Web: Example for Configuring AD SSO for Internet Access Users (Install ADSSO_Setup.exe to query AD server security logs)

Procedure

1. Choose Network > Interface, set IP addresses for interfaces and assign the interfaces to security zones.

   The following example describes how to configure interface GigabitEthernet 0/0/3. You can configure other interfaces based on the networking diagram.

   Zone	trust
   IP Address	10.3.0.1/24

2. Choose Policy > Security Policy > Security Policy, click Add to configure security policies.
   1. Configure security policies between the Trust (AD server and AD monitor) and Local zone to ensure the communication among the FW and AD server.

      Name	local_policy_ad_01
      Source Zone	local
      Destination Zone	trust
      Destination Address	10.3.0.251/32,10.3.0.254/32
      Action	Permit

      Name	local_policy_ad_02
      Source Zone	trust
      Destination Zone	local
      Source Address	10.3.0.251/32,10.3.0.254/32
      Action	Permit

      

      If the traffic from the AD monitor to the AD server passes through the device, you need to configure a security policy on the device to allow the AD monitor to access the AD server.

   2. Configure a security policy to allow users to access the Internet.

      Name	policy_sec_02
      Source Zone	trust
      Destination Zone	untrust
      Source Address	10.3.0.0/24
      Action	Permit

   3. Configure a security policy to allow users to access the server cluster.

      Name	policy_sec_03
      Source Zone	trust
      Destination Zone	dmz
      Source Address	10.3.0.0/24
      Action	Permit

3. On a FW, choose Object > Authentication Server > AD, click Add to set the parameters for communication with an AD server.

   

   The parameter settings on the FW must be consistent with those on the AD server.

   

   

   For the V600R007C20 version, whether to enable SSL for AD authentication cannot be configured on the web UI. When you configure the AD server on the web UI, SSL (ldap-over-ssl) is enabled by default. In this mode, LDAP over SSL must also be enabled on the AD server. For details, see the operating system guide of the AD server. To disable SSL (no-ssl), click CLI Console in the lower right corner of the web page. On the CLI configuration page that is displayed, run the ad-server authentication 10.3.0.251 88 no-ssl command in the corresponding AD server template view. The following uses no-ssl as an example.

   Click Detect. In the dialog box that is displayed, click OK and enter the user name and password that are configured on the AD server. Click Start Checking to check the connectivity to the AD server.

   If you are unfamiliar with the AD server and cannot provide the server name or Base DN values, you can use the AD Explorer software downloaded from Internet to connect to the AD server to query the attribute values. The mappings between the server attributes and parameters on the FW are as follows.

   

4. On a FW, choose Object > User > Authentication Domain, click Add to create an authentication domain.

   In this example, the user authentication domain of the AD server is cce.com. Therefore, you need to create the authentication domain cce.com on the FW and perform related configurations in the authentication domain. Do not perform the configuration in the default domain.

   

5. On a FW, choose Object > User > User Import > Server Import, click Add to configure a policy to import user information from the AD server to the FW.

   

   

   • If the server has many users or user groups, some users or user groups under the basedn may not be imported to the FW because the number of users or user groups exceeds the FW's specification. Therefore, you are advised to click Select on the right of Server Import Location to select an import range.

   • In this example, users and user groups are imported to the FW. The user and user group filtering conditions in this example use the default values (&(|(objectclass=person)(objectclass=organizationalPerson))(cn=*)(!(objectclass=computer))) and (|(objectclass=organizationalUnit)(ou=*)).

6. Choose Object > User > cce.com, configure AD SSO and click Apply.

   Click Configure on the right of Server Import Policy. A dialog box is displayed. Click Import Immediately corresponding to policy_import. After the import is complete, the user groups and users on the AD server are displayed in User/User Group/Security Group Management List.

   

7. Choose Object > User > Authentication Policy, click Add to create an authentication policy.

   Name	auth_policy_service
   Source Zone	Trust
   Source Address/Region	10.3.0.0/24
   Action	Authentication exemption

   

   If the action of the authentication policy is set to authentication exemption, the FW obtains user information through SSO and permits the traffic when user information fails to be obtained during SSO authentication. If the network has high security requirements, set the action of the authentication policy to portal authentication. Then the FW will implement portal authentication on the users failing the SSO authentication.

   If the packets exchanged between the user and the AD server, between the user and the AD monitor, and between the AD monitor and the AD server pass through the FW, ensure that the authentication policy on the FW does not authenticate these packets and the security policy allows them through. You can choose Object > User > Authentication Policy to check the authentication policy.

8. Choose Object > User > Authentication Option, set the online user timeout duration to 480 minutes.
9. Visit Huawei technical support website , download the AD SSO program to your PC, decompress the program package, and copy ADSSO_Setup.exe to the AD monitor.
10. Deploy the AD SSO service on the AD monitor.

    You must use an account that belongs to the Administrators group to log in to the AD monitor.

    1. Double-click ADSSO_Setup.exe. In the dialog box that is displayed, select English as the installation wizard language and click OK. The installation wizard is then displayed in English.
    2. Click Next and specify an installation directory, click Install.
    3. Start the ADSSO Agent program.
    4. Configure AD SSO parameters.

       

       1. Set the interval for querying logs and the shared key used by the AD SSO program to communicate with the FW.

       2. Add AD servers.

          When multiple AD servers are deployed to form a domain forest, the AD SSO program supports a maximum of 16 AD servers and queries user login logs from these AD servers.

          After the AD SSO program is started, a service process is started for each AD server. The startup time of the AD SSO program is the start time. That is, each service process uses its startup time as the start time. Each service process queries the user login logs generated on the AD server at the configured interval.

          The time for the AD SSO service program to start each service process is different (there is a short interval between them). In this case, each service process queries the user login logs on the AD server at different time (there is a short interval). This ensures the efficiency of querying user login logs.

       3. Add FWs.

          The SSO program supports a maximum of five FWs and sends user login messages to the FWs.

          

          When the FWs work in hot standby scenarios, you need to set Device Address to the virtual IP address of the VRRP group where the interfaces reside, so that the SSO service can send user login messages to the standby device during an active/standby FW switchover.

       4. Start the SSO service.

          You can right-click the AD SSO icon in the system tray on your desktop to start or stop the AD SSO service. Alternatively, click Show Log on the home page to view program operating logs and SSO service logs.

          You can also set the encoding style of the AD SSO program on the web UI. Ensure that the AD SSO program and the FW have the same encoding style. The default encoding style of the FW is GBK. If you have switched the encoding style to UTF-8, set the encoding style to UTF-8 here. Otherwise, keep the default setting.

11. Configure the AD domain controller.
    1. Ensure that the Windows Management Instrumentation (WMI) and Remote Procedure Call (RPC) services have been enabled on the AD controller.
    2. During the group policy configuration, enable Audit logon events and Audit account logon events so that the AD domain controller can record user login security logs.
       

       You must use an account that belongs to the Administrators group to log in to the AD domain controller. In this example, the Windows 2003 Server, Windows 2008 Server and Windows 2012 Server are used as an AD domain controller.

       Windows 2003 Server

       1. Choose Start > All Programs > Administrator Tools > Active Directory Users and Computers. Then run the Active Directory Users and Computers tool.

       2. Right-click the domain (cce.com as an example) that requires SSO and select ProPerties. In the dialog box that is displayed, click the Group Policy tab.

       3. Double-click Default Domain Policy to open the domain policy configuration window.

       4. Choose Computer Configuration > Windows Settings > Security Settings > Local Policies > Audit Policy, double-click Audit logon events and Audit account logon events respectively to enable the login audit function.

       5. Choose Start > Run, enter cmd to open the CLI, and run gpupdate to apply the policy.

       Windows 2008 Server and Windows 2012 Server

       1. Choose Start > Administrative Tools > Group Policy Management.

       2. Right-click Default Domain Policy under the domain to which SSO authentication is to be applied, and choose Edit.

       3. On the domain policy configuration page, double-click Audit logon events and Audit account logon events respectively to enable the login audit function.

       4. Choose Start > Run, enter cmd to open the CLI, and run gpupdate to apply the policy.

12. After the configuration is complete, you can configure security policies, PBR policies, bandwidth policies, quota control policies, proxy policies, and audit policies that reference the user and user group objects.