Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Administration Manual

Page: 244 / 861

Chapter
7
Limiting user access
This chapter includes the following topics:
■
Understanding authentication
■
Configuring users for internal authentication
■
Configuring user groups for internal and external authentication
■
Authenticating with an external authentication server
■
Authenticating using Out-Of-Band Authentication (OOBA)
Understanding authentication
To protect your corporate network, you must control who is granted access and how the security
gateway determines and verifies the identity of users requesting access. This is most commonly done
through a security mechanism called authentication. The authentication process verifies the identity
of a user by contacting an authentication server, looking for a record that matches the user’s
credentials, and then challenging the user to enter the appropriate key phrase or response.
The security gateway provides its own internal authentication server as well as the ability to leverage
your corporation’s existing Microsoft Active Directory, LDAP, RADIUS, RSA SecurID, or PassGo
Defender authentication systems. Through its Out Of Band Authentication (OOBA) feature, the
security gateway can enable authentication on connections for which there is none. The security
gateway also lets you define a list (called a scheme) of authentication servers to verify user identity.
The security gateway requires the configuration of two different features, users and user groups, if the
security gateway itself is performing the authentication. This is true when you use the security
gateway’s internal authentication server, or have configured an authentication scheme that uses the
security gateway’s internal authentication component. You are not required to configure users or user
groups when working with external authentication or OOBA.
The following topics describe how you prepare the security gateway for authentication:
■
Configuring users for internal authentication
■
Configuring user groups for internal and external authentication
■
Authenticating with an external authentication server
■
Configuring the OOBA service
Configuring users for internal authentication
All authentication systems require that you define and store the information necessary to authenticate
a user. This normally includes a user name to identify the user and a password, key, or hash to validate
the user’s identity. When using the security gateway’s internal authentication server, alone or in an
authentication scheme, you must first define authentication information.