Benutzerhandbuch für WatchGuard Technologies SSL VPN

Inhaltsverzeichnis

• CHAPTER 1 Getting Started with Firebox SSL VPN Gateway

  1
• Audience

  1
• Operating System Requirements

  1
• Document Conventions

  2
• LiveSecurity Service Solutions

  2
• LiveSecurity Service Broadcasts

  3
• Activating LiveSecurity Service

  4
• LiveSecurity Service Self Help Tools

  4
• WatchGuard Users Forum

  5
• Online Help

  6
• Product Documentation

  6
• Technical Support

  6
• LiveSecurity Service technical support

  6
• LiveSecurity Gold

  7
• Firebox Installation Service

  7
• VPN Installation Service

  7
• Training and Certification

  7
• CHAPTER 2 Introduction to Firebox SSL VPN Gateway

  9
• Overview

  9
• New Features

  11
• Authentication and one-time passwords

  11
• New versions of the Secure Access Client

  11
• Configurable symmetric encryption ciphers

  11
• Automatic detection of proxy server settings

  11
• Secure Access Client connections

  12
• Automatic port redirection

  12
• Disable desktop sharing

  12
• Additional control over Secure Access Client connections

  12
• Disable kiosk mode

  12
• Specify multiple ports and port ranges for network resources

  12
• Voice over IP softphone support

  12
• Editable HOSTS file

  12
• NTLM authentication and authorization support.

  13
• Added challenge-response to RADIUS user authentication

  13
• authentication

  13
• Updated serial console menu

  13
• Features

  13
• Administration Tool

  13
• Firebox SSL VPN Gateway Settings

  14
• Feature Summary

  16
• The User Experience

  16
• Deployment and Administration

  17
• Planning your deployment

  18
• Deploying the Firebox SSL VPN Gateway in the Network DMZ

  18
• Deploying the Firebox SSL VPN Gateway in a Secure Network

  18
• Planning for Security with the Firebox SSL VPN Gateway

  19
• Configuring Secure Certificate Management

  19
• Authentication Support

  19
• Deploying Additional Appliances for Load Balancing and Failover

  20
• Installing the Firebox SSL VPN Gateway for the First Time

  20
• Getting Ready to Install the Firebox SSL VPN Gateway

  20
• Setting Up the Firebox SSL VPN Gateway Hardware

  21
• Configuring TCP/IP Settings for the Firebox SSL VPN Gateway

  21
• Redirecting Connections on Port 80 to a Secure Port

  24
• Using the Firebox SSL VPN Gateway

  24
• The Firebox SSL VPN Gateway operates as follows:

  24
• Starting the Secure Access Client

  25
• Enabling Single Sign-On Operation for the Secure Access Client

  25
• Establishing the Secure Tunnel

  26
• Tunneling Destination Private Address Traffic over SSL or TLS

  26
• Operation through Firewalls and Proxies

  26
• Terminating the Secure Tunnel and Returning Packets to the Client

  27
• Using Kiosk Mode

  28
• Connecting to a Server Load Balancer

  28
• CHAPTER 3 Configuring Basic Settings

  31
• Firebox SSL VPN Gateway Administration Desktop

  32
• To open the Administration Portal and Administrative Desktop

  32
• Using the Administration Portal

  32
• Downloads Tab

  32
• Admin Users Tab

  33
• Logging Tab

  33
• Maintenance Tab

  33
• Using the Serial Console

  33
• To open the serial console

  34
• Using the Administration Tool

  34
• To download and install the Administration Tool

  34
• Publishing Settings to Multiple Firebox SSL VPN Gateways

  35
• To publish Firebox SSL VPN Gateway settings

  35
• Product Activation and Licensing

  35
• Upgrading the tunnel and tunnel upgrade license

  35
• Upgrading the LiveSecurity Renewal and Tunnel Renewal license

  36
• Managing Licenses

  36
• To manage licenses on the Firebox SSL VPN Gateway

  36
• To install a license file

  37
• Information about Your Licenses

  37
• Testing Your License Installation

  37
• Blocking External Access to the Administration Portal

  38
• To block external access to the Administration Portal

  38
• Using Portal Pages

  38
• Using the Default Portal Page

  38
• Downloading and Working with Portal Page Templates

  39
• To download the portal page templates to your local computer

  40
• To work with the templates for Windows and Linux users

  40
• Using the ActiveX Control

  40
• Installing Custom Portal Files on the Firebox SSL VPN Gateway

  40
• Enabling Portal Page Authentication

  41
• To enable portal page authentication

  41
• Linking to Clients from Your Web Site

  41
• Multiple Log On Options using the Portal Page

  42
• Pre-Authentication Policy Portal Page

  42
• Double-source Authentication Portal Page

  43
• Connecting Using a Web Address

  43
• Connecting Using Secure Access Client

  43
• Saving and Restoring the Configuration

  44
• To save the Firebox SSL VPN Gateway configuration

  44
• To restore a saved configuration

  44
• Upgrading the Firebox SSL VPN Gateway Software

  44
• To upgrade the Firebox SSL VPN Gateway

  44
• Restarting the Firebox SSL VPN Gateway

  45
• To restart the Firebox SSL VPN Gateway

  45
• Shutting Down the Firebox SSL VPN Gateway

  45
• To shut down the Firebox SSL VPN Gateway

  45
• Firebox SSL VPN Gateway System Date and Time

  45
• To change the system date and time

  46
• Network Time Protocol

  46
• Allowing ICMP traffic

  46
• To enable ICMP traffic

  46
• CHAPTER 4 Configuring Firebox SSL VPN Gateway Network Connections

  47
• Configuring Network Information

  47
• General Networking

  48
• Name Service Providers

  50
• To enable split DNS

  50
• To edit the HOSTS file

  50
• Dynamic and Static Routing

  51
• Configuring Network Routing

  51
• Configuring Dynamic Routing

  52
• Enabling RIP Authentication for Dynamic Routing

  52
• Changing from Dynamic Routing to Static Routing

  53
• Configuring a Static Route

  53
• Static Route Example

  54
• Configuring Firebox SSL VPN Gateway Failover

  55
• To specify Firebox SSL VPN Gateway failover

  55
• Configuring Internal Failover

  55
• Controlling Network Access

  56
• Configuring Network Access

  56
• Specifying Accessible Networks

  57
• Enabling Split Tunneling

  57
• To enable split tunneling

  58
• Configuring User Groups

  58
• Denying Access to Groups without an ACL

  58
• To deny access to user groups without an ACL

  59
• Improving Voice over IP Connections

  59
• Enabling Improving Voice over IP Connections

  59
• To improve latency for UDP traffic

  60
• CHAPTER 5 Configuring Authentication and Authorization

  61
• Configuring Authentication and Authorization

  61
• Configuring Authentication without Authorization

  63
• The Default Realm

  63
• Using a Local User List for Authentication

  63
• Configuring Local Users

  64
• Adding Users to Multiple Groups

  64
• Changing Password for Users

  64
• Using LDAP Authorization with Local Authentication

  65
• Changing the Authentication Type of the Default Realm

  65
• Configuring the Default Realm

  65
• Creating Additional Realms

  66
• Removing Realms

  67
• Using SafeWord for Authentication

  67
• Configuring Secure Computing SafeWord Authentication

  67
• Configuring SafeWord Settings on the Access Gateway

  67
• To disable Firebox SSL VPN Gateway authentication

  68
• SafeWord PremierAccess Authorization

  68
• Using SafeWord for Citrix or SafeWord RemoteAccess for Authentication

  68
• To configure the IAS RADIUS realm

  69
• Using RADIUS Servers for Authentication and Authorization

  69
• To configure Microsoft Internet Authentication Service for Windows 2000 Server

  70
• To specify RADIUS server authentication

  72
• To configure RADIUS authorization

  72
• Choosing RADIUS Authentication Protocols

  72
• Using LDAP Servers for Authentication and Authorization

  73
• LDAP authentication

  73
• To configure LDAP authentication

  74
• LDAP Authorization

  75
• Group memberships from group objects working evaluations

  76
• Group memberships from group objects non-working evaluations

  76
• LDAP authorization group attribute fields

  76
• To configure LDAP authentication

  76
• To configure LDAP authorization

  77
• Using certificates for secure LDAP connections

  78
• Determining Attributes in your LDAP Directory

  78
• Using RSA SecurID for Authentication

  79
• To generate a sdconf.rec file for the Firebox SSL VPN Gateway

  80
• Enable RSA SecurID authentication for the Firebox SSL VPN Gateway

  81
• Configuring RSA Settings for a Cluster

  82
• Resetting the node secret

  82
• Configuring Gemalto Protiva Authentication

  82
• Configuring NTLM Authentication and Authorization

  83
• Configuring NTLM Authorization

  84
• Configuring Authentication to use One-Time Passwords

  84
• Configuring Double-Source Authentication

  85
• To create and configure a double-source authentication realm

  85
• Changing Password Labels

  86
• CHAPTER 6 Adding and Configuring Local Users and User Groups

  87
• Adding Local Users

  87
• To create a user on the Firebox SSL VPN Gateway

  87
• To delete a user from the Firebox SSL VPN Gateway

  88
• User Group Overview

  88
• Creating User Groups

  89
• To create a local user group

  89
• To remove a user group

  89
• Configuring Properties for a User Group

  90
• Default group properties

  90
• Forcing Users to Log on Again

  90
• Configuring Secure Access Client for single sign-on

  91
• Enabling domain logon scripts

  91
• Enabling session time-out

  92
• Configuring Web Session Time-Outs

  93
• Disabling Desktop Sharing

  93
• Setting Application Options

  93
• Enabling Split DNS

  94
• Enabling IP Pooling

  94
• Choosing a portal page for a group

  95
• Client certificate criteria configuration

  95
• Global policies

  96
• Configuring Resources for a User Group

  96
• Adding Users to Multiple Groups

  98
• Allowing and denying network resources and application policies

  98
• Defining network resources

  99
• Allowing and Denying Network Resources and Application Policies

  100
• Application policies

  101
• Configuring file share resources

  102
• Configuring kiosk mode

  103
• End point resources and policies

  104
• Configuring an end point policy for a group

  105
• Setting the Priority of Groups

  106
• Configuring Pre-Authentication Policies

  107
• CHAPTER 7 Creating and Installing Secure Certificates

  109
• Generating a Secure Certificate for the Firebox SSL VPN Gateway

  109
• Digital Certificates and Firebox SSL VPN Gateway Operation

  110
• Overview of the Certificate Signing Request

  110
• Password-Protected Private Keys

  110
• Creating a Certificate Signing Request

  111
• Installing a Certificate and Private Key from a Windows Computer

  112
• Installing Root Certificates on the Firebox SSL VPN Gateway

  112
• Installing Multiple Root Certificates

  113
• Creating Root Certificates Using a Command Prompt

  113
• Resetting the Certificate to the Default Setting

  113
• Client Certificates

  114
• To require client certificates

  114
• Installing Root Certificates

  115
• Obtaining a Root Certificate from a CertificateAuthority

  115
• Installing Root Certificates on a Client Device

  115
• Selecting an Encryption Type for Client Connections

  115
• Requiring Certificates from Internal Connections

  116
• To require server certificates for internal client connections

  116
• Wildcard Certificates

  116
• CHAPTER 8 Working with Client Connections

  117
• System Requirements

  117
• Operating Systems

  117
• Web Browsers

  117
• Using the Access Portal

  118
• To connect using the default portal page

  118
• Connecting from a Private Computer

  119
• Tunneling Private Network Traffic over Secure Connections

  120
• Operation through Firewalls and Proxies

  121
• Terminating the Secure Tunnel and Returning Packets to the Client

  121
• ActiveX Helper

  122
• Using the Secure Access Client Window

  122
• Configuring Proxy Servers for the Secure Access Client

  125
• Configuring Secure Access Client to Work with Non-Administrative Users

  126
• Connecting from a Public Computer

  126
• Connections Using Kiosk Mode

  126
• Creating a Kiosk Mode Resource

  127
• Working with File Share Resources

  128
• Client Applications

  129
• To enable client applications

  129
• Firefox Web Browser

  130
• Remote Desktop client

  130
• SSH Client

  130
• Telnet 3270 Emulator Client

  131
• VNC Client

  131
• Gaim Instant Messenging

  131
• Supporting Secure Access Client

  132
• Managing Client Connections

  133
• Connection handling

  133
• Closing a connection to a resource

  134
• Disabling and enabling a user

  134
• Configuring Authentication Requirements after Network Interruption

  134
• APPENDIX A Firebox SSL VPN Gateway Monitoring and Troubleshooting

  137
• Viewing and Downloading System Message Logs

  137
• To view and filter the system log

  137
• Forwarding System Messages to a Syslog Server

  138
• To forward Firebox SSL VPN Gateway system messages to a syslog server

  138
• Viewing the W3C-Formatted Request Log

  138
• Enabling and Viewing SNMP Logs

  139
• To enable logging of SNMP messages

  139
• Multi Router Traffic Grapher Example

  139
• Viewing System Statistics

  140
• Monitoring Firebox SSL VPN Gateway Operations

  140
• To open the Firebox SSL VPN Gateway Administration Desktop

  141
• Recovering from a Failure of the Firebox SSL VPN Gateway

  141
• Reinstalling v 4.9 application software

  142
• Backing up your configuration settings

  142
• Upgrading to SSL v 5.0

  142
• Upgrading to SSL v 5.5

  142
• Launching the v 5.5 Administration Tool

  143
• Troubleshooting

  143
• Troubleshooting the Web Interface

  143
• Other Issues

  144
• APPENDIX B Using Firewalls with Firebox SSL VPN Gateway

  149
• BlackICE PC Protection

  150
• McAfee Personal Firewall Plus

  150
• Norton Personal Firewall

  151
• Sygate Personal Firewall (Free and Pro Versions)

  151
• Tiny Personal Firewall

  151
• ZoneAlarm Pro

  152
• APPENDIX C Installing Windows Certificates

  153
• To install Cygwin

  153
• Unencrypting the Private Key

  154
• To unencrypt the private key

  154
• Converting to a PEM-Formatted Certificate

  155
• To convert the certificate from PKCS7 to PEM format

  155
• Combining the Private Key with the Signed Certificate

  155
• To combine the private key with the signed certificate

  156
• Generating Trusted Certificates for Multiple Levels

  156
• To generate trusted certificates for multiple levels

  156
• APPENDIX D Examples of Configuring Network Access

  159
• Scenario 1: Configuring LDAP Authentication and Authorization

  160
• Preparing for the LDAP Authentication and Authorization Configuration

  160
• Resources

  163
• Scenario 2: Creating Guest Accounts Using the Local Users List

  169
• Creating a Guest User Authentication Realm

  170
• Creating Local Users

  171
• Creating and Assigning a Network Resource to the Default User Group

  171
• Scenario 3: Configuring Local Authorization for Local Users

  172
• APPENDIX E Legal and Copyright Information

  173