WatchGuard Firebox System 7.0 User Guide

How User Authentication WorksHow User Authentication WorksA specialized HTTP server runs on the Firebox. To authenticate,clients must connect to the authentication serverusing a Java-enabled Web browser pointed to:http://IP address of any Firebox interface:4100/A Java applet loads a prompt for a username and passwordthat it then passes to the authentication server usinga challenge-response protocol. Once successfully authenticated,users minimize the Java applet and browser windowand begin using allowed network services.As long as the Java window remains active (it can be minimizedbut not closed) and the Firebox does not reboot,users remain authenticated until the session times out. Toprevent an account from authenticating, disable theaccount on the authentication server.Using external authenticationAlthough the authentication applet is primarily used foroutbound traffic, it can be used for inbound traffic as well.Authentication can be used outside the Firebox as long asyou have an account on that Firebox. For example, if youare working at home, you can point your browser to:http://public IP address of any Firebox interface:4100/The authentication applet appears to prompt you for yourlogin credentials. This can provide you access through variousservices such as FTP and Telnet, if you have preconfiguredyour Firebox to allow this.Enabling remote authenticationUse this procedure to allow remote users to authenticatefrom the external interface, which gives them access to servicesthrough the Firebox.1 In the Services Arena in Policy Manager, double-clickthe wg_authentication service icon.2 On the Incoming tab, select Enabled and Allowed.User Guide 165