CLI: Example for Configuring AD SSO for Internet Access Users (Multiple AD Servers + ADSSO_Setup.exe)

Procedure

1. Configure IP addresses for interfaces and assign the interfaces to security zones. The following example describes how to configure GigabitEthernet 0/0/3. You can configure other interfaces based on the networking diagram.

   <FW> system-view
   [FW] interface GigabitEthernet 0/0/3
   [FW-GigabitEthernet0/0/3] ip address 10.3.0.1 24
   [FW-GigabitEthernet0/0/3] quit
   [FW] firewall zone trust
   [FW-zone-trust] add interface GigabitEthernet 0/0/3
   [FW-zone-trust] quit

2. Configure security policies.
   1. # Configure an interzone policy from the Trust zone where the AD server resides to the Local zone where the AD monitor resides so that the FW can properly communicate with the AD server and AD monitor.

      [FW] security-policy
      [FW-policy-security] rule name local_policy_ad_01
      [FW-policy-security-rule-local_policy_ad_01] source-zone local
      [FW-policy-security-rule-local_policy_ad_01] destination-zone trust
      [FW-policy-security-rule-local_policy_ad_01] destination-address 10.3.0.0 24
      [FW-policy-security-rule-local_policy_ad_01] action permit
      [FW-policy-security-rule-local_policy_ad_01] quit
      [FW-policy-security] rule name local_policy_ad_02
      [FW-policy-security-rule-local_policy_ad_02] source-zone trust
      [FW-policy-security-rule-local_policy_ad_02] destination-zone local
      [FW-policy-security-rule-local_policy_ad_02] source-address 10.3.0.0 24
      [FW-policy-security-rule-local_policy_ad_02] action permit
      [FW-policy-security-rule-local_policy_ad_02] quit

   2. Configure a security policy to allow users to access the server cluster.

      [FW-policy-security] rule name policy_sec_03
      [FW-policy-security-rule-policy_sec_03] source-zone trust
      [FW-policy-security-rule-policy_sec_03] source-address 10.3.0.0 24
      [FW-policy-security-rule-policy_sec_03] destination-zone dmz
      [FW-policy-security-rule-policy_sec_03] action permit
      [FW-policy-security-rule-policy_sec_03] quit
      [FW-policy-security] quit

3. Set AD server parameters on the FW.

   The parameters set here must be consistent with those set on the AD server.

   [FW] ad-server template auth_server_ad             
   [FW-ad-auth_server_ad] ad-server authentication 10.3.0.251 88 no-ssl       
   [FW-ad-auth_server_ad] ad-server authentication base-dn dc=cce,dc=com
   [FW-ad-auth_server_ad] ad-server authentication manager cn=administrator,cn=users Admin@123
   [FW-ad-auth_server_ad] ad-server authentication host-name ad.cce.com
   [FW-ad-auth_server_ad] ad-server authentication ldap-port 389      
   [FW-ad-auth_server_ad] ad-server user-filter sAMAccountName         
   [FW-ad-auth_server_ad] ad-server group-filter ou

   If you are unfamiliar with the AD server and cannot provide the server name or Base DN, use the AD Explorer software to connect to the AD server to query the attribute values. The AD server attributes and mappings between the server attributes and parameters on the FW are as follows.

   

   Use an existing AD server account and password to test the connectivity.

   [FW-ad-auth_server_ad] test-aaa testname testpassword ad-template auth_server_ad
   [FW-ad-auth_server_ad] quit

4. Configure an authentication domain on the FW.

   [FW] aaa
   [FW-aaa] domain cce.com
   [FW-aaa-domain-cce.com] service-type internetaccess
   [FW-aaa-domain-cce.com] quit
   [FW-aaa] quit

5. Configure a server import policy on the FW.

   [FW] user-manage import-policy policy_import from ad 
   [FW-import-policy_import] server template auth_server_ad
   [FW-import-policy_import] server basedn dc=cce,dc=com
   [FW-import-policy_import] server searchdn ou=marketing,dc=cce,dc=com
   [FW-import-policy_import] server searchdn ou=research,dc=cce,dc=com
   [FW-import-policy_import] destination-group /cce.com
   [FW-import-policy_import] import-type user-group         
   [FW-import-policy_import] import-override enable 
   [FW-import-policy_import] sync-mode incremental schedule interval 120
   [FW-import-policy_import] quit

   

   In this example, users and user groups are imported to the FW. The user and user group filtering conditions in this example use the default values (&(|(objectclass=person)(objectclass=organizationalPerson))(cn=*)(!(objectclass=computer))) and (|(objectclass=organizationalUnit)(ou=*)). To change them, run the user-filter and group-filter commands.

6. Apply the import policy to import users/user groups to the FW.

   [FW] execute user-manage import-policy policy_import

7. # On the FW, configure the new user option of the authentication domain.

   [FW] aaa
   [FW-aaa] domain cce.com
   [FW-aaa-domain-cce.com] new-user add-temporary group /cce.com auto-import policy_import
   [FW-aaa-domain-cce.com] quit
   [FW-aaa] quit

8. Configure an authentication policy.

   [FW] auth-policy
   [FW-policy-auth] rule name auth_policy_service
   [FW-policy-auth-rule-auth_policy_service] source-zone trust
   [FW-policy-auth-rule-auth_policy_service] source-address 10.3.0.0 24
   [FW-policy-auth-rule-auth_policy_service] action exempt-auth
   [FW-policy-auth-rule-auth_policy_service] quit
   [FW-policy-auth] quit

   

   If the action of the authentication policy is set to authentication exemption, the FW obtains user information through SSO and permits the traffic when user information fails to be obtained during SSO authentication. If the network has high security requirements, set the action of the authentication policy to portal authentication. Then the FW will implement portal authentication on the users failing the SSO authentication.

   If the packets exchanged between the user and the AD server, between the user and the AD monitor, and between the AD monitor and the AD server pass through the FW, ensure that the authentication policy on the FW does not authenticate these packets and the security policy allows them through. You can run the display auth-policy command to check the authentication policy.

9. Configure AD SSO parameters on the FW.

   [FW] user-manage single-sign-on ad
   [FW-sso-ad] plug-in enhanced shared-key Admin@234
   [FW-sso-ad] mode plug-in
   [FW-sso-ad] enable
   [FW-sso-ad] quit

10. Set the online user timeout duration to 480 minutes.

    [FW] user-manage online-user aging-time 480

11. Visit Huawei technical support website, download the AD SSO program to your PC, decompress the program package, and copy ADSSO_Setup.exe to the AD monitor.
12. Enable the AD SSO service on the AD monitor.
    

    When the ADs in a domain establish synchronization relationships, only one SSO service program (ADSSO_Setup.exe) needs to be deployed.

    In this example, ADSSO_Setup.exe is deployed on the AD server with IP address 10.3.0.254.

    You must use an account that belongs to the Administrators group to log in to the AD monitor (AD server with IP address 10.3.0.254 in this example) and perform the following operations:

    1. Double-click ADSSO_Setup.exe. In the dialog box that is displayed, select English as the installation wizard language and click OK. The installation wizard is then displayed in English.
    2. Click Next and specify an installation directory, click Install.
    3. Start the ADSSO Agent program.
    4. Configure AD SSO parameters.
       

       Perform step 2 in the following figure several times to add all AD servers in the domain.

       

       1. Configure the parameters for the AD SSO program to receive messages from PCs and the shared key used by the AD SSO program to communicate with the FW.

          

          In this example, one AD SSO program monitors the login messages of multiple AD servers, and therefore Anti-replay Time needs to be set to 0 to disable the anti-replay function. The anti-replay function detects the different between the time when the AD SSO service program receives a user login message and the time when the user actually logs in to the AD server. If the time difference exceeds the anti-replay time, the user is disabled from going online from the FW. In the scenario with multiple AD servers, users are authenticated by different AD servers. The AD SSO service program obtains the user login time from these AD servers one by one. In this case, the time difference exceeds the Anti-replay Time value. Therefore, the anti-replay function needs to be disabled.

          Make sure that the port (port 12345 in this example) you intend to use is not occupied by other services. Choose Start > Run on the AD domain controller, enter cmd, and run netstat -ano|findstr 12345. If no information is returned, port 12345 is not occupied by other services. Otherwise, the system displays a message indicating the process ID of the service occupying the port. You are advised to release this port or specify another idle port for the AD SSO service.

       2. Add AD servers.

          Click Add several times to add all AD servers in the domain.

          The AD SSO program supports a maximum of 16 AD servers. It can connect to multiple AD servers to query login user information until it queries required information.

       3. Add FWs.

          The SSO program supports a maximum of five FWs and sends user login/logout messages to the FWs.

          

          When the FWs work in hot standby scenarios, you need to set Device Address to the virtual IP address of the VRRP group where the interfaces reside, so that the SSO service can send user login messages to the standby device during an active/standby FW switchover.

       4. Start the SSO service.

          You can right-click the AD SSO icon in the system tray on your desktop to start or stop the AD SSO service. Alternatively, click Show Log on the home page to view program operating logs and SSO service logs.

          You can also set the encoding style of the AD SSO program on the web UI. Ensure that the AD SSO program and the FW have the same encoding style. The default encoding style of the FW is GBK. If you have switched the encoding style to UTF-8, set the encoding style to UTF-8 here. Otherwise, keep the default setting.

13. On the AD domain controller, add script ReportLogin.exe to the logon script (Logon.exe) and logoff script (Logoff.exe) respectively, and set the parameters of the logon and logoff scripts so that the AD SSO service can monitor the logon and logoff operations of domain users. You can obtain script file ReportLogin.exe from the Script folder in the installation directory of the AD SSO on the AD monitor.
    

    When the ADs in a domain establish synchronization relationships, only one set of login/logout scripts needs to be deployed on one AD server. The login/logout scripts will be automatically synchronized to other AD servers.

    You must use an account that belongs to the Administrators group to log in to the AD domain controller. In this example, the Windows Server 2003 and Windows 2008 Server are used as an AD domain controller.

    1. Access the group policy configuration page and find the login/logout script. The procedures for accessing the group policy configuration pages of Windows 2003 Server, Windows 2008 Server, and Windows 2012 Server are different, and the login/logout script paths are different on these configuration pages.

       Windows 2003 Server

       1. Choose Start > All Programs > Administrator Tools > Active Directory Users and Computers. Then run the Active Directory Users and Computers tool.

       2. Right-click the domain (cce.com as an example) that requires SSO and select ProPerties. In the dialog box that is displayed, click the Group Policy tab.

       3. Double-click Default Domain Policy to open the domain policy configuration window.

       4. Choose User Configuration > Windows Settings > Scripts(Logon/Logoff),.

       Windows 2008 Server and Windows 2012 Server

       1. Choose Start > Administrative Tools > Group Policy Management.

       2. Right-click Default Domain Policy under the domain to which SSO authentication is to be applied, and choose Edit.

       3. Choose User Configuration > Policies > Windows Settings > Scripts (Logon/Logoff).

    2. Double-click Logon to access the login script configuration window.
    3. In the login script configuration window, click ShowFiles... and copy ReportLogin.exe to the directory that is displayed. Then close the directory.
    4. In the login script configuration window, click Add, add login script ReportLogin.exe, and set the script parameters, as shown in Table 1. Then click OK.

       When adding the user login script, click Browse and select ReportLogin.exe in the directory displayed in 13.c.

       Table 1 script parameters

       Script Name

       Script Parameters

       ReportLogin.exe

       10.3.0.254 12345 0 3 Admin@123 NOTE: The parameters are separated by spaces. In the example, the IP address of the AD SSO service is the IP address (10.3.0.254) of the AD monitor. The service port must the same as the Port value specified in 12 when you install ADSSO_Setup.exe. The port number in this example is 12345. 0 indicates a login script. To configure a logout script, set this parameter to 1. 3 indicates maximum number of allowed retransmissions. The client shared key must the same as the Client Key value specified in 12 when you install ADSSO_Setup.exe. The Password in this example is Admin@123.

    5. Configure the logout script by referring to steps 13.b and 13.d. The login and logout scripts are both ReportLogin.exe but are saved in different folders.
    6. Choose Start > Run, enter cmd to open the CLI, and run gpupdate to apply the policy.
14. Reference the user groups when configuring a security policy, quota control policy, proxy policy, audit policy, PBR, and traffic policy.