INTEGRATION GUIDE. DIGIPASS Authentication for F5 FirePass

Disclaimer

Disclaimer of Warranties and Limitation of Liabilities

All information contained in this document is provided 'as is'; VASCO Data Security assumes no responsibility for its accuracy and/or completeness.

In no event will VASCO Data Security be liable for damages arising directly or indirectly from any use of the information contained in this document.

Copyright

Copyright © 2010 VASCO Data Security, Inc, VASCO Data Security International GmbH. All rights reserved. VASCO®, Vacman®, IDENTIKEY®, aXsGUARD™™, DIGIPASS® _and ® _{logo are registered or unregistered trademarks of VASCO}

Table of Contents

DIGIPASS Authentication for F5 FirePass _{... 1}

Disclaimer ... 2 Table of Contents... 3 1 Overview ... 4 2 Problem Description ... 4 3 Solution ... 4 4 Technical Concept ... 5 4.1 General overview ... 5 4.2 F5 FirePass prerequisites ... 5

4.3 IDENTIKEY Server Prerequisites ... 5

5 F5 FirePass Configuration ... 6 6 IDENTIKEY Server ... 10 6.1 Policy configuration ...10 6.2 Client configuration ...13 7 F5 FirePass SSL/VPN test ... 1 7.1 Response Only ... 1 7.2 Challenge / Response ... 2

1

Overview

The purpose of this document is to demonstrate how to configure IDENTIKEY Server to work with a F5 FirePass device. Authentication is arranged on one central place where it can be used in a regular VPN or SSL/VPN connection.

2

Problem Description

The basic working of the F5 FirePass is based on authentication to an existing media (LDAP, RADIUS, local authentication …). To use the IDENTIKEY Server with F5

FirePass, the external authentication settings need to be changed or added manually.

3

Solution

After configuring IDENTIKEY Server and the F5 FirePass in the right way, you

eliminate the weakest link in any security infrastructure – the use of static passwords – that are easily stolen guessed, reused or shared.

The F5 FirePass gives you the ability of a combined SSL/VPN platform, it’s possible to access your network from a web portal page and/or to create a SSL tunnel.

Figure 1: Web portal

4

Technical Concept

4.1

General overview

The main goal of the F5 FirePass is to perform authentication to secure all kind of VPN connections. As the F5 FirePass can perform authentication to an external service using the RADIUS protocol, we will place the IDENTIKEY Server as back-end service for the F5 FirePass appliance, to secure the authentication with our proven IDENTIKEY Server software.

The users will now be checked first by IDENTIKEY Server that can be linked to Active Directory in the back-end. So we just place IDENTIKEY Server in between the F5 FirePass and the Active Directory.

Figure 3: General overview

4.2

F5 FirePass prerequisites

Please make sure you have a working setup of the F5 FirePass. It is very important this is working correctly before you start implementing the authentication to the IDENTIKEY SERVER.

Currently all F5 FirePass devices use the same web config and CLI interface. This means our integration guide is suited for the complete product range of F5 FirePass devices.

4.3

IDENTIKEY Server Prerequisites

5

F5 FirePass Configuration

By default the webconfig is reachable by https://<IP_OR_NAME_F5_FirePass>/admin/ In our case this becomes: https://10.10.1.110/admin/

Figure 4: F5 FirePass Configuration (1) On the lower left menu, select Users.

On the top left menu, now select Groups.

Figure 6: F5 FirePass Configuration (3)

In this case we are assuming that you already have some external authentication. (Active Directory, LDAP, RADIUS, …)

Click on the group name that you want to change. As we were currently using the ADusers group to authenticate the users to Active Directory, we change this group.

In case the authentication method is already RADIUS, skip to Figure 10. Otherwise, click the Convert authentication method.

Figure 8: F5 FirePass Configuration (5) Choose the RADIUS Authentication option.

Now fill in the details of the server where IDENTIKEY Server is installed.

Figure 10: F5 FirePass Configuration (7)

Click the Save Settings button to save the changes.

We now configured the authentication to go the IDENTIKEY Server. You still need to configure the IDENTIKEY Server in order to have the same back-end as your

application was using before. If the users were checked on Active Directory, RADIUS or any other back-end authentication service, you will need to setup IDENTIKEY Server with the same back-end authentication.

6

IDENTIKEY Server

Go to the IDENTIKEY Server web administration page, and authenticate with and administrative account.

6.1

Policy configuration

To add a new policy, select Policies



Create.

Figure 11: Policy configuration (1)

Fill in a policy ID and description. Choose the option most suitable in your situation. If you want the policy to inherit setting from another policy, choose the right policy in the Inherits From list. Otherwise leave this field to None.

Figure 12: Policy configuration (2)

In the policy options configure it to use the right back-end server. This could be the local database, but also active directory or another radius server.

This is probably the same that was in your default client authentication options before you changed it. Or you use the local database, Windows or you go further to another radius server.

In our example we select our newly made Demo Policy and change it like this:

Local auth.: Digipass/Password

Back-End Auth.: Default (None)

Back-End Protocol: Default (None)

Dynamic User Registration: Default (No)

Password Autolearn: Default (No)

Stored Password Proxy: Default (No) Windows Group Check: Default (No Check)

In the Policy tab, click the Edit button, and change the Local Authentication to Digipass/Password.

Figure 13: Policy configuration (3)

The user details can keep their default settings.

6.2

Client configuration

Now create a new component by right-clicking the Components and choose New Component.

As component type choose RADIUS Client. The location is the IP address of the client. In the policy field you should find your newly created policy. Fill in the shared secret you entered also in the client for the RADIUS options. In our example this was “vasco”. Click Create.

Figure 16: Client configuration (2)

7

F5 FirePass SSL/VPN test

7.1

Response Only

To start the test, browse to the public IP address or hostname of the F5 FirePass device. In our example this is https://10.10.1.110. Enter your Username and Password (One Time Password) and click the Logon button.

Figure 17: Response Only (1)

7.2

Challenge / Response

For the challenge response test, enter your Username and Password (challenge/response trigger). Click the Logon button.

In our case the challenge/response trigger is the user’s static password.

Figure 19: Challenge / Response (1)

You will be presented with a DP300 Challenge code. Use this challenge on your DIGIPASS 300 (keypad) to generate a response. Enter the response in the empty field and click Logon.

And if everything goes well, you will be shown the SSL/VPN portal page.

8

About VASCO Data Security

VASCO designs, develops, markets and supports patented Strong User Authentication products for e-Business and e-Commerce.

VASCO’s User Authentication software is carried by the end user on its DIGIPASS products which are small “calculator” hardware devices, or in a software format on mobile phones, other portable devices, and PC’s.

At the server side, VASCO’s VACMAN products guarantee that only the designated DIGIPASS user gets access to the application.

VASCO’s target markets are the applications and their several hundred million users that utilize fixed password as security.

VASCO’s time-based system generates a “one-time” password that changes with every use, and is virtually impossible to hack or break.