Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Administration Manual

Page: 259 / 861

258 Limiting user access
Authenticating with an external authentication server
PassGo Defender version 5 authentication
Defender is a strong, two-factor authentication method that uniquely authenticates users without
forcing them to remember another password. Defender is an industry standard and uses a challenge/
response mechanism to create a one-time password that is far more secure than static passwords. For
an attacker to correctly compute the response for a challenge, they need the user’s PIN and the unique
client software. Without both pieces, potential intruders cannot calculate the required response. Even
if the response is viewed when entered, it serves no purpose, as the response is only valid for that
session.
As of the Symantec Gateway Security v3.0 release, PassGo Defender is now supported through
RADIUS.
Note: Due to the way that Defender works, the authentication exchange will fail the first time before a
challenge is issued. RADIUS has no way of knowing initially that the authentication server at the other
end is running Defender. RADIUS could be using LDAP as a back-end, or a SQL database, or something
else that requires a password. The security gateway’s normal authentication exchange is to send a user
name and password when connecting with the authentication server.
Related information
For further information related to this topic, see the following:
■
“Remote Authentication Dial-In User Service (RADIUS) authentication” on page 257
RSA SecurID authentication
RSA SecurID is a strong, two-factor authentication method similar to PassGo Defender. RSA SecurID
makes use of a hardware token that is initially synchronized with the RSA SecurID server. Once
initialized, both the server and token stay synchronized by utilizing the same time hash algorithm.
Users with the hardware token are also required to have a PIN or passcode to use the token, which
completes the two factors.
RSA SecurID is normally used to provide authentication for FTP, NNTP, and Telnet connections.
Support for RSA SecurID is provided as an external authentication method only, so to use RSA SecurID
authentication, you must have the RSA SecurID software installed and configured on a separate
system; not the security gateway. For additional information on configuring RSA SecurID, please
consult the documentation included with your RSA product. You can also find addition information on
RSA SecurID in RFC 2808.
Note:
Static RSA SecurID users must have user accounts created on the security gateway to
authenticate properly. For dynamic authentication, user information is already configured on the RSA
SecurID server and should not be duplicated on the security gateway.
Before you can use RSA SecurID/Server, you must do the following:
■
Assign cards to users
■
Create clients on the RSA SecurID/Server, including the security gateway and each cluster node if
you are authenticating clustered systems
■
Create groups, if applicable
■
Activate cards and groups