Transcription
Configuration and Advanced ConceptsBarracuda SSL VPNBarracuda Networks Confidential1
Agenda OverviewAccess ControlResourcesDeploymentAdvanced ConceptsBarracuda SSL VPN2
OverviewBarracuda Networks Confidential3
Web Interfaces – Appliance and SSL VPN Appliance Interface connects over port 8000– Used for network configurations– SSL certificate uploads– Troubleshooting, EU, and firmwareupdates SSL VPN Interface connects over HTTPS– Client login for resource access– Admin login to configure resources,authentication, and policies
Upload SSL Certificate From the Appliance Interface– Obtain a Certificate Authority (CA) signed SSL certificate to upload toyour device– First generate a CSR– Download the CSR and submit to the CA– Upload Signed Certificate - Use this boxto upload the certificate (in PEM/Apacheor PKCS12 format) that you receivedfrom your certificate authority.
Barracuda SSL VPN Agent Lightweight Java based VPN client Needed for more complex applications– Drive mapping– Proxying of rich Web applications– Remote Desktop sessions Launched automatically when required Terminated when sessions are no longer active
Barracuda SSL VPN Agent Dependencies––SSL capable web browser withJava installedJava 1.1 is supported, althoughJava 1.5 is recommended Windows Specific–––––––––Microsoft RDPEricomFirefox portable (not yet released)PuTTYPuTTY portable telnetPuTTY portable SSHRAdminUltraVNCWinSCP Mac Specific–Mac RDC Linux Specific–RDesktop OS independent (Java based)––––––––Citrix ICAElusiva RDPJTANX ClientRDPTN5250VNCUNITTY (SSH Client)
Access ControlBarracuda Networks Confidential8
User Database Internal user database, or synchronize with:––––Active DirectoryEnhanced Active DirectoryLDAPNIS OU Filter– List accounts and roles onlyfrom OU’s that are selected.– Exclude OU’s that are notneeded.– Ability to exclude builtingroups
Policy Based Management Permission to access resources aregranted via policies, which in turncontain a set of logical groupingsACCESS RIGHTSUSER DATABASE A policy grants access to a set ofusers and/or groups to selectedresources.ADLDAP All resources must be attached to apolicy; furthermore, in order for auser to access a particular resource,their user account or group mustalso be attached to the same Policy.A user or group can be a member ofmultiple policies, and resources canbe attached to multiple policies.This way, it is possible to easily setup a powerful set of permissions forall users of the TION SCHEMESNISACCOUNTS/GROUPSPASSWORDONE-TIME PASSWORDUSERSNETWORKCONNECTDISTRIBUTION GROUPSRADIUSIP AUTHENTICATIONCLIENT CERTIFICATE
Authentication Schemes Methodologies of validating user credentials submitted by theclient browser against the user database. Support for eight modules, which may be used individually or incombination with one another, to create entication KeyClient CertificateIP AuthenticationOne-Time Password (Secondary)PasswordPersonal Questions (Secondary)PIN NumberRadius
Authentication Schemes Two types of Authentication Modules: Primary and Secondary– Primary Authentication Module may appear anywhere in the list of selectedmodules– Secondary Authentication Module may only appear after a primary AuthenticationModule.– Support for many Authentication Modules, which may be used individually or incombination with one another to create authentication schemes.– Once an authentication scheme has been created, it is applied to a policy– A user can be a assigned multiple authentication schemes. For example, a userauthenticating with their password, hardware token, and coming from a trustedIP, will be granted additional resources than just authenticating with a password.
Authentication Schemes Authentication Key––Authentication keys are generated on your Barracuda SSL VPN and are passed out to users viacomputer or a USB flash drive.When authenticating using this module, the Barracuda SSL VPN will scan client drives for theauthentication key or ask the user to provide a path to the key's file.
Authentication Schemes Client Authentication– Client certificate authentication is a mechanism of authenticating againstan SSL certificate stored in the client browser– Client certificates can be generated by the Barracuda SSL VPN or byother keystores such as Active Directory.– Automatic authentication process requiring minimal interaction– The user is required to install the certificate into the browser– Future access only requires the user to select the certificate during logon
Authentication Schemes IP Authentication–––IP authentication determines and validates the IP address of client during logon.Per user IP restrictions can be configured by navigating to Access Control Accounts, selecting theappropriate user, and clicking on the edit icon adjacent to the user's name.Under the section Authorized IP you can enter in a specific address, a CIDR network range, or a wildcardaddress to restrict from which IP addresses the user can log on.
Authentication Schemes One-Time Password–––One-time password authentication sends a randomly generated password to the user via email orthrough SMS.This is a secondary authentication scheme meaning it can not be the primary or only mode ofauthentication.OTP is configured on the Advanced Configuration page.
Authentication Schemes Password– The password module authenticates using a typical username / passwordpair.– This is the most commonly used Authentication Scheme. Personal Questions– Under the Personal Questions module the user is presented with apersonal security question selected at random.– Security questions, such as Mother's Maiden Name, can be configuredby the user on his or her attributes page within the Barracuda SSL VPNweb user interface. PIN Number– The PIN number authentication module uses a string of digits as apassphrase for a user.
Authentication Schemes Radius–––The RADIUS (Remote Authentication Dial In User Service) authentication module allows the BarracudaSSL VPN to authenticate users against an external RADIUS server.Radius authentication is used with RSA SecurID, VASCO, Secure Computing and CryptoCard. The useof hardware token authentication allows for access using a one-time password token.Radius Configuration is made on the Advanced Configuration tab.
Access Rights Allow a super user to delegate administration tasks to normallyunprivileged users. This is fully modular; required rights can be delegated asneeded without compromising other more sensitive areas of thesystem. There are three types of access rights:– Personal rights, which change the ability for a user to edit or use itemson their account, such as maintaining attributes, using the Agent etc.– Resource rights, which control access to edit, create and deleteresources on the system.– System rights, which give access to system configuration options.
Access Rights To create a access right, login with the ssladmin account and navigate toAccess Control Access Rights.––––Select the Type of access right that you wish to create.You can add available rights by highlighting desired rights and clicking the Add button to move them to the right handcolumn.Select the policies to which you would like to attach the access right as a resource, and click Add to move them to theright hand column.Review the settings that you created and click Add to make the rights available.
Access Rights Since this user is a member of the IT Admins Policy, he can now configure/manage resources. Notice how he does NOT have access to other configs like Access Control or the Advanced tab
ResourcesBarracuda Networks Confidential22
Resources Resources are the main entities an end user willwant to access once connected to the BarracudaSSL VPN.Within the Barracuda SSL VPN, a resource isdefined as an application, utility, data source, orany other privileged data source or interface thatwhen assigned will allow the user to conductcertain tasks.The following types of resources are available––––––Web ForwardsNetwork PlacesApplicationsSSL TunnelsProfilesNetwork Connect
Resources Web Forwards– Proxy any intranet Web site– Rich web applications (OWA) supported– Four web forwarding techniques: Tunnelled ProxyHost-based Reverse ProxyPath-based Reverse ProxyReplacement Proxy
Web Forwards Tunneled Proxy– A tunneled proxy uses the SSL VPN Agent to open up atunnel from the local client to the destination web URL.– This type of forward does not modify the data stream, butwill only work as long as all links stay on the samedestination host (external links will jump out of thetunnel).
Web Forwards Path-based reverse proxy– Generally the best proxy type to use, if possible.– A path-based reverse proxy web forward only works forweb sites that exist solely in sub-directories of the root ofa web server.– This type of forward does not modify the data stream.– The proxy works by matching unique paths in the requestURI with the configured web forwards.– For example, if you have a web site that is accessiblefrom the URL http://example.com/blog you can configurethe reverse proxy web forward with a path of /blog sothat all requests to the SSL VPN server URLhttps://sslvpn/blog are proxied to the destination site.– This type of proxy will only be suitable if you know thepaths used by the web application. If your web site runson the root of the web server, i.e. http://example.com,there are no defined paths to proxy so another methodwill have to be used.
Web Forwards Host-based reverse proxy– A host-based reverse proxy works in a similar way to apath-based reverse proxy, but is not restricted tosubdirectories. However, the host must resolve properlyvia DNS.– Can be used to tunnel traffic for sub domains and otherhosts where the site does not have a path to identify.– This means that web sites working on the root of a webserver, https://webapp.example.com cannot be proxiedautomatically by the Reverse Proxy because there is nopath to identify. To get around this we have developed afeature called Active DNS which modifies the hostnameof the request so that we can identify the correctresource to forward to.
Web Forwards Replacement proxy– A replacement proxy is generally used if any of the otherweb forward types cannot be used.– This proxy type attempts to find all links in the web sitecode and replace them with links pointing back to theSSL VPN server.– Due to the number of ways it is possible to create links(in many different languages), this proxy type is notalways successful.– However, it is possible to create custom replacementvalues to get a web site working via a replacement proxyweb forward.
Network Places Access Windows, SFTP and FTP filesystemsMap drives using the SSL VPN AgentEdit files directly across the SSL VPNSingle Sign on using username and password variablesAutomatically detects which type of network share that isbeing configured.
Network Places There is a choice of Automatic, Windows Network, FTP or SFTP.Automatic attempts to detect which type to use. For example, entering\\server\share will set the type to Windows Network, enteringftp://host will set it to FTP. Optionally, you may select to override default permissions andbehaviors on the share; this includes showing hidden files, setting theshare to read-only, showing folders inside the share, and preventingusers from deleting files or folders. You may also decide to set a Drive Letter for this share. This featurewill only be utilized by Windows clients; upon launch the Java agentwill mount the share as a mapped drive.
Applications An application is a resource which uses the SSL VPNAgent to open a tunnel to a destinationBuiltin Applications––––––Citrix Published AppRemote Desktop (Microsoft/Mac/Linux)VNCWinSCPPutty (SSH Client)TN5250 AS/400 Terminal Emulator
SSL Tunnels Tunneling is a method of transmission over networks based ondiffering protocols.An SSL tunnel will use the Barracuda SSL VPN Agent to openup a tunnel from a port on the client machine to a port on thedestination machine, which will direct traffic from the clientthrough the tunnel to the destination machine.The flexibility and "on-demand" nature of tunnels over theBarracuda SSL VPN make them more desirable and securethan permanently opening ports on an external firewall, orgranting a client machine unrestricted network access via atraditional VPN.
SSL Tunnels Login to your Barracuda SSL VPN using your administrator login credentials, andnavigate to Resources SSL Tunnels.Enter a unique Name. Optionally you may add the tunnel to your favorites, or setit to start automatically on login.Enter a Source Interface, a Source Port, a DestinationHost, and a Destination Port.Select the appropriate policy or policies to which youwill attach the tunnel by selecting the name andclicking on the Add button.Review the settings, and if everything is correctclick Add.
Profiles A profile provides a means for an administrative user toalter the general working environment of the system.Settings in a profile can alter the timeouts of a usersession, change the default view for resources (icons orlists) and also affect agent timeouts and proxy settings.Users can select different profiles upon login, oradministrators can manage default environment settingsfor users.
Barracuda Network Connector Provides SSL VPN users with full network connectivity Provides an OSI layer 2 or 3 secure network extension Easy-to-configure network interface with minimal maintenanceoverheads.Barracuda SSL VPN35
Barracuda Network Connector Configuration– Review the automatically generated settings for Networkand IP Address and modify them if appropriate.– You should select a DHCP range that contains a sufficientnumber of addresses concomitant with the number of usersyou expect to use the Network Connect featureconcurrently.– Select the policies to which you would like to attach theresource and click Add. Once you have finished, clickSave.– Add a route for the client configurationBarracuda SSL VPN36
Barracuda SSL VPN Server Agent Create site-to-site links betweenbranch offices Provide access to resources onsystems outside the LAN Eliminates the requirement for a fullnetwork connection to secure remotesites where only a few services arerequired
Barracuda SSL VPN Server Agent The Server Agent acts as a proxy directing traffic from the appliance to theremote system.A Server Agent can be installed on a remote network and connect back tothe appliance using the standard HTTPS port. With the configuration ofroutes an administrator can then set up resources that access services onthe remote network without the need to open up a single port on the firewallprotecting the remote network.This same process can be used to access resources inside the LAN from aBarracuda SSL VPN residing in a DMZ.
DeploymentBarracuda Networks Confidential39
Plug and Play Deployment Inside The LAN– Route incoming connections to firewall on port 443 directly to theBarracuda SSL VPN– Simple firewall, port forwarding and NAT rulesBarracuda SSL VPN40
Plug and Play Deployment In The DMZ– Only port 443 on external firewall needs to be open– Ports on internal firewall need opening depending on the services that willbe offered to usersBarracuda SSL VPN41
Advanced ConceptsBarracuda Networks Confidential42
Barracuda SSL VPN Agent Lightweight Java based VPN client Needed for more complex applications– Drive mapping– Proxying of rich Web applications– Remote Desktop sessions Launched automatically when required Terminated when sessions are no longer active
Barracuda SSL VPN Agent Dependencies––SSL capable web browser withJava installedJava 1.1 is supported, althoughJava 1.5 is recommended Windows Specific–––––––––Microsoft RDPEricomFirefox portable (not yet released)PuTTYPuTTY portable telnetPuTTY portable SSHRAdminUltraVNCWinSCP Mac Specific–Mac RDC Linux Specific–RDesktop OS independent (Java based)–––––––Citrix ICAElusiva RDPJTANX ClientRDPTN5250VNC
Configure a Web Forward for OWA 2003 Exchange 2003Corp OWA for Example Destination URL uth.dll and the paths that areadded are /exchange and /exchweb.With the standard Reverse Proxy feature, web sites are proxied by identifying thepath of the request and mapping this to a back end web server. For example, toproxy Outlook Web Access we identify two paths /exchange and /exchweb.When SSL-Explorer receives a HTTP request ee we look at the path of theURI and match it against the paths configured for all Reverse Proxy resources.Since this resource URI starts with /exchange it must be destined for the OutlookWeb Access application.
Configure a Web Forward for OWA 2007 Choose path-based reverse proxy for the web forward typeCorp OWA for Example Destination URL ishttps://owaserver/owa/auth/logon.aspx and the paths that are added are /owa.With the standard Reverse Proxy feature, web sites are proxied by identifyingthe path of the request and mapping this to a back end web server. Forexample, to proxy Outlook Web Access we identify the path /owa.Single Sign on can be posted using form-based authentication by adding thefollowing form parameters–––––––Destination https://owaserver/owaFlags 4Forcedownlevel 0isUtf8 1Password {session:password}Trusted 4Username DOMAIN {session:username}
RPC Over HTTPS Allows full Outlook MAPI clients to connect to Exchange Servers usingHTTP/HTTPS.This solves the problem remote Outlook users have when located behindrestrictive firewalls.Outlook clients can then use the SSL VPN server as a proxy for MicrosoftExchange traffic.To configure Outlook RPC, navigate to Advanced Configuration, and scrolldown to the Outlook header at the bottom of the page.Enter the IP address of hostname of your Exchange server in the ExchangeServer field.Enter the port in the Exchange Port field, and select the Protocol asappropriate to your environment.
Configure Web Folders – Windows Access When using Windows XP or later along with Internet Explorer, you can takeadvantage of Microsoft Web Folders to access your file resources.For security the Barracuda SSL VPN only allows Web folders to be mapped toexisting network places.This enforces the policy restrictions; if a user does not have a policy whichallows them to access a given network place then they can neither create a Webfolder to it.To Configure–First check the box on the Advanced- Configuration, ‘Allow externalWebDAV clients’ box in the resources section.–Next create a Network place in windows to the address and folder nameof the SSL VPN appliance, https://remoteserver.co.uk/fs/cifs/Public–*Be aware that Windows Web Folders exhibits behavior that is insecure when thisoption is enabled. You will find that it is effectively impossible to logout of an externalWebDAV session. The user simply has to click Cancel when asked to authenticate,and access will be allowed.This is because Windows caches your the credentials andsimple re-presents them when the SSL VPN requests authentication again.
Configure a One-Time Password One-time password authentication works by sending arandomly generated password to the user via email orSMS.One-time password authentication must be used inconjunction with at least one other primary method.Configuration––––Navigate to Advanced Configuration.Scroll down to the section entitled SMTP. Ensure that SMTP is enabled onstartup and that the email server details have been entered correctly.In the One Time Password section, modify the following settings to suityour environment.Generally the default settings should meet the needs of most users.
Configure IP Authentication There may be a t
– Client certificate authentication is a mechanism of authenticating against an SSL certificate stored in the client browser – Client certificates can be generated by the Barracuda SSL VPN or by other keystores such as Active Directory. – Autom
