SonicWALL SonicWALL UTM Appliance manual

LDAP Leveraging LDAP Groups/ Use rs with SonicWALL UTM Appliance Contents Contents ....................................................................................................................... ....................................... 1 Integrating LDAP/Active Dire ctory with S onicwall UTM ..................................................[...]

2 Blocking IM Traffi c Categorically .............................................................................................. ................. 51 Applying Granular IM Policies .................................................................................................. ................. 52 Applying VPN Access Polici es to Groups/Us ers [...]

3 Integrating LDAP/Active Directo ry with Sonicwall UTM SonicOS supports a range of different LDAP se rvers, the most popular being Active Directory (AD). AD i s also an LDAP implementation. Please refer to the followin g pape r as a supplement on how to configure L DAP settings. http://www.sonicwall.com/downloads/LD AP_Integration_Feature_Module.p[...]

4 Exporting the CA Certificate fr om the Active Directory Server To export the CA certificate from the AD server: Step 1: Launch the Certification Authority application: Start > Ru n > cer tsrv.msc . Step 2: Right click on the CA you creat ed and select Properties. Step 3: On the General tab, click the View Certificate button. Step 4: On the [...]

5 Step 5: On the Settings tab of the LDAP Configuration win do w , configure the following fields: • Name or IP Address – The FQDN or the IP address of the LDA P serve r against which you wish to authenticate. If using a name, be certain that it c an be resolved by your DNS server. Also, if using TLS with the ‘Require valid certificate from s[...]

6 • Send LDAP ‘Start TLS’ Request – Some LDAP server implementations suppo rt the Start TLS directive rather than using native LDAP over TLS. This allows the L DAP se rver to listen on o ne port (normally 389) for LDAP connections, and to switch to TLS as direct ed by the client. Active Directory does not use this option, and it should only[...]

7 Selecting any of the predefined schemas will automat ically populate the fields used by that schema with their correct values. Selecting ‘User Defined’ will allow you to specif y your own values – use thi s only if you have a specific or proprietary LDAP schem a co nfiguration. • Object class – Select the attribute that represents the i[...]

8 • Primary Domain – The user domain used by your LDAP implementation. For AD, this will be the Active Directory domain n ame, e.g. yourADd omain . c om. Chan ges to this field will, optionally, automatically update the tree information in the rest of the page. This is set to mydomain.com by default for all schemas except Novell eDirecto ry, fo[...]

9 trees are best ordered with those on the primary server first, and the rest in the same order that they will be referred. NOTE : When working with AD, to determine the location of a user in the dire ctory for the ‘User tree for login to server’ field, the directory can be searched manually from th e Active Directory Users and Settings control[...]

10 Step 10: On the LDAP Users tab, configure the following fields: • Allow only users listed locally – Requires that LDAP users al so be present in the SonicWALL local user database for logins to be allowed. • User group membership can be set locally by duplicating LDAP user names – Allows for group membership (and privileges) to be determi[...]

11 In the LDAP Import User Groups dialog box, sele ct t he checkbox for ea ch group that you want to import into the SonicWALL, and then click Save. Having user groups on the SonicWALL with the sa me name a s existing LDAP/AD use r grou ps allo ws SonicWALL group membership s an d privileges to be granted upon succe ssful LDAP authentication. Alter[...]

12 Step 11: On the LDAP Relay tab, configure the following fields: The RADIUS to LDAP Relay feature is d esig ned for use in a topology where there is a central site with an LDAP/AD server and a central SonicWALL wi th remote satellite sites connected into it via older low-end SonicWALL security appli ances that may not support LDAP. In that case t[...]

13 configurable. Step 12: Select the Test tab to test the configured LDAP settings: The Test LDAP Settings page allows for the configured LDAP sett ings to be te sted by attempting authentication with specified user an d p assword credentials. Any user group membershi ps and/or framed IP address configured on the LDAP/AD server for the user will be[...]

14 Logon to Appliance – Configuring User Level Authentic ation Settings This is the other method of authenticating users, and requi res the user to login to the appliance. Please refer to the following paper for more details on ULA: http://www.sonicwall.com/downloads/So nicOS_St andard_2.1_User-Level_A uthentication.pdf In this example, the LAN z[...]

15 Step 5: Click Add , then create the following two rules as de picted below. The order is importan t. The new first rule allows any DNS queries out. The new second rule forces all users (Everyone) to be challenged before accessing the Intern et for HTTP only. NOTE : This configuration will allow any traffic out othe r than HTTP, even withou t fir[...]

16 NOTE : The difference between “All” and “Everyone ” in a polic y rule. Selecting “All” will allow all matching traffic, regardless from an authenticated user or n ot. Se lecting the “Everyone” user group will allow traffic from any logged in user, but not from a user who ha s not lo gged in.[...]

17 If everything is working correctly, you should then see users authenticated on the Log>Vie w page. SonicOS Options That Lev erage Groups/Users Now that we have a means of authent i c ating users to the SonicWALL firewall, we can leve rage the groups/users that are in LDAP/Active Directory for a myriad of options: • Create firewall rules fo [...]

18 • Rule processing stop s a s soon as there is a match (with some cave ats – see below) • Rule logic first looks at Source, then Destination, Service, and Action. If there is a match the re, rule processing st ops a nd then further subset rule processi ng can happen (rul es set for schedules, users/ groups, or BWM) for that specific rule . [...]

19 allowed access throug h it. Matching traffic from the user or me mbers of the user grou p will be given access, and matching traffic from anyone else will be denied access. For multiple user groups to be all owed access, create a single parent gro u p user containing all of them as members and set a si ngle rule specifying that parent group as t[...]

20 Firewall Rules with Bandwidth Mana gement & Logging It is possible to leverage FW rules simpl y for logging and/or bandwidth manag ement (BWM). To enable BWM, it is first necessary to go to Network > Interfac es and configure the WAN interface. Click the Advanced tab, and then enable ing ress an d egress rates for your net work. These rat[...]

21 After BWM is enabled on the WAN interface, a new ta b is displayed within FW rule creation: the Ethernet BWM tab. You can now enable BWM on a rule by rule basis setting a g uaranteed bandwidth rate (Kbps) or %, a maximum rate or %, priori ty, and tracking of bandwidth usage. In the below screenshot, we have restricted POP email to maximum of 100[...]

22 NOTE : You can create a firewall rule for any given user /group and rest rict that group’s overall bandwidth for any network service/protocol. Con sider also us ing Application Firewall which allows mo re granular control of bandwidth policies. Blocking Websites (Dom ain Names ) for Groups/Users Enhanced SonicOS has a f ew me chanisms at your [...]

23 Step 2: Create an AO for yahoo.com. Step 3: Now, create an AO Group and add the ap propriate AOs to this group.[...]

24 Step 4: Next, create an FW rule that will deny traffic to the Blocke d Sites AO Group. Allowing Specific Domains and Blocking All Others with Firewall Rules With firewall rules you can block HTTP/HTTPS traffic for all traffic except for the defined list you’ve created. First, create the address objects of the websites you want to allow. In the[...]

25 Step 2: Create an AO for Mysonicwall.com. Whil e u sing a FQDN is often more “friendly”, in this example we’ve chosen the IP address. Step 2: Create an AO Group for the Allowed site s. Step 3: Navigate to Firewall > Access Rules .[...]

26 Step 4: Create a rule to allow HTTP traffic for your all owed lists.[...]

27 Step 5: Do the same for HTTPS.[...]

28 Step 6: Create the deny rules for HTTP and HT TPS.[...]

29 The firewall rules should now loo k like the belo w pi cture: NOTE: that the downside to using F W rules to block/allow we bsites is that if a user is a member of differe nt groups in LDAP, and if different rules are created for different grou ps, it can cause undesirable behavio r for a given user. Firewall rules are processed from top do wn an[...]

30 Blocking HTTPS (SSL) Domains with SSL Control With Secure Socket Layer (SSL) Control it is possi bl e to whitelist an d blacklist HTTPS domains, as well as other SSL services, based on key words i n their certificate. SSL control ca nnot be enforced at the group/user level, only at the ZONE level. For example, if y ou enabled SSL control on the [...]

31 ever decreasing cost and complexity of SSL, however , has also spurred the growth of more dubiou s applications of SSL, designed prim arily for the pu rposes of obfuscation or concealment rather than security . An increasingly common camouflage is the use of SSL encrypted Web -based proxy servers for the pu rpose of hiding browsing details, and [...]

32 Step 1: To configure the Whitelist and Blacklist naviga te to Firewall > SSL control > click the Configure button to bring up the following window: Entries can be added, edited and delete d with the but tons beneath each list wind ow. List matching will be based on the subject common name in the certificate presen ted in the SSL exchange, [...]

33 Applying Differen t CFS Policies to Gr oups It is important to understand what CFS is capabl e of (as of SonicOS 5.2). CFS is a subscri ption based service that allows administrators to block domai ns b as ed on category ratings. The Premium CFS features over 50 different categories to choose from. Soni cWALL maintains and categorizes a list of [...]

34 CFS has the ability to allow or block domains by thei r fully qualified domain n ame (FQDN) or by keywords in their FQDN. This functionality does not require a sub scription to CFS. This list is a single master list that can be enforced on any given CFS policy. As you create a dditional CFS policies, ea ch policy ha s the ability to leverage the[...]

35 NOTE: If you wish to forbid or allow HTTPS domains, us e of their IP address must be used in CFS. FQDN does not work for HTTPS sites in the CFS Custo m List. For example, I was able to forbid paypal.com with the use of these 3 IP addresses. (This list may not be representative of all IPs for paypal) Using the forbidden domains list doesn’t req[...]

36 Step 1: Under the C FS tab, enable the IP based HTTPS content filtering. This enables CFS f or HTTPS domains. This is important if you wish to block sites such a s HTTPS://www.fac ebook.com or proxy sites such as HTTPS://megaproxy.com. Step 2: Navigate to the Policy tab and add a ne w CFS policy.[...]

37 Step 3: Create a friendly name for the new poli cy. Step 4: Navigate to the URL List tab and sel ect the categories you want to block or allo w for this policy. Step 5: Navigate to the Settings Tab a nd sel ect if you want to enforce allowed domains, forb idden domains, or keywords in domains. You can also choose to enforce Safe Search (Safe Sea[...]

38 default of “moderate” to “strict” filtering on Google however. Step 6: Select if you want the CFS Policy to only run at certain times of the day. For example, you might allow access to social networki ng sites betwe en 12-1 for lun ch brea k, but rest rict access the remainder of the time.[...]

39 Step 7: Next nav igate to Users > Local Groups and configure the Group you want the new CFS policy to apply to. Step 8: Select the CFS policy you created under the CFS Policy tab. Repeat this same p ro ce ss fo r every group that requires custom CFS settings. Enforcing CFS Policies without Requiring All Us ers to Authenticate There is one mor[...]

40 Step 1: Navigate to Network > Network Interfac es. Configure the respective interfaces you wish to support local authenticatio n on by enabl ing HTTPS user login. Step 2: Navigate to Security Services > Content Filter. At the bottom of the page is the html code that can be customized. Provided below is some sample co de that you can modify[...]

41 Basic Sample Code for SonicOS 5.2 ----*snipped*---- (with virtual sci ssors ☺ ) <tr><td align=center nowrap><font size="2" col or="#000000"><br> If you believe the below web site is rated incorrec tly click <a href="HTTP://cfssupport.sonicwall.c om" target='new'>here </a&[...]

42 NOTE : Use caution the website you are r edi re cting isn’t on the CFS list or blocked domains. It would create a looping situation. <html> <head> <meta HTTP-equiv="Content-Ty pe" content="text/html"> <title>SonicWALL - Web Site Blocked</title> <style type="t ex t/css"> body { b[...]

43 </div> </div> <div id="popup_box_text"> <table align=center cell padding=5 widt h=8 0%> <tr><td align=center><font size="2" colo r=" #000000"> <br> <script> <!-- var blockedURL = new String(docume nt.URL); blockedURL = blockedURL.replace(/</g , "&l[...]

44 Sample JavaScript Code for SonicOS 5.2 In this example, “blockedURL” is the variable that refe rences the URL the client wa s trying to browse to. In this example, we are looking for facebo ok, and the n ta king a unique action for that URL. You could use this to redirect users or take custom actions again st a defined list of URLs. if (bloc[...]

45 Applying Application Firewa ll Polices to Groups/Users Application Firewall is a very flexible tool to manage application specific traffic. The goal of this guide is to demonstrate how Application Firewall can be applied to different groups/ users. We will use Application Firewall to block domains for spe cific groups in this exam ple. More exam[...]

46 When lookin g for a HTTP Hos t, you can get sp ecific wi th a FQDN or leave it more general with a partial match. With the below example, websites with monster in the URL will be blocked. That would be monster.com, monsters. co m, and so fort h.[...]

47 Step 3: Navigate to Policies and add a new policy. Give the policy a friendly name. Select the Application Object that was just created “Blocked Domains”. The action we will take in this example is “drop/reset”. You can then select the grou ps you wish to include or exclude from the policy. The direction of traffic will be outgoing.[...]

48 When a user attempts to navigate to monster.com, they will be presente d with a page cannot be displayed message. Alternatively, you can have the blocked domains redi rect to another web page or displ ay a custom block page. Step 5: Navigate to Actions under Application Fire wall and create a new Action to redirect users.[...]

49 Step 6: Navigate to Application Fire wall > Policies and chang e the action from reset/drop to the new custom action. If you wish to display a block page instead, creat e a new ac tion with HTTP Block Page. You can either insert text in the content or html markup to customize it further . Select the action under the Policy to use the new HTTP[...]

50 Tightening Control over the Bro wsing Behavior of Users Now that we’ve looked at the different ways to restrict browsin g and web behavior thro ugh dif ferent mechanisms, I’m sure ide a s are spinning in your head on ho w you can apply these policies i n your environment. I want to close the topic of web browsing with a small bit of advice. [...]

51 • Turn on Gateway AV and Antispyware – turn all settings o n. If you really want to block everything, the most drastic step you can take is to unplug the firewall from the wa ll. Applying Intrusion Prevention Serv ice Signatures to Group s/Users There are 2 different methods of leveraging IPS signat ures . The first method is with Applicatio[...]

52 NOTE : You can change the Prevention and Detectio n from t he glo bal settings and adjust other setting s such as the schedule when the sign ature i s enabled. For exam ple, some organizati ons want to allow IM traffic for everyone during lunch hours but deny it outside of those ho urs. Applying Granular IM Policies Now if you wanted to prevent [...]

53 Applying VPN Access Policies to Groups/Users SonicOS 5.2 supports 2 VPN client s; Gl obal VPN Cli ent (GVC), an IPSec client and NetExtender, a SSL-VPN client. Both clients can utilize LDAP groups/users fo r authentication and access, but each does it in a slightly different manner. Global VPN Client (GVC) We will configure the WAN GroupVPN to s[...]

54 NOTE : Depending on how you setup yo ur group member ship, being a member of this group does not automatically grant those users VPN access. Step 2: Navigate to Users > Local Grou ps an d configure the group(s) that require VPN access. Under the VPN Access tab select the ne twork(s) or address obje cts that group wi ll have VPN access to. By [...]

55 SSL-VPN (NetExtender) SonicOS 5.2 introduces SSL VPN functionality via NetExtender. NetExtender is a light weight client that can run on Windows, Linux, Mac, and Wi ndo ws Mobile devices. It can easily be installed by directing the client to the URL of the WAN interface. To configure SSL-VPN LDAP authenticati on, place the LDAP group(s) that nee[...]

56 Guest Services (Wireless Guest Serv ices) SonicOS supports Guest Services. Gues t services are typically used in wireless hotspot deployments, but they can also be used in scenario s such as guest clients needing to plug into the wired LAN i nfrast ructure. As of SonicOS 5.2, WGS is not supported on the LAN zo ne, ho wever there is workaround. W[...]

57 It’s not that hard of a stretch to see that if you are using LDAP integrati on, you could essentially build guest accounts and profiles in LDAP and then leverag e that gue st group in the same ways we’ve shown above. However, that may be more time consuming then ne cessary for administrators, espe cially when guests come and go frequently. S[...]