User's Manual

ManualsBrandsRSA Security ManualsWater HeaterRSA Security Water Heater 1.6.3

RSA SecurID Ready Implementation Guide

Last Modified November 29, 2001

1. Partner Information

Partner Name Stonesoft Corp.

Web Site www.stonesoft.com

Product Name StoneGate Firewall

Version & Platform

Version 1.6.3

Product Description

StoneGate is the first firewall and VPN solution offering

high security, high performance and availability. It features:

An embedded OS for increased security.

Multiple ISP and VPN load balancing to ensure continuous

network connectivity.

Advanced centralized administration tools for enterprise -

wide management of the firewall infrastructure.

Product Category Firewall

2. Contact Information

Sales Contact

Support Contact

E-mail sales@stonesoft.com support@stonesoft.com

Phone +358 9 4767 11 +358 9 4767 11

Web www.stonesoft.com www.stonesoft.com

Summary of content (11 pages)

PAGE 1
RSA SecurID Ready Implementation Guide Last Modified November 29, 2001 1. Partner Information Partner Name Web Site Product Name Version & Platform Product Description Product Category Stonesoft Corp. www.stonesoft.com StoneGate Firewall Version 1.6.3 StoneGate is the first firewall and VPN solution offering high security, high performance and availability. It features: An embedded OS for increased security. Multiple ISP and VPN load balancing to ensure continuous network connectivity.
PAGE 2
3. Solution Summary Feature Details Authentication Methods Supported RADIUS, TACACS+. ACE/Agent Library Version N/A ACE 5 Locking N/A Replica ACE/Server Support N/A Secondary RADIUS/TACACS+ Server Support Yes (up to 10 supported) Location of Node Secret on Client None stored ACE/Server Agent Host Type UNIX Agent SecurID User Specification Designated users, all users, SecurID as default. SecurID Protection of Administrators No StoneGate system architecture.
PAGE 3
4. Product Requirements • Hardware requirements Component Name: StoneGate Management system CPU make/speed required Pentium processor, suggested minimum processor speed 500 MHz Memory 128 MB minimum, 256 MB or more recommended HD space 4GB for evaluation (20 GB or more for production use).
PAGE 4
5. Partner ACE/Agent configuration Supported authentication types with RSA SecurID product Client-initiated authentication Client initiated authentication means that the user starts the authentication process. It can be done with two tools: Authentication Client software (part of StoneGate VPN Client software) or using Telnet to connect to the firewall cluster on port 2543. It is possible to authorize the client's IP address for a period of time with client initiated authentication.
PAGE 5
StoneGate Firewall / RSA SecurID Configuration – User Authentication The following steps can be carried out using the Stonegate User Manager GUI: • Create an Authentication service (type can be Radius or Tacacs+). • Create Authentication Server/Servers with correct type.
PAGE 6
• All Created Authentication Servers must be bound to the Authentication Service. Having created your Service(s) and Server(s), you must now create users within the StoneGate user Database. If you want to use ACE/Server authentication as your default Authentication Service for all users, create a special user with the UserName: *external* within the StoneGate user database and bind it to the previously created Authentication Service.
PAGE 7
Using this generic method of authentication, *external* is the only user you will be required to create within the StoneGate user database. If there is a need to configure Authentication Services on a per user basis, it can be done by creating individual user records within the StoneGate user database and binding them to the appropriate Authentication Service. Using the Security Policy Manager, associate the appropriate access rules to the users or user group being authenticated by the RSA ACE/Server.
PAGE 8
Example SecurID enabled login sequences Firewall initiated authentication with ACE/Server user account set to New PIN-mode.
PAGE 9
PAGE 10
6. Certification Checklist Date Tested: November 22, 2001 Product ACE/Server ACE/Agent StoneGate firewall & VPN Client Test 1st time auth.
PAGE 11
7. Known Issues • If a clustered StoneGate firewall solution is used with RSA SecurID then an Agent Host entry must be defined within the ACE/Server database for each firewall cluster member. • The Firewall cluster members share configured authentication service/server information. As a result of this when configuring Agents Hosts on the ACE/Server database, the same Shared Secret value must be used for each cluster member.