Web: Example for Configuring AD SSO for Internet Access Users (Install ADSSO_Setup.exe to receive messages from PCs)

Procedure

1. Choose Network > Interface, set IP addresses for interfaces and assign the interfaces to security zones.

   The following example describes how to configure interface GigabitEthernet 0/0/3. You can configure other interfaces based on the networking diagram.

   Zone	trust
   IP Address	10.3.0.1/24

2. Choose Policy > Security Policy > Security Policy, click Add to configure security policies.
   1. Configure security policies between the Trust (AD server and AD monitor) and Local zone to ensure the communication among the FW and AD server.

      Name	local_policy_ad_01
      Source Zone	local
      Destination Zone	trust
      Destination Address	10.3.0.251/32,10.3.0.254/32
      Action	Permit

      Name	local_policy_ad_02
      Source Zone	trust
      Destination Zone	local
      Source Address	10.3.0.251/32,10.3.0.254/32
      Action	Permit

   2. Configure a security policy to allow users to access the Internet.

      Name	policy_sec_02
      Source Zone	trust
      Destination Zone	untrust
      Source Address	10.3.0.0/24
      Action	Permit

   3. Configure a security policy to allow users to access the server cluster.

      Name	policy_sec_03
      Source Zone	trust
      Destination Zone	dmz
      Source Address	10.3.0.0/24
      Action	Permit

3. On a FW, choose Object > Authentication Server > AD, click Add to set the parameters for communication with an AD server.

   

   The parameter settings on the FW must be consistent with those on the AD server.

   

   

   For the V600R007C20 version, whether to enable SSL for AD authentication cannot be configured on the web UI. When you configure the AD server on the web UI, SSL (ldap-over-ssl) is enabled by default. In this mode, LDAP over SSL must also be enabled on the AD server. For details, see the operating system guide of the AD server. To disable SSL (no-ssl), click CLI Console in the lower right corner of the web page. On the CLI configuration page that is displayed, run the ad-server authentication 10.3.0.251 88 no-ssl command in the corresponding AD server template view. The following uses no-ssl as an example.

   Click Detect. In the dialog box that is displayed, click OK and enter the user name and password that are configured on the AD server. Click Start Checking to check the connectivity to the AD server.

   If you are unfamiliar with the AD server and cannot provide the server name or Base DN values, you can use the AD Explorer software downloaded from Internet to connect to the AD server to query the attribute values. The mappings between the server attributes and parameters on the FW are as follows.

   

4. On a FW, choose Object > User > Authentication Domain, click Add to create an authentication domain.

   

5. On a FW, choose Object > User > User Import > Server Import, click Add to configure a policy to import user information from the AD server to the FW.

   

   

   • If the server has many users or user groups, some users or user groups under the basedn may not be imported to the FW because the number of users or user groups exceeds the FW's specification. Therefore, you are advised to click Select on the right of Server Import Location to select an import range.

   • In this example, users and user groups are imported to the FW. The user and user group filtering conditions in this example use the default values (&(|(objectclass=person)(objectclass=organizationalPerson))(cn=*)(!(objectclass=computer))) and (|(objectclass=organizationalUnit)(ou=*)).

6. Choose Object > User > cce.com, configure AD SSO and click Apply.

   Click Configure on the right of Server Import Policy. A dialog box is displayed. Click Import Immediately corresponding to policy_import. After the import is complete, the user groups and users on the AD server are displayed in User/User Group/Security Group Management List.

   

7. Choose Object > User > Authentication Policy, click Add to create an authentication policy.

   Name	auth_policy_service
   Source Zone	Trust
   Source Address/Region	10.3.0.0/24
   Action	Authentication exemption

   

   If the action of the authentication policy is set to authentication exemption, the FW obtains user information through SSO and permits the traffic when user information fails to be obtained during SSO authentication. If the network has high security requirements, set the action of the authentication policy to portal authentication. Then the FW will implement portal authentication on the users failing the SSO authentication.

   If the packets exchanged between the user and the AD server, between the user and the AD monitor, and between the AD monitor and the AD server pass through the FW, ensure that the authentication policy on the FW does not authenticate these packets and the security policy allows them through. You can choose Object > User > Authentication Policy to check the authentication policy.

8. Choose Object > User > Authentication Option, set the online user timeout duration to 480 minutes.
9. Visit Huawei technical support website, download the AD SSO program to your PC, decompress the program package, and copy ADSSO_Setup.exe to the AD monitor.
10. Deploy the AD SSO service on the AD monitor.

    You must use an account that belongs to the Administrators group to log in to the AD monitor.

    1. Double-click ADSSO_Setup.exe. In the dialog box that is displayed, select English as the installation wizard language and click OK. The installation wizard is then displayed in English.
    2. Click Next and specify an installation directory, click Install.
    3. Start the ADSSO Agent program.
    4. Configure AD SSO parameters.

       

       1. Configure the parameters for the AD SSO program to receive messages from PCs and the shared key used by the AD SSO program to communicate with the FW.

          

          When an AD SSO service program monitors login messages of multiple AD servers in a domain forest, set Anti-replay Time to 0 and disable the anti-replay function. The anti-replay function detects the difference between the time at which the AD SSO service program receives a user login message and the time at which the user actually logs in to the AD server. If the time difference exceeds the anti-replay time, the user is prohibited from logging in to the FW. In a scenario where multiple AD servers exist, different users are authenticated by various AD servers. The AD SSO program will connect to multiple AD servers in turn to obtain user login time. This causes the time difference to exceed Anti-replay Time. Therefore, you shall disable the anti-replay function.

          Make sure that the port (port 12345 in this example) you intend to use is not occupied by other services. Choose Start > Run on the AD domain controller, enter cmd, and run netstat -ano|findstr 12345. If no information is returned, port 12345 is not occupied by other services. Otherwise, the system displays a message indicating the process ID of the service occupying the port. You are advised to release this port or specify another idle port for the AD SSO service.

       2. Add AD servers.

          The AD SSO program supports a maximum of 16 AD servers. It can connect to multiple AD servers to query login user information until it queries required information.

       3. Add FWs.

          The SSO program supports a maximum of five FWs and sends user login/logout messages to the FWs.

          

          When the FWs work in hot standby scenarios, you need to set Device Address to the virtual IP address of the VRRP group where the interfaces reside, so that the SSO service can send user login messages to the standby device during an active/standby FW switchover.

       4. Start the SSO service.

          You can right-click the AD SSO icon in the system tray on your desktop to start or stop the AD SSO service. Alternatively, click Show Log on the home page to view program operating logs and SSO service logs.

          You can also set the encoding style of the AD SSO program on the web UI. Ensure that the AD SSO program and the FW have the same encoding style. The default encoding style of the FW is GBK. If you have switched the encoding style to UTF-8, set the encoding style to UTF-8 here. Otherwise, keep the default setting.

11. On the AD domain controller, add script ReportLogin.exe to the logon script (Logon.exe) and logoff script (Logoff.exe) respectively, and set the parameters of the logon and logoff scripts so that the AD SSO service can monitor the logon and logoff operations of domain users. You can obtain script file ReportLogin.exe from the Script folder in the installation directory of the AD SSO on the AD monitor.
    

    You must use an account that belongs to the Administrators group to log in to the AD domain controller. In this example, the Windows Server 2003 and Windows 2008 Server are used as an AD domain controller.

    1. Access the group policy management page and locate logon and logoff scripts. The steps for accessing the group policy management page and the paths of logon and logoff scripts differ on Windows 2003 Server, Windows 2008 Server and Windows 2012 Server. Details are as follows:

       Windows 2003 Server

       1. Choose Start > All Programs > Administrator Tools > Active Directory Users and Computers. Then run the Active Directory Users and Computers tool.

       2. Right-click the domain (cce.com as an example) that requires SSO and select ProPerties. In the dialog box that is displayed, click the Group Policy tab.

       3. Double-click Default Domain Policy to open the domain policy configuration window.

       4. Choose User Configuration > Windows Settings > Scripts(Logon/Logoff),.

       Windows 2008 Server and Windows 2012 Server

       1. Choose Start > Administrative Tools > Group Policy Management.

       2. Right-click Default Domain Policy under the domain to which SSO authentication is to be applied, and choose Edit.

       3. Choose User Configuration > Policies > Windows Settings > Scripts (Logon/Logoff).

    2. Double-click Logon to access the login script configuration window.
    3. In the login script configuration window, click ShowFiles... and copy ReportLogin.exe to the directory that is displayed. Then close the directory.
    4. In the login script configuration window, click Add, add login script ReportLogin.exe, and set the script parameters, as shown in Table 1. Then click OK.

       When adding the user login script, click Browse and select ReportLogin.exe in the directory displayed in 11.c.

       Table 1 script parameters

       Script Name

       Script Parameters

       ReportLogin.exe

       10.3.0.254 12345 0 3 Admin@123 NOTE: The parameters are separated by spaces. In the example, the IP address of the AD SSO service is the IP address (10.3.0.254) of the AD monitor. The service port must the same as the Port value specified in 10 when you install ADSSO_Setup.exe. The port number in this example is 12345. 0 indicates a login script. To configure a logout script, set this parameter to 1. 3 indicates maximum number of allowed retransmissions. The client shared key must the same as the Client Key value specified in 10 when you install ADSSO_Setup.exe. The Password in this example is Admin@123.

    5. Configure the logout script by referring to steps 11.b and 11.d. The login and logout scripts are both ReportLogin.exe but are saved in different folders.
    6. Choose Start > Run, enter cmd to open the CLI, and run gpupdate to apply the policy.
12. After the configuration is complete, you can configure security policies, PBR policies, bandwidth policies, quota control policies, proxy policies, and audit policies that reference the user and user group objects.