Web: Example for Enabling Remote Users to Access the Headquarters through SSL VPN (RADIUS Two-Factor Authentication + Local Authorization)

Procedure

1. Configure interfaces.
   1. Choose Network > Interface.
   2. Click of GE0/0/1 and set the following parameters:

      Zone	untrust
      IPv4
      IP Address	1.1.1.1/24
      Default Gateway	1.1.1.2

   3. Click OK.
   4. Repeat the preceding steps to configure GE0/0/2.

      Zone	trust
      IPv4
      IP Address	10.2.0.1/16

2. Configure security policies to allow users to use SSL VPN services.
   1. Choose Policy > Security Policy > Security Policy.
   2. Click Add.
   3. Configure security policy policy_sslvpn_1 and set the parameters as follows:

      Name	policy_sslvpn_1
      Source Zone	untrust
      Destination Zone	local
      Destination Address	1.1.1.1/32
      Service	https
      Action	Permit

   4. Click OK.
   5. Repeat the preceding steps to configure security policy policy_sslvpn_2 as follows:

      Name	policy_sslvpn_2
      Source Zone	local
      Destination Zone	trust
      Destination Address	10.2.0.10/32,10.2.0.11/32
      Action	Permit

   6. Repeat the preceding steps to configure security policy policy_sslvpn_3 as follows:

      Name	policy_sslvpn_3
      Source Zone	untrust
      Destination Zone	trust
      Source Address	172.16.1.1-172.16.1.100
      Destination Address	10.2.0.0/16
      Action	Permit

   7. Repeat the preceding steps to configure security policy policy_radius_server as follows:

      Name	policy_radius_server
      Source Zone	local
      Destination Zone	trust
      Destination Address	10.2.0.155/32
      Action	Permit

3. Choose Object > Authentication Server > RADIUS and set parameters for interconnection between the FW and RADIUS server.

   

   

   If the RADIUS server does not support user names in Login Name@Authentication Domain format, you cannot select Include Authentication Domain for User Name Format. Otherwise, the authentication fails.

   

   Click Test. In the dialog box that is displayed, click OK and enter the user name and password. Click Start to check the connectivity to the RADIUS server.

   

   The user name and password for testing server connectivity can be different from those specified on the server. The user name can be any user name, and the password cannot contain any space, question mark (?), or double quotation mark (").

   

4. Choose Object > User > Authentication Domain, configure an authentication domain.

   

5. Import users and user groups from a CSV file.
   1. Choose Object > User > User Import.
   2. In Local Import, click Download CSV Template and download the CSV template to your PC.

      

   3. Write user information on the RADIUS server into a CSV file according to the template.

      Read the instructions on the CSV template and fill in user information. The following figure shows a complete CSV file.

      

      

      The first level of the "group path" in the CSV file is the authentication domain name. Therefore, the "login name" does not contain "@domain-name." In this example, the user name on the RADIUS server is user0002@sslvpn. Therefore, the group path is /sslvpn and the login name is user0002 in the CSV file.

   4. Click Browse, select the edited CSV file, click Open, and set the following parameters.

      

   5. Click Start Import.

      After the import succeeds, you can view information about the imported users and user groups on the FW.

6. Configure an SSL VPN gateway, including the gateway address, user authentication, and maximum number of concurrent users.
   1. Choose Network > SSL VPN > SSL VPN.
   2. Click the Add, configure an SSL VPN gateway and set the parameters as follows.

      

      

      

      If the virtual gateway is bound to an authentication domain, the user name entered for a login should not carry the authentication domain information. If the user name carries an authentication domain name, the gateway considers the string following the at sign (@) as a part of the user name, not an authentication domain name. For example, if the virtual gateway has been bound to the authentication domain sslvpn, you should enter user0001, not user0001@sslvpn, as the user name.

   3. Click Next.
7. Configure the SSL version, SSL encryption suite, and timeout duration and life cycle of SSL sessions on the device. The configuration is optional. You can use the default values.
   1. Set the following parameters. In the example, use the default algorithms.
   2. Click Next.
8. Select the services to be enabled.
   1. Select Web Proxy and Network Extension.

      

   2. Click Next.
9. Configure the network extension function.
   1. Set the Available IP Address Range and Accessible Private Network Segment List to the network extension function as follows:

      

   2. Click Next.
10. Configure the web proxy function and add resources Webmail and ERP.
    1. In Web Proxy Resource List, click Add.

       

    2. Add web proxy resource Webmail as follows:

       

    3. Click OK.
    4. Repeat the preceding steps to add web proxy resource ERP as follows:

       

    5. Click OK.
    6. Click Next.
11. Configure SSL VPN role authorization/users.
    1. Under List of Authorized Roles, click Add.

       

    2. Add director user group to a role and associate corresponding permissions.

       

    3. Click OK.
    4. Add employee user group to a role and associate corresponding permissions.

       

    5. Click OK.
    6. Click Finish.