D-Link 800 - DFL 800 - Security Appliance, User Manual

Page: 311 / 469

authentication:
1. A user creates a new connection to the D-Link Firewall.
2. NetDefendOS sees the new user connection on an interface and checks the Authentication rule
set to see if there is a matching rule for traffic on this interface, coming from this network and
data which is one of the following types:
• HTTP traffic
• HTTPS traffic
• IPsec tunnel traffic
• L2TP tunnel traffic
• PPTP tunnel traffic
3. If no rule matches, the connection is allowed, provided the IP rule set permits it, and nothing
further happens in the authentication process.
4. Based on the settings of the first matching authentication rule, NetDefendOS prompts the user
with an authentication request.
5. The user replies by entering their identification information which is usually a
username/password pair.
6. NetDefendOS validates the information against the Authentication Source specified in the
authentication rule. This will be either a local NetDefendOS database, an external RADIUS
database server or an external LDAP server.
7. NetDefendOS then allows further traffic through this connection as long as authentication was
successful and the service requested is allowed by a rule in the IP rule set. That rule's Source
Network object has either the No Defined Credentials option enabled or alternatively it is
associated with a group and the user is also a member of that group.
8. If a timeout restriction is specified in the authentication rule then the authenticated user will be
automatically logged out after that length of time without activity.
Any packets from an IP address that fails authentication are discarded.
8.2.7. HTTP Authentication
Where users are communicating through a web browser using the HTTP protocol then
authentication can be done by presenting the user with HTML pages to retrieve required user
information. This is sometimes referred to as WebAuth and the setup requires further considerations.
Changing the Management WebUI Port
HTTP authentication will collide with the WebUI's remote management service which also uses
TCP port 80. To avoid this, the WebUI port number should be changed before configuring
authentication. Do this by going to Remote Management > advanced settings in the WebUI and
changing the setting WebUI HTTP Port. Port number 81 could instead, be used for this setting.
Agent Options
For HTTP and HTTPS authentication there is a set of options in Authentication Rules called Agent
Options. These are:
• Login Type - This can be one of:
8.2.7. HTTP Authentication Chapter 8. User Authentication
311