WSM User Guide - WatchGuard Technologies

Configuring the Firebox as an Authentication ServerAuthentication server typesWith Fireware®, there are five authentication methods:• Firebox• RADIUS• SecurID• LDAP• Active DirectoryYou can configure one or more authentication server types for a Firebox. Authentication to differentserver types is almost the same for the user. For the Firebox administrator, the difference is that the userdatabase can be on the Firebox or on a dedicated authentication server.When you use an authentication server, you configure it with the instructions from its manufacturer. Youinstall the server with access to the Firebox and put it behind the Firebox for security.Using a backup authentication serverYou can configure a backup authentication server with all types of third-party authentication. If the Fireboxcannot connect to the primary authentication server (after three attempts), it connects to thebackup authentication server. If the Firebox cannot connect to the backup authentication server, it waitsten minutes, and then tries to connect to the primary authentication server again. This cycle continuesuntil the Firebox connects with an authentication server.Configuring the Firebox as an Authentication ServerIf you do not use a third-party authentication server, you can use the Firebox® as an authenticationserver. This procedure divides your company into groups and users for authentication. The group towhich you assign a person is controlled by the tasks they do and information they use. For example, youcan have an accounting group, a marketing group, and a research and development group. You can alsohave a new employee group, with controlled access to the Internet.In a group, you set the authentication procedure for the users, the system type, and the information towhich they have access. A user can be a network or a computer. If your company changes, you can addor remove users or systems from your groups.Use Policy Manager to:• Add, change, or delete the groups in the configuration• Add or change the users in a groupAbout Firebox authenticationYou can configure the Firebox to authenticate users for three different types of authentication:• Firewall authentication• PPTP connections• MUVPN connectionsWhen the authentication is successful, the Firebox makes a mapping between these items:• User name• Firebox User group (or groups) of which the user is a member• IP address on the user’s computer when the user authenticatesUser Guide 123