Barracuda Networks NG Network Access Client SP4 Administrator'S Manual Download

Page: 1 / 268

Summary of Contents for NG Network Access Client SP4

Page 1: ......

Page 2: ...2 All rights reserved Use of this product and this manual is subject to license Information in this document is subject to change without notice Trademarks Barracuda NG Firewall is a trademark of Barr...

Page 3: ...ral 17 Access Control Service Settings 17 System Health Validator 17 Remediation Service 19 Trustzone Border 19 802 1X 19 Advanced 20 General 21 Access Control Objects 21 Access Control Service Trustz...

Page 4: ...ion 121 Automatic Rule Configuration 122 Chapter 10 VPN Component Configuration 124 Create a New Profile Using the Profile Wizard 124 Configure a New Profile Manually 127 Functional Elements of the Ba...

Page 5: ...Overview 183 Status Monitoring 184 EAP Packet Tracer 184 Using the Barracuda NG Access Monitor for Analysis 185 Log Files on the Client Computer 185 Switch Web Interface 186 Switch Console Interface...

Page 6: ...tion of the device s compliance with current security policies By default a typical Network Access Control solution offers enhanced protection against malicious software and attackers improved access...

Page 7: ...obody actually being logged in may already have been compromised This routine situation must be easily accommodated within the policy framework This also means we ve got to find means to identify a ma...

Page 8: ...time identity and health state and type of network access The latter is required to enforce different policies when access takes place through a VPN tunnel This setup requires the presence of at leas...

Page 9: ...period of time during which the client is given a chance to recover from the current condition for example by successfully starting a disabled anti virus AV scanner service or updating an obsolete AV...

Page 10: ...lationship can be established Within each trustzone there are three policy rule sets There is a local machine policy rule set that is used to determine a policy for a connecting machine A connecting m...

Page 11: ...etails in the server side visualisation will be available Each policy rule consists of three parts 1 An identity related part that defines the applicable matching policy and criteria 2 A health policy...

Page 12: ...rvice sends probation actions to client Probation actions executed by client Access rights remain unchanged Health state change to Unhealthy Restricted Access Ctrl Service sends ACTION Activate policy...

Page 13: ...user context mentioned above The client is able to determine if a Barracuda NG VPN connection was initiated as well as if the VPN server has Access Control Service capabilities If the client mode is...

Page 14: ...only matching of health requirements is done but actions on the client can be performed as well An overview of the health matching procedure is available in the flowchart above At the beginning of the...

Page 15: ...state to healthy if the client complies to the assigned health policy from now on Should the client fail to self remedy the situation or does not reconnect in a reasonable amount of time its status c...

Page 16: ...s can be verified Service Settings Is the installed Barracuda NG Personal Firewall active Is the installed Virus Scanner active Is the installed Spyware Scanner active Antivirus Settings Which Virus S...

Page 17: ...ommended for formerly unrestricted network transitions many administrators nevertheless use AEM for practical reasons If however you have the chance to already know what should happen at the network p...

Page 18: ...based on the use of ICMP packages Succinctly the client submits an access request to the border patrol The border patrol responses by sending an authentication request through an ICMP package Upon re...

Page 19: ...on stand alone managed boxes and CC administered boxes Internet access using an HTTP HTTPS proxy server is possible Stand alone managed boxes running a Access Control Service require internet access F...

Page 20: ...r Settings System Health Validator section Local Machine Authentication Parameter Description Certificate Required If set to yes a local machine authentication requires a certificate for a successful...

Page 21: ...ss Control Server remediation service module TLS required Set to yes will allow unencrypted downloads from the remediation server This will increase download velocity but decrease security since perso...

Page 22: ...ault realm Dest IP Address Destination RADIUS server Dest Port Auth Destination server s port for authentication Dest Port Acct Destination server s port for accounting Dest Secret Destinations server...

Page 23: ...r Settings Advanced section TLS SSL Parameter Description TLS SSL Certificate The X 509 certificate which is used with TLS TLS SSL Private Key Corresponding RSA private key which is used with TLS List...

Page 24: ...ome message be displayed to individual groups of users In addition welcome messages may be used to display localized messages Each mes sage is assigned to a language According to the client s language...

Page 25: ...ails of a Barracuda NG Personal Firewall rule set is explained in Server Config Personal Firewall Rules page 41 Fig 2 3 Access Control Objects Access Control Service Bitmaps Keep the size of your pict...

Page 26: ...l if the specified registry keys are not set appropriately Notify generates appropriate log messages on the Barracuda NG Firewall Import of a registry file Click clipboard import the adequate registry...

Page 27: ...nfiguration of the trustzone is located in the configuration node Virtual Servers servername Assigned Services servicename Access Control Service Access Control Service Trustzones The Barracuda NG Con...

Page 28: ...entication is requested by the connecting client the current user policy rule set is used for policy matching If the connection attempt is mediated by an intermittent VPN Service then the VPN policy r...

Page 29: ...ight 1 3 What is a Policy Rule Set page 8 2 4 2 Identity Matching Basic The first step when processing a policy rule set either local machine current user or VPN is to determine the client s identity...

Page 30: ...to an IP address which is defined in External IPs see above Set to Ignore means that the policy rule is neither ignored for internal nor external connections Time Restriction Each policy rule can be...

Page 31: ...up OU my unit CD mycompany DC at Net Bios Domain Enter the name of a NetBIOS Domain to match only users of a specific Domain Note Only available for Current User and VPN rule set User Login Name Enter...

Page 32: ...Subject Enter X 509 subject name patterns here for example CN name O my company The X 509 subject of the clients authentication certificate must match at least one of these patterns Note Certificate a...

Page 33: ...of the health evaluation doesn t depend on this parameter Required If a Required parameter does not match the user is notified and manual action is required Furthermore the client s health state chan...

Page 34: ...is to Continue on Health Mismatch if the health validation should be continued with the next policy rule in the policy rule set if the health evaluation in the current rule gave the result that the cl...

Page 35: ...ot listed here are ignored in the health validation process This option is helpful especially to exclude some on the clients installed anti virus products from the health validation process The list o...

Page 36: ...althy This option will be ignored if the latest anti spyware pattern is older than value For instance if this option is set to 6 Hours but the latest anti spyware pattern was released 8 hours ago the...

Page 37: ...n Major Release The clients health suite major number must match Major Release Minor Release The clients health suite minor number must match Minor Release Service Pack Number The Service Pack Number...

Page 38: ...ssage it will be advised to get the message from the remediation server Limit Access Ruleset Name Message Client Emerg Quarantine Time s Define the quarantine rule set here Assignment of Limited Acces...

Page 39: ...ed authentication on the client computer Use DHCP renew Whenever the client is relocated into a different VLan this flag enforces the renewal of the client computers IP address Healthy Vlan Id Specifi...

Page 40: ...Message List 2 34 Access Control Service Trustzone Settings section Identity Parameter Description Health Passport Signing Key The Health Validator returns a digital passport to the client as result o...

Page 41: ...any effect See 11 3 2 Access Control Server IPs from Registry page 160 and 11 3 3 Access Control Server IPs from DHCP page 160 Quarantine Ruleset Name Here choose one of the Personal Firewall Rules o...

Page 42: ...ted in the support chart may differ from the technically executed actions e g automatic update of Windows Defender 1 x the chart states Implemented though it may not work on the 64 Bit client Reason T...

Page 43: ...Client to Site and select the VPN FW tab Config Box Virtual Servers servername Assigned Services servicename vpnserver Client to Site Double click the appropriate VPN Firewall Rule Set 3 2 Rule Set Na...

Page 44: ...42 Server Config Personal Firewall Rules Fig 3 1 Rules Incoming...

Page 45: ...all services affected by the selected rule Show Applications Opens a window displaying all applications affected by the selected rule Show Adapters Opens a window displaying all adapters affected by t...

Page 46: ...guration dialog for a new rule 3 2 4 Rule Configuration page 45 Delete Deletes the selected rule s Copy Copies the selected rule s to the clipboard Paste Pastes the selected rule s from the clipboard...

Page 47: ...Parameter Description Action Select Pass to enable a connection request select Block to prevent it Name Insert a rule name into this field Note The maximum length of this parameter is 50 characters C...

Page 48: ...ion Objects page 59 Select Explicit to define an application object explicitly without adding it to the Application Objects listing Right click the source window below the list and Select New to creat...

Page 49: ...47 Barracuda NG Network Access Client Administrator s Guide 3 2 5 Tester The Tester view allows testing rule sets for consistency Fig 3 5 Time restriction dialog Fig 3 6 Rule Tester...

Page 50: ...t Update Users to clear the field Adapter optional Select an adapter from the list Optionally Click the Adapter link and select Update Adapters to clear the field Test Click Test to test the connectio...

Page 51: ...tion of a trusted adapter changes 3 3 Adapters page 51 By default the Trusted Network option points to the preconfigured TrustedNet object 3 5 Net Objects page 55 You may change the setting to another...

Page 52: ...plements the services and protocols listed in table 3 3 page 50 Table 3 3 Services and protocols employed by the ADSL rule Port Protocol Service Name Description GRE pptp Generic Routing Encapsulation...

Page 53: ...UMTS ISDN and modem cards Adapter Ethernet This object summarizes all Ethernet adapters available on the system for example LAN de vices Adapter Wireless Fig 3 8 Adapter view Table 3 4 Adapter view d...

Page 54: ...nterface of the NG VPN client To create a new adapter object click New in the Adapter Objects window Adapters available on the system are automatically assigned to the appropriate adapter object with...

Page 55: ...g from Trusted to Untrusted the reference to the adapter object is automatically deleted from the Trusted Network object References to Untrusted adapter objects may not be added to the Trusted Network...

Page 56: ...wall are available for selection Local user group information is displayed in the list first If the Windows workstation is a member of a Microsoft Windows domain domain user group information may be r...

Page 57: ...Net Network Connection name These network objects contain the network addresses of each specific adapter available on the system The Network Connection name is retrieved from the Microsoft Windows Ne...

Page 58: ...es living on it are added to the Trust edNet object Vice versa they are deleted from it when trust assignment changes to untrust ed The TrustedNet object is also updated when IP address configuration...

Page 59: ...the Entry section insert IP network address es of the new Net Object and or specify a Reference to the Net Object for example select an existing Net Object to refer to a new one The Excluded Entry sec...

Page 60: ...and protocol management Use the Services window to assign port and protocol to specific services and merge multiple services to one service object using references Properties of Service Objects are d...

Page 61: ...O Network Time Protocol used to synchronize the time of a computer client or server to another server or reference time source LOC SRV EPMAP 135 TCP O NETBIOS very common protocol it is supported on...

Page 62: ...ile and its inherent file description will be displayed in the Path and Description fields below Optionally insert a file description into the Comment field Specify Application Liability and Applicati...

Page 63: ...ded by the OS kernel TCP IP Ping Command O I lsass exe O Local Security Authority Service process responsible for management of local security authority domain authentication and Active Directory mana...

Page 64: ...following columns Time Displays date and time of the last client access Hostname Displays the client s hostname as reported by the client IP Address Client s IP address as reported by the client User...

Page 65: ...e entry MAC Address Client s MAC address as reported by the NG client SID Client s local machine Secure Identifier SID as reported by the NG client 4 1 2 Filtering All available tabs provide filtering...

Page 66: ...ven in routed environments the original MAC address will be available SID Filter for microsoft machine SID Box Filter for originating box where the Access Control Service runs on only relevant in CC B...

Page 67: ...ion and Healthy For single entries the summary displays a red icon to indicate an unhealthy client if it was unhealthy only once per displayed time period day week Grey icons mean that no data is avai...

Page 68: ...s are cumulated Show time in UTC Show UTC time instead of Barracuda NG Firewall system timezone 4 1 4 Status Tab The Status tab summarizes the health information of all connected clients The Barracuda...

Page 69: ...subset of the information available in the Status tab Only Barracuda NG Network Access Client Client connections established through VPN are enlisted Manually applying filters in the Status tab result...

Page 70: ...indows Vista 32 Bit and 64 Bit and Windows 7 32 Bit and 64 Bit logo compliance Barracuda NG Network Access Client is not intended to work as complement to VPN clients and or personal firewalls provide...

Page 71: ...page 70 Customer Setup See 5 4 Customer Setup page 73 5 1 Complete Installation The complete installation itself is a standard installation routine providing default settings For example for connecti...

Page 72: ...y List 5 1 Complete Installation section Barracuda NG Access Monitor default settings Parameter Default 802 1x Enable DHCP Renew List 5 2 Complete Installation section NG Personal Firewall default set...

Page 73: ...nstall Barracuda Networks GINA FW_NOTINSTALL 0 1 This option is for SMART clients only although SMART clients still also work with installed firewall INSTALLDIR Defines the installation path C Program...

Page 74: ...ff Selecting this checkbox results in a pass all behavior of the NG Personal Firewall Use this option for unattended setups Firewall Always ON This option prevents deactivating the NG Personal Firewal...

Page 75: ...for Customer Setup customer inf silent cmd are available on the Application CD allowing you to adapt the remote configuration procedure Proceed as follows to prepare a completely customized setup 1 Ed...

Page 76: ...source file name is given this specification is also the name of the source file source file name Specifies the name of the source file If the source and destination file names for the file copy opera...

Page 77: ...pied if they are also specified in an INF DelFiles directive or an INF RenFiles directive 0x00000020 COPYFLG_NO_VERSION_DIALOG Do not overwrite a file in the destination directory with the source file...

Page 78: ...ADDREG_BINVALUETYPE The given value is raw data This value is identical to the FLG_ADDREG_TYPE_BINARY 0x00000002 FLG_ADDREG_NOCLOBBER Prevent a given value from replacing the value of an existing valu...

Page 79: ...the specified value entry name to be added to the given registry key Such a value can be a replacement value for an existing named value entry in an existing key a value to be appended flag value 0x0...

Page 80: ...n a SourceDisksNames section of the same INF subdir This optional value specifies the subdirectory relative to the SourceDisksNames path specification if any on the source disk where the named file re...

Page 81: ...79 Barracuda NG Network Access Client Administrator s Guide For an overview of specific properties see table 5 1 page 71...

Page 82: ...arracuda NG Network Access Clients installation and removal processes create restore points in the Windows System Restore area that you may use to restore your system to a previous state Refer to the...

Page 83: ...ng the migration process then please contact the Barracuda Networks support For migration it is mandatory to have the setup file locally on your system A network installation is NOT possible If the Pe...

Page 84: ...tall the client browse to Start Control Panel Add or Remove Programs Barracuda NG Network Access Client and click Remove Close all applications including the VPN client before uninstalling You will be...

Page 85: ...standards and hence improves the VPN connectivity substantially Barracuda Networks provides two types of VPN client licenses Barracuda NG VPN Client Barracuda NG SSL VPN and NAC 8 2 Facts and Figures...

Page 86: ...namic adapter object handling Dynamic user object handling RPC handling Multiple rule sets support Client side policy enforcement Table 8 3 Policy matching capabilities Function Comment ID based polic...

Page 87: ...tection active Last AS scan time Enforce overdue AS scan AS engine version AS pattern version AS pattern max age Enforce overdue AS engine pattern update Personal firewall rule set a Registry entries...

Page 88: ...ed health agent Integrated VPN client Integrated personal firewall managed Full entegra policy support Table 8 6 OS Requirements Function Barracuda NG VPN Client Barracuda NG SSL VPN and NAC Operation...

Page 89: ...The active operational mode is selected To change the mode click another item in the menu Each rule in a Barracuda NG Personal Firewall rule set is constructed from a variety of configuration entitie...

Page 90: ...tings Disable Windows Firewall it will properly replace the built in Windows Firewall as long as it is enabled Disabling the Barracuda NG Personal Firewall will automatically re enable the Windows Fir...

Page 91: ...Guide 9 2 Rule Set Selection Click Rule Set Selection to select one of the available rule sets for viewing The Local Rule Set is selected by default Only the Local Rule Set may be edited in the Barra...

Page 92: ...raphical user interface of the Barracuda NG Personal Firewall is built up of the following items Fig 9 3 Graphical Interface of the Barracuda NG Personal Firewall Menu bar page 91 Load display page 94...

Page 93: ...Tab Click the Save Configuration link within the Configuration Item bar to save configuration changes after prior confirmation inquiry List 9 1 Firewall Settings Protocol Option Parameter Description...

Page 94: ...9 4 Firewall Settings Firewall Settings Parameter Description Disable Windows Firewall Selecting this checkbox disables the Windows Firewall if it is installed default selected Block all IP Fragments...

Page 95: ...lecting this item closes the Barracuda NG Personal Firewall configuration window 9 4 2 View Menu DCERPC List This dialog displays the status of each DCERPC communication slot for detailed informa tion...

Page 96: ...the firewall off and allow all traffic Barracuda Networks Secure Mode Activate customized firewall rule sets Process Monitor Generate an entry in the event monitor for every process initiation 9 6 2 E...

Page 97: ...rracuda NG Personal Firewall The NG Control Center is divided into the following sub items Summary see 9 6 1 Summary page 95 Events see 9 6 2 Events page 96 History see 9 6 3 History page 97 Live Acti...

Page 98: ...ter value Click Refresh to apply filter settings Fig 9 10 NG Control Center Events window Table 9 1 Event view details Column Description Date Date and time the connection has been initiated Action Ty...

Page 99: ...ing columns Fig 9 11 NG Control Center History window Table 9 2 History window details Column Description Direction Flags the connection direction outgoing connections incoming connections Connection...

Page 100: ...c over this slot Service Affected service object or UUID Universal Unique IDentifier Adapter NIC that was used for connection AID Unique Access ID of the connection Table 9 3 History window Context me...

Page 101: ...Filter tab is highlighted in yellow Select the checkbox on the right side of an available filter to activate it and insert the condition to apply Policy filters the connection s Traffic Policy Source...

Page 102: ...100 Barracuda NG Personal Firewall 9 6 7 Live Activity The Live Activity view details all currently active connections Fig 9 12 NG Control Center Live Activity window Refresh...

Page 103: ...ewall rule bps Connection load in bits per second Idle Idle time of the connection Total Total amount of data transfer that is sum of incoming column In and outgoing column Out traffic Start Expired t...

Page 104: ...the view to the minimum wanted amount of entries Click Activate to activate the filter settings Click Disable to deactivate the filter settings After having specified a filter click to refresh the vi...

Page 105: ...disabled state Click the link to enable secure mode Secure This icon depicts secure firewall mode Click the link to deactivate effectiveness of the con figured rule set 9 8 Configuration 9 8 1 Genera...

Page 106: ...ndow displaying all applications affected by the selected rule Show Adapters Opens a window displaying all adapters affected by the selected rule Show Users Opens a window displaying all users affecte...

Page 107: ...ely you can use drag drop 9 8 5 Rule Configuration Select New from the context menu to create a new rule Paste Pastes the selected rule s from the clipboard According to a regular Barracuda NG Firewal...

Page 108: ...etworks window are available 9 8 7 Networks page 110 Select Explicit to define a network object explicitly without adding it to the Network Objects listing Right click the source window below the list...

Page 109: ...striction A time restriction can be assigned to each rule The granularity is 1 hour on a weekly base A rule is allowed at all times by default for example all checkboxes in the Time Interval window ar...

Page 110: ...cards Adapter Ethernet This object summarizes all Ethernet adapters available on the system for example LAN de vices Adapter Wireless Fig 9 19 Adapter objects window Table 9 8 Adapter Object view det...

Page 111: ...etwork Connections NG VPN This is the virtual interface of the Barracuda NG VPN Connector To create a new adapter object click New in the Adapter Objects window Adapters available on the system are au...

Page 112: ...nce select Untrusted Note When later changing the setting from Trusted to Untrusted the reference to the adapter object is automatically deleted from the Trusted Network object References to Untrusted...

Page 113: ...r to trustworthy networks The content of this object is de pendent on assignment of an adapter as trusted or untrusted 9 8 6 Adapters page 108 When an adapter is specified as trusted the IP addresses...

Page 114: ...specify a Reference to the Net Object for example select an existing Net Object to refer to a new one The Excluded Entry section allows excluding specific networks from a network object 9 8 8 Service...

Page 115: ...tor s Guide Fig 9 23 Service Object dialog Table 9 9 Service Objects available in the Personal Firewall Service Name Port Protocol Connection Description ICMP O I Internet Control Message Protocol ICM...

Page 116: ...aming Session and Datagram NETBIOS NS 137 UDP O I NETBIOS DGM 138 UDP O I NETBIOS SSN 139 TCP O I SNMP 161 UDP O Simple Network Protocol Network management system contains two primary elements Manager...

Page 117: ...indow opens Click Browse and select the file you want to create the object for After selection the path to the file and its inherent file description will be displayed in the Path and Description fiel...

Page 118: ...in Microsoft Windows domains Application Connection Description System O I Services needed by the OS kernel TCP IP Ping Command O I lsass exe O Local Security Authority Service process responsible fo...

Page 119: ...irewall are available for selection Local user group information is displayed in the list first If the Windows workstation is a member of a Microsoft Windows domain domain user group information may b...

Page 120: ...reset the field to the default value From IP Port Insert Source IP and corresponding connection port Click the From or To link to Swap IP and or Port information Protocol Specify which protocol to tes...

Page 121: ...ble A failed connection will be indicated by symbol and Action field Block A successful connection attempt will be indicated by symbol and Action field Pass Rule The Rule field displays the applicable...

Page 122: ...ing applications required in Microsoft Windows domains Windows File Sharing This option can only be set to yes when a network object has been configured as Trusted Network When set to yes incoming con...

Page 123: ...incoming adapter block rule in the Incoming tab of the firewall rule set configuration area 9 8 2 Rules page 104 Generally the security alert window will pop up if an adapter is used for the first tim...

Page 124: ...guration page 103 If cleared the connection request is granted temporarily for this one specific connection request only Fig 9 28 Security Alert windows Windows Vista If you don t have access to the d...

Page 125: ...ort This option is selected by default to allow a restrictive rule set only All activities for this application Select this option to allow connection initiation on arbitrary ports Port Range Select t...

Page 126: ...te and configure a new VPN profile To start the wizard right click anywhere within the empty white space in the Barracuda NG VPN Control window followed by choosing New Wizard from the context menu In...

Page 127: ...the wrong one Choosing Username and Password or SecurID will enable the Finish button allowing you to complete the configuration process at this point However if you selected one of the two remaining...

Page 128: ...tle To finish the configuration wizard browse for the license file then click Finish If you have chosen Certificate you will be taken to this dialog of the same title Enter your certificate data and c...

Page 129: ...e Manually Double click the Barracuda NG Network Access Client icon in the system tray to open the VPN component This will bring up the client s status window which is attached to the tray Clicking Co...

Page 130: ...s Connect dialog als shown below The VPN profile can be chosen using the Profile dropdown Clicking Connect either left hand or at the bottom would then initiate a connection using the chosen profile...

Page 131: ...igured profile from the VPN client dialog Instead of creating a new profile the default profile can of course be edited Advanced configuration options found in die Advanced Settings tab are described...

Page 132: ...ll R8 Double click the icon to open the VPN client Connection dialog 10 3 Connection Dialog page 132 Right click the icon to make the following menu items available About NG Network Access Client Show...

Page 133: ...rsonal Firewall Barracuda NG Personal Firewall page 87 NG VPN Client Opens the Status dialog of the Barracuda NG VPN Client 10 4 Status Dialog page 134 10 2 2 The Barracuda NG VPN Client s Menu Bar Th...

Page 134: ...69 Before using Remote VPN a profile must be configured The following values are required for a successful login to the VPN server Profile list Select a preconfigured profile for login here The creati...

Page 135: ...res a password you need to insert it into the respective field Click Connect to establish a connection to the VPN server You can make use of the proxy server checkbox to override settings that have be...

Page 136: ...chnical Details tab Technical Details section Client IP The assigned VPN client IP address Source and gateway IP address Domain The assigned domain DNS The assigned DNS IP address for the VPN connecti...

Page 137: ...etwork resources available through the VPN can be accessed Client IP The client s IP address within the VPN Activity section Bytes Sent Bytes Received Amount of traffic transferred so far during the c...

Page 138: ...se the VPN client window The VPN control window will remain open Change Server Password link This link is only available as long as an active connection to the VPN server is established Barracuda Netw...

Page 139: ...t and a configuration area on the right side At start up Barracuda NG VPN Control opens with the VPN Profiles configuration area Further available for configuration are Certification Authorities 10 6...

Page 140: ...le as new default profile The default profile is displayed with bold letters in the overview window New Click New to create a new VPN profile The profile configuration itself is done through the Conne...

Page 141: ...DER encoded binary x 509 PKCS 12 certificates PEM encoded binary x 509 Export Certificate To section File Clipboard Exports the certificate to a text file or to the clipboard for further use in anoth...

Page 142: ...of the adapter Automatically reorder adapters Place the VPN client s virtual adapter within the Windows adapter bindings right at the position that is configurable through Order VPN Adapter Order VPN...

Page 143: ...ame in the Connection dialog window Certificate section Choose the authentication method required by the VPN server The chosen authentication type appoints further configuration parameters Remote Serv...

Page 144: ...reation using an ini file Barracuda NG Authentication only page 146 for further details Selecting this method requires a valid X 509 certificate List 10 2 Parameters available for use with X509 authen...

Page 145: ...Clear List 10 4 Advanced Settings tab Proxy Settings section Parameter Description via Proxy Default No Proxy Whether a proxy should be used and if of which type it is Proxy Port IP address and port f...

Page 146: ...or the VPN Service to wait for the Health Agent Recommended value 30 WLAN Roaming Default Yes Different IP addresses from the same profile are tried if a connection breaks Recommended value Yes Fast R...

Page 147: ...user name For security reasons this parameter is disabled by default Show Popup Yes Specifies whether pop up messages are displayed for incoming and outgoing connections Close after Connection No Caus...

Page 148: ...r the VPN profile The following parameters can be defined through the ini file Description Name of the profile Server IP address of the VPN server Proxy URL or IP address of the proxy server ProxyType...

Page 149: ...nection mode By default this parameter is set to tcp The alternatively available modes are shown in brackets Please remove the bracket and its entries in order the get a working setup file 10 7 Log Wi...

Page 150: ...148 VPN Component Configuration Module row The module the respective log entry refers to Status row The status of several actions such as Internal loop Add Routes added routes Refresh IP client IP etc...

Page 151: ...t returned by the Access Control Server This includes Downloading and installing necessary updates Restricting network access Executing Antivirus Antispyware updates and starting scans or updates 11 1...

Page 152: ...onitor Table 11 1 Barracuda NG Access Monitor Property Description Health Condition There are 3 different health states Healthy The client computer complies with the policy configured on the Access Co...

Page 153: ...estricted network access is active the Client will activate the quarantine rule set assigned by the Access Control Server Note It is possible to configure two quarantine rule sets one for when the cli...

Page 154: ...able 11 1 page 150 or the Quarantine Status link see Quarantine Status same table in the Health Agent view 11 2 3 Service Status If either the Client service or the Barracuda NG Access Monitor Agent s...

Page 155: ...hen the Barracuda NG Access Monitor has no Access Control Server IP addresses configured There are some options to resolve this Table 11 2 Health Agent states State Description Initializing The Barrac...

Page 156: ...12 Allow Emergency Network Adapter Repair page 163 By using the operating system s built in ipconfig tool to obtain a new IP address for the client computer which will include a Access Control Server...

Page 157: ...155 Barracuda NG Network Access Client Administrator s Guide Fig 11 6 Connection error because no Access Control Server IP addresses are configured...

Page 158: ...Barracuda NG Access Monitor actions for managed network interfaces Task Description Logon Starts the 802 1X authentication scheme by requesting network access through the switch which enables the lin...

Page 159: ...tus Shows the device status of the network interface these include Network cable unplugged Not connected Disconnected Connecting Connected PAE state Port Access Entity status EAP state Extensible Auth...

Page 160: ...cer The EAP Tracer allows you to view EAP and EAPOL packets captured by the Barracuda NG Access Monitor for every network interface which has the option Trace EAP Packets enabled see 11 3 13 Capture 8...

Page 161: ...ee 11 3 5 Offline Check page 161 Use Basic Authentication See 11 3 7 Use Basic Authentication page 162 Use NTML Authentication See 11 3 8 Use NTLM Authentication page 162 IEEE 802 1X Authentication Se...

Page 162: ...sure continuous connectivity As shown in figure 11 11 these IPs can be configured locally using the dialog and then they are stored in the registry These can be found as follows 11 3 3 Access Control...

Page 163: ...connecting to the Access Control Server instead of checking for connectivity first It is highly recommended to enable this feature when connecting to the Access Control Server through a VPN connectio...

Page 164: ...indows user credentials provided by NTLM for authentication To edit this option manually modify the following registry key Table 11 7 Registry entry for ICMP connectivity Item Description Path DEFAULT...

Page 165: ...or Emergency Network Adapter Repair in the Barracuda NG Access Monitor Health Agent view By clicking the button all network interfaces enabled to use 802 1X are being reset and will receive a new IP i...

Page 166: ...etwork Access Client installation directory These files can be viewed using the EAP Tracer To edit this option manually modify the following registry key Key AllowEmergencyRepair Value Default 1 0 dis...

Page 167: ...opened either using the Barracuda NG Access Monitor by double clicking the desired log file in the Advanced Settings section or with the desired text editor Following log files are available depending...

Page 168: ...ownload such as rule set message of the day downloadLocal xml Contains data received when a local computer based health evaluation succeeded downloadUser xml Contains data received when a user based h...

Page 169: ...2 VPN Connector Create a connector to achieve following Enable a user to gain quick access to a preconfigured profile or multiple profiles Place shortcuts to the connectors on the client s desktop Con...

Page 170: ...eate Connector see Advanced Settings Tab page 143 Browse to Start Control Panel Network Connections A default Barracuda NG VPN Connector is available in the Virtual Private Network section Modify or c...

Page 171: ...tablished successively during logon process to your PC enabling access to an otherwise inaccessible domain 12 3 Remote VPN rvpn Remote VPN allows connecting disconnecting automatically via script rvpn...

Page 172: ...onfiguration from it As soon as the configuration is received the VPN Service transmits this configuration to the Barracuda Networks Secure Personal Access Client SPAC This enables the SPAC to answer...

Page 173: ...gers ipconfig renew for the Barracuda NG VPN Virtual Adapter 5 SPAC answers DHCP requests for the Adapter with the configuration data 6 Operating system reconfigures the Virtual Adapter 7 VPN Service...

Page 174: ...chine The client LAN has the IP range 10 0 8 0 24 the protected servers are located in the network 172 16 0 0 24 Additionally to the protected servers one server acts as Microsoft Domain Controller an...

Page 175: ...uidelines for personal firewall rule sets The required applications may strongly differ between companies Nevertheless remember for all your Barracuda NG Personal Firewall rule sets All your clients r...

Page 176: ...ion Additional remote desktop connections are allowed in the Incoming rule set 13 3 Introduce an Access Control Service Trustzone As mentioned above the hierarchical structure of a Barracuda NG Contro...

Page 177: ...igure your trustzone within the Access Control Service Trustzone node As a guideline for a simple setup using a CC we recommend to use global trustzones or alternatively switch to range trustzones For...

Page 178: ...e keys use the previously created key and export the public part into the clipboard This public key is imported again as Health Passport Verification Key To keep our setup as simple as possible we wil...

Page 179: ...nistrator s Guide For the Identity Matching and Required Health State views Basic and Advanced configuration dialogs exist Fig 13 4 Example configuration Configure an Access Control Service Trustzone...

Page 180: ...and the Antivirus Scanner if they are deactivated To set the parameter Last AV Scan Not Older Than to Ignore is due to the reason that performing a regular full scan of the client computer takes quite...

Page 181: ...ayed as soon as a user has logged in Assign the Welcome Picture Barracuda NG Network Access Client Logo For Limited Access assign the appropriate Rule Set and Message For the catch all rule which matc...

Page 182: ...Network Access Policies Instead you can set up your firewall rules of the gateway firewall using the implicit roles unhealthy healthy probation and untrusted Fig 13 6 Example configuration Configure...

Page 183: ...ork access To allow communication to protected servers only for clients conforming to the health policy modify the gateway firewall rule set as follows Open the forwarding firewall rule set and change...

Page 184: ...ule Healthy Access to protected Servers Rule Fig 13 9 Example configuration Configure forwarding firewall rule set Firewall Rules Barracuda Networks allows access even for clients in probation since w...

Page 185: ...l start the authentication using a unique identifier as username and a session id as password received by the Access Control Server based on his health evaluation result The authentication server will...

Page 186: ...nents handling the 802 1X authentication process EAP Packet Tracer Barracuda NG Access Monitor Log files on the client computer Access Control Server logs Switch web interface Switch console interface...

Page 187: ...he following components The log files can be found in the folder log located in the installation directory which by default is C Program Files BarracudaNG Also the Barracuda NG Access Monitor provides...

Page 188: ...lt Software phion phionvpn settings Key Logging Value Enables or disables verbose output to be written Default 0 0 disabled 1 enabled Changing this value takes effect immediately This value may also b...

Page 189: ...tEthernet0 3 is down line protocol is down notconnect Hardware is Fast Ethernet address is 0016 c7ba 9505 bia 0016 c7ba 9505 MTU 1500 bytes BW 100000 Kbit DLY 100 usec reliability 255 255 txload 1 255...

Page 190: ...rectory on the client computer the Barracuda NG Access Monitor is installed to adapter_uid The unique identifier for any network interface this GUID can be viewed in the detail view of any network ada...

Page 191: ...4 Authentication Message Exchange 5 VLAN Assignment 14 3 5 Shutdown 1 Operating system shutdown by the user 2 Operating system logoff by the user 3 Manual Logoff command by the user 14 3 6 Start up 1...

Page 192: ...A is set to enabled 1 1 B is set to enabled for the network interface to use 802 1X is set to enabled Table 14 5 Microsoft 802 1X compliant client software Service Friendly Name Service Name Wired Aut...

Page 193: ...ce used is corrupted following behavior will occur The wpa supplicant exe will terminate almost immediately and will not appear in the Process Explorer or Task Manager If verbose output is enabled wpa...

Page 194: ...pa supplicant will re authenticate periodically This can be triggered either by the Client service or the switch The Client service will generate the configuration file based on the template Table 14...

Page 195: ...llow these steps to enable periodic re authentication of the client and to configure the number of seconds between re authentication attempts Commands configure terminal Enter global configuration mod...

Page 196: ...ates the authentication message exchange between the client computer the switch and the RADIUS authentication server Shown in the first section I is the initial EAPOL start packet sent by the wpa_supp...

Page 197: ...to any packets received on the port the client computer is connected to For faster response time it is recommended to set this value to 1 second To change the quiet period follow the steps below in pr...

Page 198: ...lient computer received via DHCP are visible in the Advanced Settings section of the Barracuda NG Access Monitor or the Barracuda NG Personal Firewall Both provide the functionality to delete the Acce...

Page 199: ...e Barracuda NG Access Monitor provides the necessary functionality In order to perform this you should follow these steps Enter the Port Security section in the Barracuda NG Access Monitor Selected th...

Page 200: ...lowing steps Enter the Barracuda NG Access Monitor Port Security section Select the network interface to log off Choose Logoff from the tasks menu on the left or through the context menu of the networ...

Page 201: ...le 14 17 Fields of the EAP request response frame Field Name Size Purpose Code 1 Byte 1 Request 2 Response 3 Success 4 Failure Identifier 1 Byte To match request response Length 2 Byte Length of total...

Page 202: ...tarting RestartServices 003 error opening service manager 004 REASSOCIATE event send to thread d thread id 004 EMERGENCYREPAIR event send to thread d thread id 005 error opening service s 006 service...

Page 203: ...8021XThread 000 creation startup 001 thread starting restarting for adapter s adapter uid 002 supplicant file information conf log dump 003 no config found for supplicant on adapter xxx create from te...

Page 204: ...03 005 FindStatus 001 empty findState string 003 empty expectedState string 004 found findString with state expected 005 expectedState not found 009 003 007 002 port state changed on adapter s adapter...

Page 205: ...in s domain information 024 GetHostName Error s error information 024 no user name found switch to local computer authentication Table 14 19 Technical Guideline Engineering Environment Switch Cisco Ca...

Page 206: ...st containing an empty user name This request is not treated as an authentication failure therefore the switch will not disable the port allowing all network traffic Given these circumstances client c...

Page 207: ...tall DelFiles PhionCustomerCopyFiles DelReg PhionCustomerReg 1 Customer Area PhionCustomerCopyFiles destination file name source file name temporary file name flag customer inf 2 important do not remo...

Page 208: ...0x00010001 1 Reliability TCP 2 Response UDP 3 Optimized Hybrid Virtual Adapter Configuration dhcp 0x00010001 0 Assign IP address manually 1 Use internal DHCP assignment default 2 Direct assignment Co...

Page 209: ...Certificate Store Linked x509 Certificate HKU DEFAULT Software Phion phionvpn Profile 3 Default 0x00010001 0 HKU DEFAULT Software Phion phionvpn Profile 3 dhcp 0x00010001 1 HKU DEFAULT Software Phion...

Page 210: ...ocalizable Strings Strings ph Phion DisplayClassName Phion Customer Files Phion Phion AG Phiond DeviceDesc Phion Customer Files Phion DeviceDesc Phion Customer Files Phion DeviceDesc Phion Customer Fi...

Page 211: ...tificate Store Lookup CertSearchOrder 0x00010001 0 Lookup with Subject 1 Lookup with Issuer Use Serial Number certserialnumber 0x00000000 Private Encrypt PrivateEncrypt 0x00010001 Probe Encryption Pro...

Page 212: ...Time Password oneTimePassword 0x00010001 Allow ENA Connection allowENA 0x00010001 Allow Sending Offline Ruleset allowFWRule 0x00010001 Save new Certificate Unattended unattended 0x00010001 Silent Mod...

Page 213: ...Disconnect all applications and connect again to solve the issue This behavior may also occur with slow connections Increase the Keep alive seconds pa rameter 10 6 8 Advanced Settings Tab page 143 if...

Page 214: ...ced Settings Tab page 143 and change from Virtual Adapter Configuration to Direct assignment or the other way around The message Session PHS signature check failed bad decrypt is logged to the events...

Page 215: ...unknown incoming connections 9 120 Ask for unknown outgoing connections 3 49 Ask for unknown outgoing connections 9 120 Attribute Value listing 3 48 Attribute Value listing 9 119 Authentication algori...

Page 216: ...59 IEEE 802 1X DHCP Renew 11 159 inactive 3 45 inactive checkbox 9 106 Incoming 9 120 Internal Remediation Server IPs 2 18 IP Address 2 20 IP Monitor 9 91 IPs 3 53 IPs 9 110 Issuer 10 142 Keep Access...

Page 217: ...w Popup 10 145 Silent Mode No Keep Alive 10 144 Simulate SSL 10 143 Size limit 9 91 Soft Hearbeat Default No 10 144 Software Update Required 2 36 Source Service Destination Application User Adapter 3...

Page 218: ...3 48 User optional 9 118 User Login Name 2 29 User Authentication Required 2 18 User Authentication Required 2 37 Valid to 10 142 via Proxy 10 143 Virtual Adapter Configuration 10 144 VPN Remediation...

Page 219: ...one Rules Identity Matching Basic section Basic Matching 29 List 2 22 Access Control Service Trustzone Rules Identity Matching Advanced section Advanced Identity Matching 30 List 2 23 Access Control S...

Page 220: ...llaneous 120 Chapter 10 VPN Component Configuration List 10 1 Parameters used with Barracuda NG authentication 142 List 10 2 Parameters available for use with X509 authentication 142 List 10 3 Paramet...

Page 221: ...lowed Health Suite Versions 35 Figure 2 15 Access Control Service Trustzone Rules Policy Assignments 36 Figure 2 16 Access Control Service Trustzone Settings 38 Chapter 3 Server Config Personal Firewa...

Page 222: ...License 126 Figure 10 5 VPN Profile Wizard Certificate 126 Figure 10 6 VPN Profile Wizard Modify Existing Profile Using the Wizard 127 Figure 10 7 VPN client tray status window 127 Figure 10 8 NG VPN...

Page 223: ...ple configuration Configure a Access Control Service Trustzone Local Machine Edit Policy Rule catch all 180 Figure 13 7 Example configuration Configure forwarding firewall rule set Edit Create User Ob...

Page 224: ...t will become the property of Barracuda Networks In connection with warranty services hereunder Barracuda Networks may at its discretion modify the hardware of the product at no cost to you to improve...

Page 225: ...et forth in your purchase order or in Barracuda Networks product catalog user documentation or Web site for the Software The BARRACUDA SOFTWARE IS NOT INTENDED FOR USE IN THE OPERATION OF NUCLEAR FACI...

Page 226: ...ter 24 hours of continuous use vii Barracuda alone will provide support for customer issues with DR6 and Microsoft and its Affiliates are released of all liability related to its use and operation and...

Page 227: ...for lack of full payment 17 Auto Renewals If your Software purchase is a time based license includes software maintenance or includes a subscription you hereby agree to automatically renew this purch...

Page 228: ...any program or other work which contains a notice placed by the copyright holder saying it may be distributed under the terms of this General Public License The Program below refers to any such progra...

Page 229: ...uivalent access to copy the source code from the same place counts as distribution of the source code even though third parties are not compelled to copy the source along with the object code 4 You ma...

Page 230: ...PERFORMANCE OF THE PROGRAM IS WITH YOU SHOULD THE PROGRAM PROVE DEFECTIVE YOU ASSUME THE COST OF ALL NECESSARY SERVICING REPAIR OR CORRECTION 12 IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREE...

Page 231: ...be individuals or organizations To modify a work means to copy from or adapt all or part of the work in a fashion requiring copyright permission other than the making of an exact copy The resulting wo...

Page 232: ...PO copyright treaty adopted on 20 December 1996 or similar laws prohibiting or restricting circumvention of such measures When you convey a covered work you waive any legal power to forbid circumventi...

Page 233: ...oduct is either 1 a consumer product which means any tangible personal property which is normally used for personal family or household purposes or 2 anything designed or sold for incorporation into a...

Page 234: ...es or a notice indicating where to find the applicable terms Additional terms permissive or non permissive may be stated in the form of a separately written license or stated as exceptions the above r...

Page 235: ...d the patent license to downstream recipients Knowingly relying means you have actual knowledge that but for the patent license your conveying the covered work in a country or your recipient s use of...

Page 236: ...y IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER OR ANY OTHER PARTY WHO MODIFIES AND OR CONVEYS THE PROGRAM AS PERMITTED ABOVE BE LIABLE TO YOU FOR DAM...

Page 237: ...in order to permit linking those libraries into non free programs When a program is linked with a library whether statically or using a shared library the combination of the two is legally speaking a...

Page 238: ...n the event an application does not supply such function or table the facility still operates and performs whatever part of its purpose remains meaningful For example a function in a library to comput...

Page 239: ...e Also you must do one of these things a Accompany the work with the complete corresponding machine readable source code for the Library including whatever changes were used in the work which must be...

Page 240: ...egrity of the free software distribution system which is implemented by public license practices Many people have made generous contributions to the wide range of software distributed through that sys...

Page 241: ...e and give away verbatim copies of the source form of the Standard Version of this Package without restriction provided that you duplicate all of the original copyright notices and associated disclaim...

Page 242: ...urce and binary forms with or without modification are permitted provided that the following conditions are met Redistributions of source code must retain the above copyright notice this list of condi...

Page 243: ...an fifty percent 50 of the outstanding shares or beneficial ownership of such entity 2 Source Code License 2 1 The Initial Developer Grant The Initial Developer hereby grants You a world wide royalty...

Page 244: ...related documentation in which You describe the origin or ownership of the Covered Code 3 4 Intellectual Property Matters a Third Party Claims If Contributor has knowledge that a license under a thir...

Page 245: ...License This License applies to code to which the Initial Developer has attached the notice in Exhibit A and to related Covered Code 6 Versions of the License 6 1 New Versions Netscape Communications...

Page 246: ...RK STOPPAGE COMPUTER FAILURE OR MALFUNCTION OR ANY AND ALL OTHER COMMERCIAL DAMAGES OR LOSSES EVEN IF SUCH PARTY SHALL HAVE BEEN INFORMED OF THE POSSIBILITY OF SUCH DAMAGES THIS LIMITATION OF LIABILIT...

Page 247: ...nditions and the following disclaimer in the documentation and or other materials provided with the distribution THIS SOFTWARE IS PROVIDED AS IS AND ANY EXPRESSED OR IMPLIED WARRANTIES INCLUDING BUT N...

Page 248: ...terms and if you retain no copies of the Software LIMITATION OF LIABILITY IN NO EVENT SHALL AMCC AND BARRACUDA NETWORKS OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING WITHOUT LIMITAT...

Page 249: ...ork but excluding communication that is conspicuously marked or otherwise designated in writing by the copyright owner as Not a Contribution Contributor shall mean Licensor and any individual or Legal...

Page 250: ...computer failure or malfunction or any and all other commercial damages or losses even if such Contributor has been advised of the possibility of such damages 9 Accepting Warranty or Additional Liabi...

Page 251: ...ear in all copies THE SOFTWARE IS PROVIDED AS IS AND NOMINUM DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS IN NO EVENT SHALL NOM...

Page 252: ...the Work as stated below a You may use the standard version of the Source Code or Executable Files in Your own applications b You may apply bug fixes portability fixes and other modifications obtained...

Page 253: ...atically upon any breach by You of any term of this License Individuals or entities who have received Derivative Works from You under this License however will not have their licenses terminated provi...

Page 254: ...used in advertising or otherwise to promote the sale use or other dealing in this Software without specific written prior permission Title to copyright in this Software shall at all times remain with...

Page 255: ...code The SSL documentation included with this distribution is covered by the same copyright terms except that the holder is Tim Hudson tjh cryptsoft com Copyright remains Eric Young s and as such any...

Page 256: ...OVIDED HEREUNDER IS ON AN AS IS BASIS AND THE UNIVERSITY OF CALIFORNIA HAS NO OBLIGATIONS TO PROVIDE MAINTENANCE SUPPORT UPDATES ENHANCEMENTS OR MODIFICATIONS Barracuda Networks Products may contain p...

Page 257: ...vis and the first part covers all code written during this time From 2001 onwards the project has been based at SourceForge and Networks Associates Technology Inc hold the copyright on behalf of the w...

Page 258: ...t Holder and derivatives of that collection of files created through textual modification Standard Version refers to such a Package if it has not been modified or has been modified in accordance with...

Page 259: ...istribution The name of the author may not be used to endorse or promote products derived from this software without specific prior written permission THIS SOFTWARE IS PROVIDED BY THE AUTHOR AS IS AND...

Page 260: ...Redistribution and use in source and binary forms are permitted provided that the above copyright notice and this paragraph are duplicated in all such forms and that any documentation advertising mate...

Page 261: ...promote products derived from this software without specific prior written permission THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS AS IS AND ANY EXPRESS OR IMPLIED WARRANTIES INCLUDING B...

Page 262: ...S SOFTWARE EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE Barracuda Networks Products may include programs that are covered by the BSD License 1 Redistributions of source code must retain the above...

Page 263: ...esponding modified Vim or as long as possible e When the GNU General Public License GPL applies to the changes you can distribute the modified Vim under the GNU GPL version 2 or any later version 3 A...

Page 264: ...ar in the software itself in the same form and location as other such third party acknowledgments 4 Except as contained in this notice the name of The XFree86 Project Inc shall not be used in advertis...

Page 265: ...used to build Barracuda products available at source barracuda com This directory includes all the programs that are distributed on the Barracuda products Obviously not all of these programs are utili...

Page 266: ...264...

Page 267: ......

Page 268: ......

Search results

Summary of Contents for NG Network Access Client SP4

Reviews:

Related manuals for NG Network Access Client SP4

Brands by name

Popular brands

Barracuda Networks NG Network Access Client SP4, Administrator'S Manual

Search results

Summary of Contents for NG Network Access Client SP4

Reviews:

Related manuals for NG Network Access Client SP4

Brands by name

Popular brands