WSM User Guide - WatchGuard Technologies

Configuring LDAP Authentication3 In the IP Address box, type the IP address of the primary LDAP server for the Firebox to contact withauthentication requests.The LDAP server can be located on any Firebox interface or available through a VPN tunnel.4 From the Port drop-down list, select the TCP port number for the Firebox to use to connect to theLDAP server. The default port number is 389.We do not support SSL binds on port 636.5 Type the Search Base. The standard format for the search base setting is: ou=organizationalunit,dc=first part of distinguished server name,dc=any part of the distinguished server nameappearing after the dot.For example, if your user accounts are in an OU (organizational unit) you refer to as “accounts” andyour domain name is kunstlerandsons.com, your search base is:“ou=accounts,dc=kunstlerandsons,dc=com”.You set a search base to put limits on the directories on the authentication server the Firebox searches in for anauthentication match.6 Type the Group String.The attribute string that is used to hold user group information on the LDAP server. On many LDAP servers, thedefault group string is “uniqueMember”; on other servers it is “member”.7 If necessary, change the time-out value. This is how long the Firebox waits for a response from theauthentication server.8 Add information for a backup LDAP Server, if you have one.9 To configure MUVPN users to get configuration information from the LDAP Server, you can changeyour directory schema and use the settings available through the Optional Settings button. Youcan enter MUVPN client information in the user properties of your LDAP Server, which includes theIP address, subnet mask, or DNS and WINS servers. Then, you can map these fields to the fields thatappear in Optional Settings. When the MUVPN user starts a VPN tunnel through the Firebox, theFirebox sets the IP address, subnet mask, or DNS and WINS servers for the user with the informationcontained in the LDAP user properties.IP Attribute StringType the name of the LDAP user property field name that contains the assigned IP address.Netmask Attribute StringType the name of the LDAP user property field name that contains the assigned subnet mask.DNS Attribute StringType the name of the LDAP user property field name that contains the DNS server IP address.WINS Attribute StringType the name of the LDAP user property field name that contains the WINS server IP address.Lease Time Attribute StringType the name of the LDAP user property field name that contains the total time allowed for theMUVPN connection session.Idle Timeout Attribute StringType the name of the LDAP user property field name that contains the assigned idle time-out.130 WatchGuard System Manager