Watchguard SSL User guide

WatchGuard SSL Web UI 3.2 User Guide

WatchGuard SSL

Web UI

3.2 User Guide

WatchGuard SSL100

WatchGuard SSL 560

User Guide ii

About this User Guide

The WatchGuard SSL Web UI User Guide is updated with each major product release. For minor product

releases, only the WatchGuard SSL Web UI Help system is updated. The Help system also includes specific,

task-based implementation examples that are not available in the User Guide.

For the most recent product documentation, see the WatchGuard SSL Web UI Help on the WatchGuard

web site at: http://www.watchguard.com/help/documentation/.

Information in this guide is subject to change without notice. Companies, names, and data used in examples

herein are fictitious unless otherwise noted. No part of this guide may be reproduced or transmitted in any

form or by any means, electronic or mechanical, for any purpose, without the express written permission

of WatchGuard Technologies, Inc.

Guide revised: 8/8/2013

Copyright, Trademark, and Patent Information

mentioned herein, if any, are the property of their respective owners.

Complete copyright, trademark, patent, and licensing information can be found in the Copyright and

Licensing Guide, available online at: http://www.watchguard.com/help/documentation/.

Note This product is for indoor use only.

About WatchGuard

WatchGuard offers affordable, all-in-one network and content security

solutions that provide defense-in-depth and help meet regulatory

compliance requirements. The WatchGuard XTM line combines

firewall, VPN, GAV, IPS, spam blocking and URL filtering to protect

your network from spam, viruses, malware, and intrusions. The new

XCS line offers email and web content security combined with data

loss prevention. WatchGuard extensible solutions scale to offer right-

sized security ranging from small businesses to enterprises with

10,000+ employees. WatchGuard builds simple, reliable, and robust

security appliances featuring fast implementation and comprehensive

management and reporting tools. Enterprises throughout the world

rely on our signature red boxes to maximize security without

sacrificing efficiency and productivity.

For more information, call 206.613.6600 or go to

www.watchguard.com.

Address

505 Fifth Avenue South

Suite 500

Seattle, WA 98104

Support

www.watchguard.com/support

U.S. and Canada +877.232.3531

All Other Countries +1.206.521.3575

Sales

U.S. and Canada +1.800.734.9905

All Other Countries +1.206.613.0895

User Guide iii
Table of Contents
Introduction to WatchGuard SSL 1
About the WatchGuard SSL solution 1
About the WatchGuard SSL Access Client 2
About the Application Portal 2
Getting Started 3
Verify Basic Components 3
Get a WatchGuard Device Feature Key 3
Install the WatchGuard SSL Device Behind a Firewall 3
Use the Quick Setup Wizard to Set Up a Basic Configuration 4
Run the Quick Setup Wizard 4
Connect the WatchGuard SSL Device to Your Network 5
Connect to WatchGuard SSL Web UI and Complete Initial Tasks 6
Connect to WatchGuard SSL Web UI 6
Upload the Feature Key File 6
Download and Install the Latest Software 6
Get a Feature Key 7
Find your Serial Number 7
Activate your Device and Get a Feature Key 7
Retrieve a Current Feature Key 7
About WatchGuard SSLWeb UI 8
WatchGuard SSL Web UI Wizards 8
Publish Your Configuration 8
System Messages 9
Use the File Browser 9
Get Started with Common Tasks 9
Create User Accounts and Configure Authentication 10
Configure Resource Access 10
Customize the Device Hostname 10
Add a Certificate to the SSLDevice 11
About the Access Client 11

Restore Factory Default Settings 11

Before You Begin 11

Start the WatchGuard SSLDevice in Recovery Mode 12

Upload a New Software Image 12

Next Steps 12

About WatchGuard LiveSecurity Service 13

LiveSecurity Service 13

LiveSecurity Service Gold 14

Service expiration 14

Support Information 14

Online Resources 14

Telephone Numbers 15

Before You Call 15

Relevant Information 15

About Monitor System 17

About the System Status Page 18

View Status Information 19

Manage Settings 19

View Administrator Activities 20

System Overview 20

Network Status 23

Authentication 24

Events 25

Device Status 26

Network Tools 28

Manage Settings 29

View Administrator Activities 31

About User Sessions 31

Search for User Sessions 32

View a User Session 33

End a User Session 34

Manage Search and Display Settings 34

iv WatchGuard SSL Web UI

User Guide v

About Alerts 35

Manage Alerts 35

Add an Alert 36

Edit and Delete Alerts 41

Manage Global Alert Settings 42

Manage Logging 46

Edit Logging Settings 46

Set the Log Level Filter 48

Configure Log File Rotation 48

Debug Logs 49

Log File Information 49

Syslog 49

Manage Global Logging Settings 49

Use Log Viewer 51

About Log Viewer Search Criteria 52

About Reports 54

Available Reports 54

Generate a Report 55

Save a Report 56

Abolishment Report 57

Assessment Report 57

Session Trend Report 58

Session Trend Real-Time Report 58

Access Report 59

Authentication Report 59

Authorization Report 60

Account Statistics Report 61

User Policy Analysis Report 61

User Audit Report 61

Communication Report 62

Performance Report 62

Tunnel Report 63

Alerts Report 63
System Report 63
Complete Report 64
Manage Report Database Settings 65
About the Diagnostics File 65
About the Feature Key 66
Feature key information 67
Upload a New Feature Key 69
Live Update 69
Configure Live Update Settings 70
Reboot after Engine Updates 71
Check for New Live Update Files 71
User Management 73
User accounts 74
User groups 74
External Directory Service 74
Self Service 75
About User Accounts 75
User Account Search Result List 75
Manually Add a User Account 76
Import User Accounts 79
Link to a User Account 83
Repair a Linked User Account 84
Edit User Accounts 86
Manage Global User Account Settings 87
About User Groups 91
About User Property Groups 91
About User Location Groups 91
About User Groups and Access Rules 91
Add a User Group 92
Add a User to a Group using a Custom Attribute 93
Search, Edit, or Delete User Groups 95
vi WatchGuard SSL Web UI

User Guide vii
About the External Directory Service 97
About Search Rules 97
About User Groups and Access Rules 98
About Directory Mapping 98
Add an External Directory Service Location 98
Edit an External Directory Service Location 102
About Self Service 105
Use the wizard to enable Self Service 105
Manually enable and configure Self Service 106
Disable or restore Self Service 106
Manage Self Service Settings 107
Modify System Challenges 109
Configure and Enable Self Service 111
About Resource Access 119
Resources 119
Client firewall 119
Access rules 120
Application Portal 120
SSO domains 120
About Resources 120
Manage Resources 120
Manage Global Tunnel Resource Settings 185
Manage Global Resource Settings 187
About Client Firewalls 207
Disable routes for other network connections 207
Check the integrity of application connections 207
How the client firewall works 207
Configure client definitions 208
Firewall rules based on a device 208
Incoming Firewall Rules 209
Outgoing firewall rules 209
Manage Internet Firewall Configurations 210

About Access Rules 215
Manage Access Rules 215
Manage Global Access Rules 219
Assessment Access Rule Requirements 220
Configure an Access Rule to Require Anti-virus or Anti-spyware Software 227
Configure an Access Rule to Verify the Windows Client Logon Domain 229
Configure an Access Rule to Verify a Windows File is Found 230
Configure an Access Rule to Verify a Windows File Digest is Found 231
Configure an Access Rule to Verify a Directory is Found 234
Configure an Access Rule to Verify the Client Computer MAC Address 235
Configure an Access Rule to Combine Authentication Methods 236
About the Application Portal 238
About the Access Client 238
Manage Application Portal Items 238
Connect to the Application Portal 242
Customize your Web UI and Application Portal 242
Add Additional Application Portals 260
About SSO Domains 260
Domain type attributes 261
Manage SSO Domains 261
Configure SSO for Outlook Web Access (Form Based Authentication) 265
Configure SSO with Outlook Web Access (Basic Authentication) 270
Configure SSO for Microsoft Outlook Web App 2010 273
Configure SSO for File Share Resources 276
Configure SSO for Remote Control Resources 280
Configure SSO for a Citrix MetaFrame Presentation Server Resource 284
About Manage System 295
About Authentication Methods 296
Supported Authentication Methods 297
About WatchGuard SSL Authentication Methods 298
About Other Authentication Methods 299
Add an Authentication Method 300
viii WatchGuard SSL Web UI

User Guide ix
Manage an Authentication Method 302
Manage Global Authentication Service Settings 311
Manage RADIUS Configuration 317
Two-factor Authentication with Mobile ID and MobileOTP iOSApp 322
Configure Active Directory Authentication with LDAP over SSL 330
About Certificates 345
Certificate Lifetimes and CRLs 346
Certificate Authorities and Signing Requests 346
Default Certificate 346
Manage Certificates 346
Add a Certificate Authority 347
Add a Server Certificate 349
Edit or Delete a Server Certificate 350
Manage Client Certificate Settings 351
Create a CSR with OpenSSL 352
About Abolishment 358
Configure General Settings 360
Configure Cache Cleaner Settings 362
Configure Advanced Settings 363
Post-connection Cleanup with Abolishment 364
About Assessment 366
Configure General Settings for Assessment 368
Configure Advanced Settings 371
Pre-connection End-point Integrity Check 373
About Notification Settings 376
Notification Variables 377
Configure the Email Notification Channel 377
Configure the SMSNotification Channel 378
Manage SMSPlug-ins 392
Manage Client Definitions 393
Add Client Definitions 395
Edit or Delete Client Definitions 395

About Delegated Management 396
About Administrative Privileges 397
Manage Administrative Roles 398
About the Administration Service 401
Manage Administration Service Settings 401
Change the Super Administrator Password 402
Manage Global Settings 403
Restart the Administration Service 405
Manage Device Settings 406
General Settings for the Application Portal 407
Performance Settings 410
Cipher Suite Settings 413
Advanced Settings 415
Update the Device 418
Update the OS 419
Configure the System Time and Time Zone 419
Restore Factory Default Configuration Settings 421
Reinitialize the Local User Database 421
Reboot the Device 422
Network Configuration 422
Configure the Network Type 422
Manage Global Tunnel Resource Settings 426
Configure Administration Service External Communication Settings 427
Confirm Network Configuration Settings 428
Configure Network Routes 429
Restore a Saved Configuration 430
Restore the Current Configuration 431
Restore a Saved Configuration 431
Add a Description to a Saved Configuration 432
Delete a Saved Configuration 432
Lock or Unlock a Saved Configuration 433
Manage Saved Configuration Settings 433
x WatchGuard SSL Web UI

User Guide xi
Import or Export the Configuration 434
Configure Active Directory Authentication on your SSL Device 435
Before You Begin 436
Enable your AD Server for LDAP over SSL 437
Configure Active Directory Authentication on your SSL device 439
Send One-Time Passwords (OTPs) to Users 445
Configurethe SMS Channel to send email 445
Configure SMS Settings for each user account 446
Change the Directory Mapping Attribute for Notification SMS 447
Enable mobile text authentication for all users 448
Use the OTP to Authenticate 449
About the Access Client 451
Install the Access Client 452
Before You Begin 452
Run the Installer 452
Launch the Installed Access Client 452
After You Install 452
Connect to the Application Portal 453
Uninstall the Access Client 453
Set up the Access Client for a Standard User 454
Installation 454
Use the Access Client as a Standard User 456
Limitations 456
Launch the Access Client 456
Launch the On-demand Access Client 457
Launch the Installed Access Client 457
About the Access Client Menu 457
Edit Access Client Preferences 458
Manage Access Client Favorites 462
Check Access Client Status 465
Close a Tunnel 465
End Your SSL VPN Session 466

Use ESSP to Link Directly to a Resource 466

Register the ESSP Protocol Handler 466

Use ESSP to Connect to a Resource 467

Example 467

xii WatchGuard SSL Web UI

User Guide 1

1

Introduction to WatchGuard SSL

Your WatchGuard SSL device is an affordable, easy-to-use, and secure remote access device that provides

reliable connectivity to your corporate data and resources. Its flexibility enables you to make your remote

connectivity deployment as simple or as sophisticated as your business requirements dictate.

If your business requires remote access to email and file shares, your WatchGuard SSL device delivers the

security, flexibility, and breadth of options you need for secure remote access to your network. The

WatchGuard SSL stand-alone deployment implementation is a hassle-free VPN solution that provides

universal access to applications and network resources with no connectors, no modules, no client

management issues, and no extras to buy. The WatchGuard SSL 100 accommodates up to 100 concurrent

users. The WatchGuard SSL 560 accommodates up to 500 concurrent users.

About the WatchGuard SSL solution

The WatchGuard SSL solution includes a WatchGuard SSL device, WatchGuard SSL Web UI, the WatchGuard

SSL Application Portal, and the WatchGuard SSL Access Client.

n A WatchGuard SSL device is an all-in-one appliance that includes all the hardware, software, and

WatchGuard servers for your solution.

n WatchGuard SSLWeb UIis a Web-based administration application with a task-oriented approach.

You can use the Web UI to monitor your WatchGuard SSL system, add user accounts, manage access

to your resources, and manage your system settings.

n The WatchGuard SSL Application Portal is the web site where your users authenticate and get access

to your network resources.

n The Access Client is a SSL VPN client that enables on-demand access to tunnel resources in your

Application Portal.

About the WatchGuard SSL Access Client

The WatchGuard SSLAccess Client is an on-demand SSL VPN client. When a user selects a resource

available through the tunnel, the Access Client automatically downloads and installs on the client computer

through the web browser. The Access Client is available in two versions: the installed Access Client and the

on-demand Access Client. The Access Client is loaded with either ActiveX or a Java Applet, based on your

configuration choices. To use the ActiveX client loader to install the client, users must have local

administrator rights on their computers. For your users who do not have local administrator rights, you can

download the Access Client from the WatchGuard web site and provide it to the SSL VPN users on your

network.

About the Application Portal

The Application Portal provides access to Web Resources and Tunnel Resources. Web Resources are any

files accessible with a web browser, or applications with a web interface such as Outlook Web Access or

WatchGuard SSL Web UI. Users can connect to Web Resources without the Access Client.

Tunnel Resources are client-server applications or intranet sites. Examples of tunnel resources include

Remote Desktop or a Windows file share. Users must have the Access Client to connect to Tunnel

Resources.

Introduction to WatchGuard SSL

2 WatchGuard SSL Web UI

User Guide 3

2

Getting Started

Before you install your WatchGuard SSLdevice, make sure you verify the basic components and get a

feature key, as described in the subsequent sections.

Verify Basic Components

Make sure that you have these items:

n A computer with a 10/100BaseT Ethernet network interface card and a web browser installed

n WatchGuard SSL device

n Ethernet cable

n Power cable

Get a WatchGuard Device Feature Key

To enable all of the features on your WatchGuard SSL device, you must activate the device on the

WatchGuard LiveSecurity web site and retrieve your feature key file. You can upload your feature key in the

Quick Setup Wizard if you register your device before you start the wizard. Or, you can complete the wizard

without a feature key. The SSL device only allows one authenticated user until you upload a feature key to

the device.

For more information, see Get a Feature Key.

Install the WatchGuard SSL Device Behind a

Firewall

To protect your WatchGuard SSLdevice, we recommend that you install the device on your network

behind the network firewall. You must then add an HTTPSpolicy to the firewall configuration to allow

inbound traffic to the device. The procedure you use to add the policy depends on whether your

WatchGuard SSL device has a public or private network IP address.

If your WatchGuard SSL device has a private IP address

Configure the firewall with an HTTPSpolicy that uses static NAT.This policy must allow all traffic on

port 443 from any external IPaddress to the private IP address of the WatchGuard SSL device.

If your WatchGuard SSLdevice has a public IP address

Configure the firewall with an HTTPS policy that allows traffic on port 443 from any external IP

address to the public IP address of the WatchGuard SSL device.

For detailed examples about how to configure these policies on a WatchGuard firewall, see the Policies

topics in the latest Fireware XTMdocumentation.

Use the Quick Setup Wizard to Set Up a Basic

Configuration

The Quick Setup Wizard helps you set up a basic network configuration for your WatchGuard SSL device.

Use the Quick Setup Wizard to set up the device for the first time, or after you reset the device to factory

default settings.

Before you start the Quick Setup Wizard, make sure you:

n Register your WatchGuard SSL device with LiveSecurity Service

n Save a copy of your feature key file from the LiveSecurity web site to your computer, and extract

the feature key from the compressed file

For more information, see Getting Started.

Run the Quick Setup Wizard

1. Make sure your computer is configured to use a static IP address on the 192.168.111.0/24 network.

Note The default IP address on the WatchGuard SSL is 192.168.111.1. Do not use

192.168.111.1 on your own computer.

2. Connect the Ethernet interface on your computer to Eth1 on the WatchGuard SSL device.

3. Plug the power cord into the WatchGuard device power input and into a power source.

4. Power on the WatchGuard SSL.

5. Open a web browser and type:https://192.168.111.1:8443

The Quick Setup Wizard begins.

Note Because the WatchGuard SSLdevice uses a self-signed certificate, you may see a

certificate warning in your browser. It is safe to ignore the warning (Internet

Explorer) or add a certificate exception (Mozilla Firefox).

6. Upload your feature key file, if you have it.

If you do not upload a feature key file, only one authenticated user can get access to the device. If you do not

have a feature key, you can continue with the wizard, and then upload a feature key from the Web UI after you

finish the wizard.

Getting Started

4 WatchGuard SSL Web UI

Getting Started

User Guide 5

7. Set the time zone and system time settings.

Though the NTPserver configuration is optional, we recommend that you specify an NTP Server. Accurate time

stamps are important not only for log file messages, but also for the SSL handshake.

8. Create the Super Administrator credentials. This is a local account on the SSL device. These

credentials do not have to correspond to an existing user in a directory service.

The Super Administrator password must be at least six characters long and must include characters

from at least three of these four categories:

n English uppercase characters (from A through Z)

n English lowercase characters (from a through z)

n Base-10 digits (from 0 through 9)

n Non-alphanumeric characters (for example: !, $, #, or %)

9. Select the network configuration mode. The choices are:

Single Interface mode (default)

Select this mode if you want to connect the WatchGuard SSL device to one network DMZ. In

single interface mode, only the Eth0 interface is active.

Dual Interface mode

Select this mode if you want to connect the WatchGuard SSL device to two separate networks

(for example, two different DMZ networks). In dual interface mode, both the Eth0 and Eth1

interfaces are active.

For more information about network interface modes, see Network Configuration.

10. Type the network address information for each interface you enabled.

The final page of the Quick Setup Wizard shows a summary of the configuration settings, and the interface

and IPaddress you must use to connect after the device reboots. After you complete the wizard, the device

restarts with the settings you configured.

Connect the WatchGuard SSL Device to Your Network

After you complete the Quick Setup Wizard, connect the WatchGuard SSLdevice to your network.

1. Connect the WatchGuard SSL device to your network.

n If you selected single interface mode, connect the device to your network with Eth0.

n If you selected dual interface mode, connect the device to your network with both Eth0 and Eth1.

2. Reset the IPaddress on your computer to the original IPaddress.

3. Connect your computer to the network.

You can now use WatchGuard SSLWeb UI to continue configuration, management, and monitoring tasks.

For more information, see Connect to WatchGuard SSL Web UI and Complete Initial Tasks.

Connect to WatchGuard SSL Web UI and

Complete Initial Tasks

After you complete the basic configuration, you can use WatchGuard SSLWeb UI to continue the

configuration, management, and monitoring tasks. Before you get started, make sure that you have:

n Connected the WatchGuard SSL device to your network

n Connected your computer to the network

n Reset the IPaddress of your computer

Connect to WatchGuard SSL Web UI

The interface that you use to connect to WatchGuard SSLWeb UI is different depending on the deployment

method you used for your device. WatchGuard SSLWeb UI uses port 8443 by default.

If you configured your device in Single Interface Mode, you must connect to the Eth0 interface for

management.

1. Connect your computer to the Eth0 network.

2. In a web browser, type https://<Eth0 IP address>:8443.

3. Use the Super Administrator credentials you configured in the Quick Setup Wizard to log in.

WatchGuard SSL Web UIappears.

If you configured your device in Dual Interface Mode, you must connect to the Eth1 interface for

management.

1. Connect your computer to the Eth1 network.

2. In a web browser, type https://<Eth1 IP address>:8443.

3. Use the Super Administrator credentials you configured in the Quick Setup Wizard to log in.

WatchGuard SSL Web UIappears.

Upload the Feature Key File

If you did not upload your feature key file when you ran the Quick Setup Wizard, we recommend that you

upload it now.

1. Get your feature key file from LiveSecurity.

For instructions, see Get a Feature Key.

2. In WatchGuard SSLWeb UI, select Monitor System > Feature Key.

The Feature Key page appears.

3. Upload the feature key file to the device.

For more information, see Upload a New Feature Key.

Download and Install the Latest Software

A newer version of operating system software for your WatchGuard SSLdevice could be available. To

update your software:

Getting Started

6 WatchGuard SSL Web UI

Getting Started

User Guide 7

1. Go to www.watchguard.com/archive/softwarecenter.asp.

2. Find and download the latest version of WatchGuard SSLOS.

3. From the Web UI, select Manage System > Device Update.

The Update the OSpage appears.

4. Update the OS version on the device.

For more information, see Update the OS.

Get a Feature Key

A feature key is a file that enables licensed features on your WatchGuard SSL device. You must get a feature

key when you first install the device, and when you renew the LiveSecurity service.

Find your Serial Number

To activate your SSLdevice, retrieve a feature key, and activate support for your product, you need your

device serial number.

The device serial number is located on a sticker attached to the rear panel of the device in this format:

xxxxxxxxxx-xxxx.

Activate your Device and Get a Feature Key

To activate your device and get the device feature key:

1. Open a web browser and go to http://www.watchguard.com.

Note If you are new to WatchGuard, follow the instructions on the web site to create a

WatchGuard account profile.

2. Log in with your WatchGuard account user name and password.

3. On the Support Home tab, click Activate a Product.

The Activate Products page appears.

4. Type the serial number of the device. Make sure to include any hyphens.

5. Click Continue.

6. Follow the instructions to register your device.

7. Save the feature key as a text file on your computer.

After you download the feature key, you can use the Quick Setup Wizard or the Web UI to browse to the

location of the feature key on your computer and upload it to the WatchGuard SSL device.

Retrieve a Current Feature Key

You can retrieve a current feature key from the WatchGuard web site:

1. Open a web browser and go to http://www.watchguard.com.

2. Log in with your WatchGuard account user name and password.

3. On the Support Home tab, click My Products.

4. In the list of products, select your device.

5. Use the on-screen instructions to obtain the feature key.

6. Save the feature key to a text file on your computer.

For more information, see:

n Use the Quick Setup Wizard to Set Up a Basic Configuration

n Upload a New Feature Key

About WatchGuard SSLWeb UI

WatchGuard SSLWeb UIis a web-based administration application with a task-oriented approach. You can

use the Web UI to monitor your WatchGuard SSL device, add user accounts, manage resource access, and

manage your system settings.

WatchGuard SSLWeb UIhas two levels of menus:

Main menu

Includes these sections:

n Monitor System — Monitor information about system status, user sessions, log files, reports,

licenses, and alerts.

n User Management — Manage user accounts, user groups, and configure an external directory

service.

n Resource Access — Create Application Portal items to give user access to applications, folders

and files, and URLs.

n Manage System — See and manage the overall configuration of your WatchGuard SSLsystem.

Left menu

Includes options to manage your configuration from the sections of the main menu.

Context-sensitive Help is integrated with WatchGuard SSL Web UI. To open the Help topic for a task, click .

WatchGuard SSL Web UI Wizards

All common tasks use wizards to guide you through the steps to complete your task. This includes

procedures to add user accounts, resources, and many others.

n To start a wizard, click Add.

n To cancel a wizard at any time, select a different menu item or close your browser window or tab.

n To return to the previous page in a wizard, click Previous.

n To save your changes, click Finish Wizard or Save.

Publish Your Configuration

After you add or edit a setting in your configuration, you must save the changes to the WatchGuard SSL

device and services before they can take effect. The Publish button at the top of the Web UIchanges from

white to blue when you make changes that must be saved.

To save your configuration changes:

Click Publish at the top of the Web UI.

You can later review or restore a configuration.

For more information about configurations, see Restore a Saved Configuration.

Getting Started

8 WatchGuard SSL Web UI

Page is loading ...

Watchguard SSL User guide

Watchguard SSL User guide

Related papers

Other documents