example this was http://62.58.226.226 Figure 82: Response Only (3) DIGIPASS Authentication for WatchGuard Firebox - Integration Guideline V1.0 © 2007 VASCO Data Security. All rights reserved.
9.2 Challenge/Response As we setup everything before to use “Response Only” (using only the generated OTP of a DIGIPASS), you can also use “Challenge/Response”. You only have to change one option in your policy (Firebox Policy) in VACMAN Middleware. Go to the Policy properties – Challenge Settings, and select as “2-Step Challenge/Response” the option Password. (Make sure your DIGIPASS is out of grace period to use this method.
And as you can see in Figure 57, the Firebox is returning you a Challenge to use on your DIGIPASS. Type the Response in the empty field, and click Submit. Figure 85: Challenge / Response (3) When the authentication was successful you will receive a confirmation message on your screen. Now you can access the corporate website in a more secure way using the challenge/response method. Figure 86: Challenge / Response (4) DIGIPASS Authentication for WatchGuard Firebox - Integration Guideline V1.
10 VACMAN Middleware features 10.1 Installation The VACMAN Middleware (VM) installation is very easy and straightforward. VM runs on Windows platforms, supports a variety of databases and uses an online registration. Different authentication methods allow a seamless integration into existing environments. 10.1.1 Support for Windows 2000, 2003, IIS5 and IIS6 VM can be installed on Windows 2000 and Windows 2003.
The configuration of authentication methods is done within the policy (policies). 10.2.5 Policies Policies specify various settings that affect the User authentication process. Each authentication request is handled according to a Policy that is identified by the applicable Component record. Components can be radius clients, authentication servers or Citrix web interfaces. 10.2.
10.3 Administration 10.3.1 Active Directory Users and Computers Extensions Since VACMAN Middleware version 2.3, Managing the users and DIGIPASS can be done within the Active Directory Users and Computers section. Selecting the properties of a user, offers complete User-DIGIPASS management. Figure 87: VM Features (1) 10.3.2 Administration MMC Interface A highly intuitive Microsoft Management Console (MMC) exists to administer the product.
10.3.3 User Self Management Web Site A web site running on IIS has been developed to allow users to register themselves to the VM with their username and back-end (RADIUS or Windows) password, to do a DIGIPASS self assign, to update their back-end password stored in the VM database, to do a change PIN (Go-1/Go-3 DIGIPASS), to do a DIGIPASS test. Figure 89: VM Features (3) 10.3.4 Delegated administration Administration can be delegated by appointing different administrators per organizational unit (OU).
11 About VASCO Data Security VASCO designs, develops, markets and supports patented Strong User Authentication products for e-Business and e-Commerce. VASCO’s User Authentication software is carried by the end user on its DIGIPASS products which are small “calculator” hardware devices, or in a software format on mobile phones, other portable devices, and PC’s. At the server side, VASCO’s VACMAN products guarantee that only the designated DIGIPASS user gets access to the application.
