Step by Step Guide to implement SMS authentication to F5 Big-IP APM (Access Policy Manager)

(1)

™

Installation guide for securing the authentication to your F5 Big-IP APM™ solution with

Nordic Edge One Time Password Server, delivering strong authetication via SMS to

your mobile phone.

1 Summary

This is the complete installation guide for securing the authentication to your F5 Big-IP APM™ with Nordic Edge One Time Password Server 3, delivering strong authentication via SMS to your mobile phone. You will be able to test the product with your existing F5 Big-IP APM™ and LDAP user database, without making any changes that affect existing users. The guide will also allow you to make the complete installation efficiently, using a maximum of 1 hour. Nordic Edge provides several methods for delivering one time passwords, like the mobile client Pledge, e-mail, tokens, prefetch, Yubikey etc. - however in this test we are only going to use SMS.

(2)

™

machine with Windows Server 2003 installed with Ethernet in bridge mode. The server needs to have an ip-address configured and must also be able to reach your DNS-servers, your F5 Big-IP APM™ solution and the Active Directory. Since the software is quite small and easy to remove, you can also use any existing server in your network.

Definitions

In this Step by Step guide the guide for securing the authentication to your F5 Big-IP APM™ is referred

as "SSL-VPN Solution".

Important information regarding communication

The One Time Password Server is a software that you can place on any server in your internal network or DMZ.

- The One Time Password Server needs to be able to communicate (Outbound traffic) with your

LDAP

or

JDBC

User Database. Default port for LDAP and Secure LDAP is TCP port 389 / 636.

- SSL-VPN solution needs to be able to communicate (Outbound traffic) with the One Time Password Server with Radius, UDP port 1812 or 1645 (Outbound traffic)

- If you want to use the

Nordic Edge SMS Gateway

, the One Time Password Server needs to be able to communicate (Outbound traffic) with otp.nordicedge.net and otp.nordicedge.se with HTTPS on TCP port 443.

In this test-scenario you will want to communicate with RADIUS port 1812 or 1645 and use our Nordic

Edge

(5)

™

3 Getting started

3.1 Register and download the software

(6)

™

(7)

™

You will receive an e-mail a link for downloading the software. A 30 days evaluation license will be sent

via e-mail when you download the software.

(8)

™

4 Installation

4.1 Start the installation

Start the installation on the server where you want to install the One Time Password Server

Please note that if you are installing on a Windows 2008 Server you need to right click on the otp3install.exe using explorer and click on “Run as Administrator”.

(9)

(10)

(11)

™

4.2 Installing license

(12)

(13)

(14)

™

(15)

(16)

(17)

(18)

(19)

™

5 Configuring the One Time Password Server

(20)

™

Start the OTP Configurator by clicking on the left button - “Configuration”

(21)

™

On the Server page you can set the length of the one time password and for how long it should be valid. Default is 5 minutes.

You can also set a default country prefix, which means that you will not need to state it in the mobile attribute. For more information regarding the optional setting please see One Time Password Server 3 – Administration manual

For now, leave this page as default and go on to the next part – Configure RADIUS.

5.3 Configure RADIUS

(22)

™

Click Save config.

5.4 Configure databases

(23)

(24)

™

5.5 Configure LDAP Host Settings

For our configuration we are going to use the active directory installed on the same server as the One

Time Password Server. We will use the internal IP-address (127.0.0.1) as host address.

We will use the standard LDAP port nb (389) to communicate with Active Directory.

(25)

™

Configure your LDAP host settings and click test. You should now get a messages saying “LDAP

connection success”

Click OK and Save

Next step is to configure the LDAP database settings.

5.6 Configure the LDAP database settings

The BASE DN is the search base for where your users contains. Click on the button with three dots at

the right side of the Base DN field to browse your LDAP Database.

(26)

™

5.7 Configure search filter

Next step is to configure the search filter for letting the One Time Password search for the right object classes and attribute according to Microsoft Active Directory.

(27)

™

5.8 Test LDAP Authentication

(28)

™

Type in the password

(29)

™

6 Configure the SSL-VPN client settings.

Since we are configuring the One Time Password Server to act as RADIUS-server. The actual SSL-VPN server / appliance box is considered a client to the One Time Password Server.

(30)

™

Type in a name for your SSL-VPN server and the ipaddress to your SSL-VPN server. Type in the RADIUS shared secret (this must match the shared secret in Access Gateway). Choose the Active Directory you configured earlier as User Database.

(31)

™

7 Configure Delivery Method

The Delivery Methods object category is used to enable and configure one or more delivery methods

that the OTP Server can use to send the one-time passwords.

One Time Password Server offers various methods like SMS, Oath Tokens, Instant Messaging, HTTP,

Yubikey.

In this example we will use SMS as Method and the Nordic Edge SMS-service as SMS-provider.

(32)

™

In the left Pane, click “Deliver Methods” and then Nordic Edge SMS. In the right pane enable Nordic

Edge SMS Gateway.

To Request a demo account click “Request a demo account”.

(33)

™

(34)

™

8 Restart the One Time Password Server as Windows Service

(35)

™

In Windows Control Panel, open Administrative Tools / Services

(36)

(37)

™

9 Add mobile phone number with Microsoft Management Console

(38)

™

10 CONFIGURING F5 Big-IP APM™

To use the Nordic Edge OTP Server, you have to configure a RADIUS authentication server, bind the

server to an access profile and then use this access profile in the SSL-VPN Virtual Server. In this

example, we already have an access profile and a Virtual Server for remote access. There are multiple

ways to setup remote access. You can for example do this with the Device Wizards that will guide you

through this process. For a detailed discussion on how to configure a SSL-VPN server, please review the

BIG-IP Administration Guide.

10.1 Adding the authentication server

(39)

™

-Name: Give the server a suitable name. -Mode: Authentication.

-Server Connection: Direct.

-Server Address: IP address of the Nordic Edge OTP Server.

(40)

™

-Secret: Enter the secret key and confirm it (this must match the shared secret in OTP Server).

-Timeout: Raise the server time-out to 25 seconds. This allows the RADIUS server to respond with an alternative attribute to F5 Big-IP APM if the operator fails to deliver the OTP SMS.

(41)

™

10.2 Adding authentication server to Access Policy

Goto Access Policys --> Access Profiles --> Access Profiles List. Choose "Edit" under "Access Policy" at your Access Profile.

(42)

™

(43)

™

(44)

™

(45)

™

10.3 Test the configuration

Navigate to the BIG-IP Virtual Server log on page. Enter the Microsoft Active Directory user name and password used earlier to configure the OTP server. After entering your credentials, press “Logon” to continue.

(46)

(47)

™

Enter the One Time Password and click on “Logon”.

(48)

Step by Step Guide to implement SMS authentication to F5 Big-IP APM (Access Policy Manager)

™

Installation guide for securing the authentication to your F5 Big-IP APM™ solution with

Nordic Edge One Time Password Server, delivering strong authetication via SMS to

your mobile phone.

1 Summary

™

Table of Contents

™

™

2 Prerequisites

.

As this guide only show you how to enable

SMS password functionality for secure login you will need to have a server available, for example a virtual

Definitions

In this Step by Step guide the guide for securing the authentication to your F5 Big-IP APM™ is referred

as "SSL-VPN Solution".

Important information regarding communication

LDAP

JDBC

Nordic Edge SMS Gateway

In this test-scenario you will want to communicate with RADIUS port 1812 or 1645 and use our Nordic

Edge

™

3 Getting started

3.1 Register and download the software

™

™

via e-mail when you download the software.

™

4

Installation

4.1 Start the installation

™

4.2 Installing license

™

™

5

Configuring the One Time Password Server

™

Start the OTP Configurator by clicking on the left button - “Configuration”

™

5.3 Configure RADIUS

™

Click Save config.

5.4 Configure databases

™

5.5

Configure LDAP Host Settings

For our configuration we are going to use the active directory installed on the same server as the One

Time Password Server. We will use the internal IP-address (127.0.0.1) as host address.

We will use the standard LDAP port nb (389) to communicate with Active Directory.

™

Configure your LDAP host settings and click test. You should now get a messages saying “LDAP

connection success”

Click OK and Save

Next step is to configure the LDAP database settings.

5.6

Configure the LDAP database settings

The BASE DN is the search base for where your users contains. Click on the button with three dots at

the right side of the Base DN field to browse your LDAP Database.

™

5.7 Configure search filter

™

5.8

Test LDAP Authentication

™

™

6 Configure the SSL-VPN client settings.

™

™

7

Configure Delivery Method

The Delivery Methods object category is used to enable and configure one or more delivery methods

that the OTP Server can use to send the one-time passwords.

One Time Password Server offers various methods like SMS, Oath Tokens, Instant Messaging, HTTP,

Yubikey.

In this example we will use SMS as Method and the Nordic Edge SMS-service as SMS-provider.

™

In the left Pane, click “Deliver Methods” and then Nordic Edge SMS. In the right pane enable Nordic