DIGIPASS Authentication for FortiGate IPSec VPN - Vasco
DIGIPASS Authentication for FortiGate IPSec VPN - Vasco
DIGIPASS Authentication for FortiGate IPSec VPN - Vasco
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
INTEGRATION GUIDE<br />
<strong>DIGIPASS</strong> <strong>Authentication</strong> <strong>for</strong><br />
<strong>FortiGate</strong> <strong>IPSec</strong> <strong>VPN</strong>
Disclaimer<br />
<strong>DIGIPASS</strong> <strong>Authentication</strong> <strong>for</strong> <strong>FortiGate</strong> <strong>IPSec</strong> <strong>VPN</strong><br />
Disclaimer of Warranties and Limitation of Liabilities<br />
All in<strong>for</strong>mation contained in this document is provided 'as is'; VASCO Data Security assumes no<br />
responsibility <strong>for</strong> its accuracy and/or completeness.<br />
In no event will VASCO Data Security be liable <strong>for</strong> damages arising directly or indirectly from any<br />
use of the in<strong>for</strong>mation contained in this document.<br />
Copyright<br />
Copyright © 2010 VASCO Data Security, Inc, VASCO Data Security International GmbH. All<br />
rights reserved. VASCO ® , Vacman ® , IDENTIKEY ® , aXsGUARD, <strong>DIGIPASS</strong> ® and ® logo<br />
are registered or unregistered trademarks of VASCO Data Security, Inc. and/or VASCO Data<br />
Security International GmbH in the U.S. and other countries. VASCO Data Security, Inc.<br />
and/or VASCO Data Security International GmbH own or are licensed under all title, rights and<br />
interest in VASCO Products, updates and upgrades thereof, including copyrights, patent<br />
rights, trade secret rights, mask work rights, database rights and all other intellectual and<br />
industrial property rights in the U.S. and other countries. Microsoft and Windows are<br />
trademarks or registered trademarks of Microsoft Corporation. Other names may be<br />
trademarks of their respective owners.<br />
1 <strong>DIGIPASS</strong> <strong>Authentication</strong> <strong>for</strong> <strong>FortiGate</strong> <strong>IPSec</strong> <strong>VPN</strong>
<strong>DIGIPASS</strong> <strong>Authentication</strong> <strong>for</strong> <strong>FortiGate</strong> <strong>IPSec</strong> <strong>VPN</strong><br />
Table of Contents<br />
Disclaimer ...................................................................................................................... 1<br />
Table of Contents ........................................................................................................... 2<br />
Reference guide ............................................................................................................. 3<br />
1 Reader ...................................................................................................................... 4<br />
2 Overview................................................................................................................... 4<br />
3 Problem Description ................................................................................................. 4<br />
4 Solution .................................................................................................................... 4<br />
5 Technical Concept ..................................................................................................... 5<br />
5.1 General overview .................................................................................................. 5<br />
5.2 <strong>FortiGate</strong> prerequisites ........................................................................................... 5<br />
5.3 IDENTIKEY SERVER Prerequisites ............................................................................ 5<br />
6 <strong>FortiGate</strong> configuration ............................................................................................. 6<br />
6.1 RADIUS configuration ............................................................................................ 7<br />
6.2 Group configuration ............................................................................................... 8<br />
6.3 <strong>IPSec</strong> configuration ............................................................................................... 9<br />
6.4 Firewall configuration ........................................................................................... 11<br />
7 FortiClient configuration ......................................................................................... 12<br />
8 IDENTIKEY Server .................................................................................................. 16<br />
8.1 Policy configuration ............................................................................................. 16<br />
8.2 Client configuration ............................................................................................. 19<br />
9 Test <strong>FortiGate</strong> <strong>VPN</strong> Client ........................................................................................ 21<br />
10 About VASCO Data Security .................................................................................. 23<br />
2 <strong>DIGIPASS</strong> <strong>Authentication</strong> <strong>for</strong> <strong>FortiGate</strong> <strong>IPSec</strong> <strong>VPN</strong>
<strong>DIGIPASS</strong> <strong>Authentication</strong> <strong>for</strong> <strong>FortiGate</strong> <strong>IPSec</strong> <strong>VPN</strong><br />
Reference guide<br />
ID Title Author Publisher Date ISBN<br />
3 <strong>DIGIPASS</strong> <strong>Authentication</strong> <strong>for</strong> <strong>FortiGate</strong> <strong>IPSec</strong> <strong>VPN</strong>
1 Reader<br />
<strong>DIGIPASS</strong> <strong>Authentication</strong> <strong>for</strong> <strong>FortiGate</strong> <strong>IPSec</strong> <strong>VPN</strong><br />
This Document is a guideline <strong>for</strong> configuring the partner product with IDENTIKEY SERVER or<br />
Axsguard IDENTIFIER. For details about the setup and configuration of IDENTIEKEY SERVER and<br />
Axsguard IDENTIFIER, we refer to the Installation and administration manuals of these products.<br />
Axsguard IDENTIFIER is the appliance based solution, running IDENTIKEY SERVER by default.<br />
Within this document, VASCO Data Security, provides the reader guidelines <strong>for</strong> configuring the<br />
partner product with this specific configuration in combination with VASCO Server and Digipass.<br />
Any change in the concept might require a change in the configuration of the VASCO Server<br />
products.<br />
The product name`IDENTIKEY SERVER`will be used throughout the document keeping in mind<br />
that this document applies as well to the Axsguard IDENTIFIER.<br />
2 Overview<br />
The purpose of this document is to demonstrate how to configure IDENTIKEY SERVER to work<br />
with a <strong>FortiGate</strong> device. <strong>Authentication</strong> is arranged on one central place where it can be used in a<br />
regular <strong>VPN</strong> or SSL/<strong>VPN</strong> connection.<br />
3 Problem Description<br />
The basic working of the <strong>FortiGate</strong> is based on authentication to an existing media (LDAP,<br />
RADIUS, local authentication …). To use the IDENTIKEY SERVER with <strong>FortiGate</strong>, the external<br />
authentication settings need to be changed or added manually.<br />
4 Solution<br />
After configuring IDENTIKEY SERVER and <strong>FortiGate</strong> in the right way, you eliminate the weakest<br />
link in any security infrastructure – the use of static passwords – that are easily stolen guessed,<br />
reused or shared.<br />
In this integration guide we will make use of a <strong>FortiGate</strong> 60B. This combines a firewall, an <strong>IPSec</strong>,<br />
PPTP or SSL/<strong>VPN</strong> and a UTM suite in one. For authentication, we focused on the <strong>IPSec</strong> <strong>VPN</strong> part.<br />
Figure 1: Solution<br />
4 <strong>DIGIPASS</strong> <strong>Authentication</strong> <strong>for</strong> <strong>FortiGate</strong> <strong>IPSec</strong> <strong>VPN</strong>
<strong>DIGIPASS</strong> <strong>Authentication</strong> <strong>for</strong> <strong>FortiGate</strong> <strong>IPSec</strong> <strong>VPN</strong><br />
5 Technical Concept<br />
5.1 General overview<br />
The main goal of the <strong>FortiGate</strong> is to per<strong>for</strong>m authentication to secure all kind of <strong>VPN</strong> connections<br />
and web traffic. As the <strong>FortiGate</strong> can per<strong>for</strong>m authentication to an external service using the<br />
RADIUS protocol, we will place the IDENTIKEY SERVER as back-end service, to secure the<br />
authentication with our proven IDENTIKEY SERVER software.<br />
5.2 <strong>FortiGate</strong> prerequisites<br />
Please make sure you have a working setup of the <strong>FortiGate</strong>. It is very important this is working<br />
correctly be<strong>for</strong>e you start implementing the authentication to the IDENTIKEY SERVER.<br />
Currently all <strong>FortiGate</strong> devices use the same web config and CLI interface. This means<br />
our integration guide is suited <strong>for</strong> the complete product range of <strong>FortiGate</strong> devices.<br />
5.3 IDENTIKEY SERVER Prerequisites<br />
In this guide we assume you already have IDENTIKEY SERVER installed and working. If this is not<br />
the case, make sure you get IDENTIKEY SERVER working be<strong>for</strong>e installing any other features.<br />
5 <strong>DIGIPASS</strong> <strong>Authentication</strong> <strong>for</strong> <strong>FortiGate</strong> <strong>IPSec</strong> <strong>VPN</strong>
<strong>DIGIPASS</strong> <strong>Authentication</strong> <strong>for</strong> <strong>FortiGate</strong> <strong>IPSec</strong> <strong>VPN</strong><br />
6 <strong>FortiGate</strong> configuration<br />
The <strong>FortiGate</strong> device is configured by web config or by CLI, there is even a CLI window available<br />
in the web config screen.<br />
By default the web config is reachable by https://.<br />
In our case this becomes: https://192.168.0.3<br />
Figure 2: <strong>FortiGate</strong> configuration<br />
6 <strong>DIGIPASS</strong> <strong>Authentication</strong> <strong>for</strong> <strong>FortiGate</strong> <strong>IPSec</strong> <strong>VPN</strong>
<strong>DIGIPASS</strong> <strong>Authentication</strong> <strong>for</strong> <strong>FortiGate</strong> <strong>IPSec</strong> <strong>VPN</strong><br />
6.1 RADIUS configuration<br />
Go to UserRemote. Select the RADIUS tab and click on the Create New button.<br />
Fill in the IDENTIKEY SERVER details, IP address and shared secret. Specify the authentication<br />
scheme to PAP. Also don’t <strong>for</strong>get to fill in a NAS IP. This will be the IP address on the Firewall<br />
Interface which is used to send the RADIUS request to the IDENTIKEY SERVER. Click OK to save<br />
the settings.<br />
Figure 3: Group configuration (1)<br />
7 <strong>DIGIPASS</strong> <strong>Authentication</strong> <strong>for</strong> <strong>FortiGate</strong> <strong>IPSec</strong> <strong>VPN</strong>
<strong>DIGIPASS</strong> <strong>Authentication</strong> <strong>for</strong> <strong>FortiGate</strong> <strong>IPSec</strong> <strong>VPN</strong><br />
6.2 Group configuration<br />
Now go to UserUser Group and click the Create New button.<br />
Fill in an appropriate name and choose firewall as type. Leave the protection profile as default<br />
on unfiltered. Select the RADIUS settings we created in chapter 5.1 on the left side of the<br />
screen and click the button to add it to the members of this group. Click OK to continue.<br />
Figure 4: Group configuration (2)<br />
You will now see the group appearing in the list.<br />
Figure 5: Group configuration (3)<br />
8 <strong>DIGIPASS</strong> <strong>Authentication</strong> <strong>for</strong> <strong>FortiGate</strong> <strong>IPSec</strong> <strong>VPN</strong>
<strong>DIGIPASS</strong> <strong>Authentication</strong> <strong>for</strong> <strong>FortiGate</strong> <strong>IPSec</strong> <strong>VPN</strong><br />
6.3 <strong>IPSec</strong> configuration<br />
Go to <strong>VPN</strong>IPSEC, select the Auto Key (IKE) tab and click the Create Phase1 button.<br />
Give this phase an appropriate name and select Preshared Key as <strong>Authentication</strong> Method.<br />
Fill in a secret in the Pre-Shared Key box. Click on the Advanced… button on the bottom of the<br />
screen.<br />
Figure 6: <strong>IPSec</strong> configuration (1)<br />
In the XAUTH section, select Enable as Server. Mark PAP as authentication mechanism and<br />
select the User Group you created in Chapter 5.2. Click OK to save this new Phase1.<br />
Figure 7: <strong>IPSec</strong> configuration (2)<br />
9 <strong>DIGIPASS</strong> <strong>Authentication</strong> <strong>for</strong> <strong>FortiGate</strong> <strong>IPSec</strong> <strong>VPN</strong>
<strong>DIGIPASS</strong> <strong>Authentication</strong> <strong>for</strong> <strong>FortiGate</strong> <strong>IPSec</strong> <strong>VPN</strong><br />
Once you created Phase1, click on the Create Phase2 button.<br />
Enter an appropriate name <strong>for</strong> this phase and select the Phase1 you create in the previous step.<br />
Click the Advanced… button and make the following changes.<br />
1-Encryption: 3DES <strong>Authentication</strong>: SHA1<br />
2-Encryption: 3DES <strong>Authentication</strong>: MD5<br />
Enable replay detection<br />
Enable perfect <strong>for</strong>ward secrecy (PFS)<br />
DH Group: 5<br />
Keylife: Seconds 1800<br />
Auto Keep Alive Enable<br />
DHCP-IPsec Enable<br />
Click the OK button to save phase 2.<br />
Figure 8: <strong>IPSec</strong> configuration (3)<br />
10 <strong>DIGIPASS</strong> <strong>Authentication</strong> <strong>for</strong> <strong>FortiGate</strong> <strong>IPSec</strong> <strong>VPN</strong>
<strong>DIGIPASS</strong> <strong>Authentication</strong> <strong>for</strong> <strong>FortiGate</strong> <strong>IPSec</strong> <strong>VPN</strong><br />
6.4 Firewall configuration<br />
Go to FirewallPolicy and click the Create New button.<br />
Give this policy an appropriate name. Select the correct Source and Destination network<br />
details and make sure Shedule is always, service is ANY and Action is IPSEC. Choose the<br />
correct Phase1 tunnel <strong>for</strong> the <strong>VPN</strong> Tunnel and select Allow inbound and outbound. Click OK<br />
to save the firewall policy.<br />
Figure 9: Firewall configuration<br />
The Fortigate appliance is now set up. We first have to do some configuration on the client side<br />
too.<br />
11 <strong>DIGIPASS</strong> <strong>Authentication</strong> <strong>for</strong> <strong>FortiGate</strong> <strong>IPSec</strong> <strong>VPN</strong>
<strong>DIGIPASS</strong> <strong>Authentication</strong> <strong>for</strong> <strong>FortiGate</strong> <strong>IPSec</strong> <strong>VPN</strong><br />
7 FortiClient configuration<br />
Open the FortiClient on the client side.<br />
Select the following options on the Connections tab:<br />
Start <strong>VPN</strong> be<strong>for</strong>e logging on to Windows<br />
Keep <strong>IPSec</strong> Service running <strong>for</strong>ever unless manually stopped<br />
Beep when connection error occers<br />
o Stop after 60 seconds<br />
Click the Advanced>>> button and select Add…<br />
Figure 10: FortiClient configuration (2)<br />
Fill in a connection name and select Manual configuration.<br />
Enter the network settings and select Preshared Key as authentication method. Fill in the<br />
Preshared Key set in Chapter 5.3. Click the Advanced… button to continue.<br />
Figure 11: FortiClient configuration (3)<br />
12 <strong>DIGIPASS</strong> <strong>Authentication</strong> <strong>for</strong> <strong>FortiGate</strong> <strong>IPSec</strong> <strong>VPN</strong>
<strong>DIGIPASS</strong> <strong>Authentication</strong> <strong>for</strong> <strong>FortiGate</strong> <strong>IPSec</strong> <strong>VPN</strong><br />
Click on the Config… button in the Policy group.<br />
Figure 12: FortiClient configuration (4)<br />
On the next screen select Autokey Keep Alive. And click OK.<br />
Figure 13: FortiClient configuration (5)<br />
13 <strong>DIGIPASS</strong> <strong>Authentication</strong> <strong>for</strong> <strong>FortiGate</strong> <strong>IPSec</strong> <strong>VPN</strong>
<strong>DIGIPASS</strong> <strong>Authentication</strong> <strong>for</strong> <strong>FortiGate</strong> <strong>IPSec</strong> <strong>VPN</strong><br />
Now select eXtended <strong>Authentication</strong> and click the Config… button.<br />
Figure 14: FortiClient configuration (6)<br />
Select Prompt to login and click OK.<br />
Figure 15: FortiClient configuration (7)<br />
14 <strong>DIGIPASS</strong> <strong>Authentication</strong> <strong>for</strong> <strong>FortiGate</strong> <strong>IPSec</strong> <strong>VPN</strong>
<strong>DIGIPASS</strong> <strong>Authentication</strong> <strong>for</strong> <strong>FortiGate</strong> <strong>IPSec</strong> <strong>VPN</strong><br />
Select OK in the Advanced Settings and the New Connection screen.<br />
Now the connection is ready to be used, but we will first set up the IDENTIKEY SERVER.<br />
Figure 16: FortiClient configuration (8)<br />
15 <strong>DIGIPASS</strong> <strong>Authentication</strong> <strong>for</strong> <strong>FortiGate</strong> <strong>IPSec</strong> <strong>VPN</strong>
<strong>DIGIPASS</strong> <strong>Authentication</strong> <strong>for</strong> <strong>FortiGate</strong> <strong>IPSec</strong> <strong>VPN</strong><br />
8 IDENTIKEY Server<br />
Go to the IDENTIKEY Server web administration page, and authenticate with and administrative<br />
account.<br />
8.1 Policy configuration<br />
To add a new policy, select PoliciesCreate.<br />
Figure 17: Policy configuration (1)<br />
There are some policies available by default. You can also create new policies to suit your needs.<br />
Those can be independent policies or inherit their settings from default or other policies.<br />
16 <strong>DIGIPASS</strong> <strong>Authentication</strong> <strong>for</strong> <strong>FortiGate</strong> <strong>IPSec</strong> <strong>VPN</strong>
<strong>DIGIPASS</strong> <strong>Authentication</strong> <strong>for</strong> <strong>FortiGate</strong> <strong>IPSec</strong> <strong>VPN</strong><br />
Fill in a policy ID and description. Choose the option most suitable in your situation. If you want<br />
the policy to inherit setting from another policy, choose the right policy in the Inherits From list.<br />
Otherwise leave this field to None.<br />
Figure 18: Policy configuration (2)<br />
In the policy options configure it to use the right back-end server. This could be the local<br />
database, but also active directory or another radius server.<br />
This is probably the same that was in your default client authentication options be<strong>for</strong>e you<br />
changed it. Or you use the local database, Windows or you go further to another radius server.<br />
In our example we select our newly made Demo Policy and change it like this:<br />
Local auth.: Digipass/Password<br />
Back-End Auth.: Default (None)<br />
Back-End Protocol: Default (None)<br />
Dynamic User Registration: Default (No)<br />
Password Autolearn: Default (No)<br />
Stored Password Proxy: Default (No)<br />
Windows Group Check: Default (No Check)<br />
After configuring this Policy, the authentication will happen locally in the IDENTIKEY Server. So<br />
user credentials are passed through to the IDENTIKEY Server, it will check these credentials to its<br />
local user database and will answer to the client with an Access-Accept or Access-Reject<br />
message.<br />
17 <strong>DIGIPASS</strong> <strong>Authentication</strong> <strong>for</strong> <strong>FortiGate</strong> <strong>IPSec</strong> <strong>VPN</strong>
<strong>DIGIPASS</strong> <strong>Authentication</strong> <strong>for</strong> <strong>FortiGate</strong> <strong>IPSec</strong> <strong>VPN</strong><br />
In the Policy tab, click the Edit button, and change the Local <strong>Authentication</strong> to<br />
Digipass/Password.<br />
Figure 19: Policy configuration (3)<br />
The user details can keep their default settings.<br />
Figure 20: Policy configuration (4)<br />
18 <strong>DIGIPASS</strong> <strong>Authentication</strong> <strong>for</strong> <strong>FortiGate</strong> <strong>IPSec</strong> <strong>VPN</strong>
<strong>DIGIPASS</strong> <strong>Authentication</strong> <strong>for</strong> <strong>FortiGate</strong> <strong>IPSec</strong> <strong>VPN</strong><br />
8.2 Client configuration<br />
Now create a new component by right-clicking the Components and choose New Component.<br />
Figure 21: Client configuration (1)<br />
19 <strong>DIGIPASS</strong> <strong>Authentication</strong> <strong>for</strong> <strong>FortiGate</strong> <strong>IPSec</strong> <strong>VPN</strong>
<strong>DIGIPASS</strong> <strong>Authentication</strong> <strong>for</strong> <strong>FortiGate</strong> <strong>IPSec</strong> <strong>VPN</strong><br />
As component type choose RADIUS Client. The location is the IP address of the client. In the<br />
policy field you should find your newly created policy. Fill in the shared secret you entered<br />
also in the client <strong>for</strong> the RADIUS options. In our example this was “vasco”. Click Create.<br />
Figure 22: Client configuration (2)<br />
Now the client and the IDENTIKEY Server are set up. We will now see if the configuration is<br />
working.<br />
20 <strong>DIGIPASS</strong> <strong>Authentication</strong> <strong>for</strong> <strong>FortiGate</strong> <strong>IPSec</strong> <strong>VPN</strong>
<strong>DIGIPASS</strong> <strong>Authentication</strong> <strong>for</strong> <strong>FortiGate</strong> <strong>IPSec</strong> <strong>VPN</strong><br />
9 Test <strong>FortiGate</strong> <strong>VPN</strong> Client<br />
In the Connections tab, select the correct connection and click the Connect button. Currently<br />
the Status is Down.<br />
Figure 23: Test <strong>FortiGate</strong> <strong>VPN</strong> Client (1)<br />
Enter a username and One-Time Password (OTP) and click OK.<br />
Figure 24: Test <strong>FortiGate</strong> <strong>VPN</strong> Client (2)<br />
21 <strong>DIGIPASS</strong> <strong>Authentication</strong> <strong>for</strong> <strong>FortiGate</strong> <strong>IPSec</strong> <strong>VPN</strong>
<strong>DIGIPASS</strong> <strong>Authentication</strong> <strong>for</strong> <strong>FortiGate</strong> <strong>IPSec</strong> <strong>VPN</strong><br />
The connection screen will show you the IKE Negotiation details and will state that the<br />
Negotiation succeeded when the authentication was successful. Click OK to close.<br />
Figure 25: Test <strong>FortiGate</strong> <strong>VPN</strong> Client (3)<br />
You will now see that the Status has changed to Up (time).<br />
Figure 26: Test <strong>FortiGate</strong> <strong>VPN</strong> Client (4)<br />
22 <strong>DIGIPASS</strong> <strong>Authentication</strong> <strong>for</strong> <strong>FortiGate</strong> <strong>IPSec</strong> <strong>VPN</strong>
<strong>DIGIPASS</strong> <strong>Authentication</strong> <strong>for</strong> <strong>FortiGate</strong> <strong>IPSec</strong> <strong>VPN</strong><br />
10 About VASCO Data Security<br />
VASCO designs, develops, markets and supports patented Strong User <strong>Authentication</strong> products<br />
<strong>for</strong> e-Business and e-Commerce.<br />
VASCO’s User <strong>Authentication</strong> software is carried by the end user on its <strong>DIGIPASS</strong> products which<br />
are small “calculator” hardware devices, or in a software <strong>for</strong>mat on mobile phones, other portable<br />
devices, and PC’s.<br />
At the server side, VASCO’s VACMAN products guarantee that only the designated <strong>DIGIPASS</strong> user<br />
gets access to the application.<br />
VASCO’s target markets are the applications and their several hundred million users that utilize<br />
fixed password as security.<br />
VASCO’s time-based system generates a “one-time” password that changes with every use, and<br />
is virtually impossible to hack or break.<br />
VASCO designs, develops, markets and supports patented user authentication products <strong>for</strong> the<br />
financial world, remote access, e-business and e-commerce. VASCO’s user authentication<br />
software is delivered via its <strong>DIGIPASS</strong> hardware and software security products. With over 25<br />
million <strong>DIGIPASS</strong> products sold and delivered, VASCO has established itself as a world-leader <strong>for</strong><br />
strong User <strong>Authentication</strong> with over 500 international financial institutions and almost 3000<br />
blue-chip corporations and governments located in more than 100 countries.<br />
23 <strong>DIGIPASS</strong> <strong>Authentication</strong> <strong>for</strong> <strong>FortiGate</strong> <strong>IPSec</strong> <strong>VPN</strong>