D-Link NetDefendOS, User Manual

Page: 642 / 912

iii. The user's IP.
• The user's IP address is now authenticated to NetDefendOS and connections coming from
that IP are permitted through the firewall if an
IP Rule or IP Policy is defined to allow it.
• A client attempts to open a connection through NetDefendOS.
• A NetDefendOS IP Rule or IP Policy object is triggered that could allow this connection.
• The source network address object for the triggered rule or policy has an associated
authentication list of allowed usernames and groups. If the client is part of this list, the
connection can be established.
The IP Rule or IP Policy object that is created for authentication has the dual purpose of
identifying and allowing the connection as well as triggering the authentication process. NAT
could also be a function included in the rule or policy.
Setting Up Identity Awareness
To set up identity awareness, the following steps are required:
• Install and configure the Identity Awareness Agent (IDA) software on one or more domain
servers. The servers can be either a domain controller or a domain member. The IDA software
is described in more detail at the end of this section. Installation on a single server is sufficient
but installation on multiple servers will provide redundancy.
• Configure an Authentication Agent object in NetDefendOS which has IP Address and
Pre-shared Key properties that correspond to the ones used by the agents installed on the
domain servers. A separate Authentication Agent object should be created for each server in
the domain which has the IDA software installed.
If the Pre-shared Key property is not specified, this defaults to the value of the predefined PSK
object auth_agent_psk . This is also the default key value used by the D-Link Identity
Awareness Agent . However, the default key is the same across all NetDefendOS systems and
should be used for testing purposes only.
An IP rule or IP policy is not needed in NetDefendOS to allow the traffic coming from the
agent.
• Configure an address book IP4 Address object that defines the IP address, IP range or network
from which authenticating clients will come.
Important: In the Authentication property of this address object, specify the usernames
and/or groups which are allowed to create connections. Usernames must be specified in the
format
username@domain . For example, myusername@example.com . If this format with the @
symbol is not used and a simple string is used, for example myusername , then this will be
treated as a group.
• Specify an IP Rule or IP Policy object in the NetDefendOS configuration that triggers on the
client connections to be authenticated and allows them to be opened. The source network
for this rule or policy must be the IPv4 address object specified in the previous step.
It is the triggering of this rule or policy that triggers the authentication process.
Example 8.7. Enabling User Identity Awareness
This example assumes that there are external clients on a network client_net connected to the If1
Chapter 8: User Authentication
642