CLI: Example for Configuring AD SSO for Internet Access Users (Install ADSSO_Setup.exe to receive messages from PCs)

Procedure

1. Set IP addresses for interfaces and assign the interfaces to security zones. The following example describes how to configure interface GigabitEthernet 0/0/3. You can configure other interfaces based on the networking diagram.

   <FW> system-view
   [FW] interface GigabitEthernet 0/0/3
   [FW-GigabitEthernet0/0/3] ip address 10.3.0.1 24
   [FW-GigabitEthernet0/0/3] quit
   [FW] firewall zone trust
   [FW-zone-trust] add interface GigabitEthernet 0/0/3
   [FW-zone-trust] quit

2. Configure security policies.
   1. Configure security policies between the trust (AD server and AD monitor) and local zone to ensure the communication among the FW and AD server.

      [FW] security-policy
      [FW-policy-security] rule name local_policy_ad_01
      [FW-policy-security-rule-local_policy_ad_01] source-zone local
      [FW-policy-security-rule-local_policy_ad_01] destination-zone trust
      [FW-policy-security-rule-local_policy_ad_01] destination-address 10.3.0.251 32
      [FW-policy-security-rule-local_policy_ad_01] destination-address 10.3.0.254 32
      [FW-policy-security-rule-local_policy_ad_01] action permit
      [FW-policy-security-rule-local_policy_ad_01] quit
      [FW-policy-security] rule name local_policy_ad_02
      [FW-policy-security-rule-local_policy_ad_02] source-zone trust
      [FW-policy-security-rule-local_policy_ad_02] destination-zone local
      [FW-policy-security-rule-local_policy_ad_02] source-address 10.3.0.251 32
      [FW-policy-security-rule-local_policy_ad_02] source-address 10.3.0.254 32
      [FW-policy-security-rule-local_policy_ad_02] action permit
      [FW-policy-security-rule-local_policy_ad_02] quit

   2. Configure a security policy to allow users to access the Internet.

      [FW-policy-security] rule name policy_sec_02
      [FW-policy-security-rule-policy_sec_02] source-zone trust
      [FW-policy-security-rule-policy_sec_02] source-address 10.3.0.0 24
      [FW-policy-security-rule-policy_sec_02] destination-zone untrust
      [FW-policy-security-rule-policy_sec_02] action permit
      [FW-policy-security-rule-policy_sec_02] quit

   3. Configure a security policy to allow users to access the server cluster.

      [FW-policy-security] rule name policy_sec_03
      [FW-policy-security-rule-policy_sec_03] source-zone trust
      [FW-policy-security-rule-policy_sec_03] source-address 10.3.0.0 24
      [FW-policy-security-rule-policy_sec_03] destination-zone dmz
      [FW-policy-security-rule-policy_sec_03] action permit
      [FW-policy-security-rule-policy_sec_03] quit
      [FW-policy-security] quit

3. On a FW, set the parameters for communication with an AD server.

   The parameter settings on the FW must be consistent with those on the AD server.

   [FW] ad-server template auth_server_ad             
   [FW-ad-auth_server_ad] ad-server authentication 10.3.0.251 88 no-ssl       
   [FW-ad-auth_server_ad] ad-server authentication base-dn dc=cce,dc=com
   [FW-ad-auth_server_ad] ad-server authentication manager cn=administrator,cn=users Admin@123
   [FW-ad-auth_server_ad] ad-server authentication host-name ad.cce.com
   [FW-ad-auth_server_ad] ad-server authentication ldap-port 389      
   [FW-ad-auth_server_ad] ad-server user-filter sAMAccountName         
   [FW-ad-auth_server_ad] ad-server group-filter ou

   If you are unfamiliar with the AD server and cannot provide the server name or Base DN values, you can use the AD Explorer software downloaded from Internet to connect to the AD server to query the attribute values. The mappings between the server attributes and parameters on the FW are as follows.

   

   Use the user name and password that are configured on the AD server to check the connectivity to the AD server.

   [FW-ad-auth_server_ad] test-aaa testname testpassword ad-template auth_server_ad
   [FW-ad-auth_server_ad] quit

4. Configure an authentication domain.

   [FW] aaa
   [FW-aaa] domain cce.com
   [FW-aaa-domain-cce.com] service-type internetaccess
   [FW-aaa-domain-cce.com] quit
   [FW-aaa] quit

5. Configure a policy to import user information from the AD server to the FW.

   [FW] user-manage import-policy policy_import from ad 
   [FW-import-policy_import] server template auth_server_ad
   [FW-import-policy_import] server basedn dc=cce,dc=com
   [FW-import-policy_import] server searchdn ou=marketing,dc=cce,dc=com
   [FW-import-policy_import] server searchdn ou=research,dc=cce,dc=com
   [FW-import-policy_import] destination-group /cce.com
   [FW-import-policy_import] import-type user-group         
   [FW-import-policy_import] import-override enable 
   [FW-import-policy_import] sync-mode incremental schedule interval 120
   [FW-import-policy_import] quit

   

   • If the server has many users or user groups, some users or user groups under the basedn may not be imported to the FW because the number of users or user groups exceeds the FW's specification. Therefore, you are advised to run the command server searchdn to select an import range.

   • In this example, users and user groups are imported to the FW. The user and user group filtering conditions in this example use the default values (&(|(objectclass=person)(objectclass=organizationalPerson))(cn=*)(!(objectclass=computer))) and (|(objectclass=organizationalUnit)(ou=*)). To change them, run the user-filter and group-filter commands.

6. Execute the import policy to import users to the FW.

   [FW] execute user-manage import-policy policy_import

7. Set the new user option for the authentication domain on the FW.

   [FW] aaa
   [FW-aaa] domain cce.com
   [FW-aaa-domain-cce.com] new-user add-temporary group /cce.com auto-import policy_import
   [FW-aaa-domain-cce.com] quit
   [FW-aaa] quit

8. Configure an authentication policy.

   [FW] auth-policy
   [FW-policy-auth] rule name auth_policy_service
   [FW-policy-auth-rule-auth_policy_service] source-zone trust
   [FW-policy-auth-rule-auth_policy_service] source-address 10.3.0.0 24
   [FW-policy-auth-rule-auth_policy_service] action exempt-auth
   [FW-policy-auth-rule-auth_policy_service] quit
   [FW-policy-auth] quit

   

   If the action of the authentication policy is set to authentication exemption, the FW obtains user information through SSO and permits the traffic when user information fails to be obtained during SSO authentication. If the network has high security requirements, set the action of the authentication policy to portal authentication. Then the FW will implement portal authentication on the users failing the SSO authentication.

   If the packets exchanged between the user and the AD server, between the user and the AD monitor, and between the AD monitor and the AD server pass through the FW, ensure that the authentication policy on the FW does not authenticate these packets and the security policy allows them through. You can run the display auth-policy command to check the authentication policy.

9. Set AD SSO parameters on the FW.

   [FW] user-manage single-sign-on ad
   [FW-sso-ad] plug-in enhanced shared-key Admin@234
   [FW-sso-ad] mode plug-in
   [FW-sso-ad] enable
   [FW-sso-ad] quit

10. Set the online user timeout duration to 480 minutes.

    [FW] user-manage online-user aging-time 480

11. Visit Huawei technical support website, download the AD SSO program to your PC, decompress the program package, and copy ADSSO_Setup.exe to the AD monitor.
12. Deploy the AD SSO service on the AD monitor.

    You must use an account that belongs to the Administrators group to log in to the AD monitor.

    1. Double-click ADSSO_Setup.exe. In the dialog box that is displayed, select English as the installation wizard language and click OK. The installation wizard is then displayed in English.
    2. Click Next and specify an installation directory, click Install.
    3. Start the ADSSO Agent program.
    4. Configure AD SSO parameters.

       

       1. Configure the parameters for the AD SSO program to receive messages from PCs and the shared key used by the AD SSO program to communicate with the FW.

          

          When an AD SSO service program monitors login messages of multiple AD servers, set Anti-replay Time to 0 and disable the anti-replay function. The anti-replay function detects the difference between the time at which the AD SSO service program receives a user login message and the time at which the user actually logs in to the AD server. If the time difference exceeds the anti-replay time, the user is prohibited from logging in to the FW. In a scenario where multiple AD servers exist, different users are authenticated by various AD servers. The AD SSO program will connect to multiple AD servers in turn to obtain user login time. This causes the time difference to exceed Anti-replay Time. Therefore, you shall disable the anti-replay function.

          Make sure that the port (port 12345 in this example) you intend to use is not occupied by other services. Choose Start > Run on the AD domain controller, enter cmd, and run netstat -ano|findstr 12345. If no information is returned, port 12345 is not occupied by other services. Otherwise, the system displays a message indicating the process ID of the service occupying the port. You are advised to release this port or specify another idle port for the AD SSO service.

       2. Add AD servers.

          The AD SSO program supports a maximum of 16 AD servers. It can connect to multiple AD servers to query login user information until it queries required information.

       3. Add FWs.

          The SSO program supports a maximum of five FWs and sends user login/logout messages to the FWs.

          

          When the FWs work in hot standby scenarios, you need to set Device Address to the virtual IP address of the VRRP group where the interfaces reside, so that the SSO service can send user login messages to the standby device during an active/standby FW switchover.

       4. Start the SSO service.

          You can right-click the AD SSO icon in the system tray on your desktop to start or stop the AD SSO service. Alternatively, click Show Log on the home page to view program operating logs and SSO service logs.

          You can also set the encoding style of the AD SSO program on the web UI. Ensure that the AD SSO program and the FW have the same encoding style. The default encoding style of the FW is GBK. If you have switched the encoding style to UTF-8, set the encoding style to UTF-8 here. Otherwise, keep the default setting.

13. On the AD domain controller, add script ReportLogin.exe to the logon script (Logon.exe) and logoff script (Logoff.exe) respectively, and set the parameters of the logon and logoff scripts so that the AD SSO service can monitor the logon and logoff operations of domain users. You can obtain script file ReportLogin.exe from the Script folder in the installation directory of the AD SSO on the AD monitor.
    

    You must use an account that belongs to the Administrators group to log in to the AD domain controller. In this example, the Windows Server 2003 and Windows Server 2008 are used as an AD domain controller.

    1. Access the group policy management page and locate logon and logoff scripts. The steps for accessing the group policy management page and the paths of logon and logoff scripts differ on Windows 2003 Server, Windows Server 2008 and Windows Server 2012. Details are as follows:

       Windows 2003 Server

       1. Choose Start > All Programs > Administrator Tools > Active Directory Users and Computers. Then run the Active Directory Users and Computers tool.

       2. Right-click the domain (cce.com as an example) that requires SSO and select ProPerties. In the dialog box that is displayed, click the Group Policy tab.

       3. Double-click Default Domain Policy to open the domain policy configuration window.

       4. Choose User Configuration > Windows Settings > Scripts(Logon/Logoff).

       Windows Server 2008 and Windows Server 2012

       1. Choose Start > Administrative Tools > Group Policy Management.

       2. Right-click Default Domain Policy under the domain to which SSO authentication is to be applied, and choose Edit.

       3. Choose User Configuration > Policies > Windows Settings > Scripts (Logon/Logoff).

    2. Double-click Logon to access the login script configuration window.
       Figure 2 Login script configuration window
       

    3. In the login script configuration window, click ShowFiles... and copy ReportLogin.exe to the directory that is displayed. Then close the directory.
    4. In the login script configuration window, click Add, add login script ReportLogin.exe, and set the script parameters, as shown in Table 1. Then click OK.

       When adding the user login script, click Browse and select ReportLogin.exe in the directory displayed in 13.c.

       Table 1 script parameters

       Script Name

       Script Parameters

       ReportLogin.exe

       10.3.0.254 12345 0 3 Admin@123 NOTE: The parameters are separated by spaces. In the example, the IP address of the AD SSO service is the IP address (10.3.0.254) of the AD monitor. The service port must the same as the Port value specified in 12 when you install ADSSO_Setup.exe. The port number in this example is 12345. 0 indicates a login script. To configure a logout script, set this parameter to 1. 3 indicates maximum number of allowed retransmissions. The client shared key must the same as the Client Key value specified in 12 when you install ADSSO_Setup.exe. The Password in this example is Admin@123.

    5. Configure the logout script by referring to steps 13.b and 13.d. The login and logout scripts are both ReportLogin.exe but are saved in different folders.
    6. Choose Start > Run, enter cmd to open the CLI, and run gpupdate to apply the policy.
14. After the configuration is complete, you can configure security policies, PBR policies, bandwidth policies, quota control policies, proxy policies, and audit policies that reference the user and user group objects.