Contents

Hillstone Firewall Integration with AuthPoint

Deployment Overview

This document describes how to set up multi-factor authentication (MFA) for your Hillstone® Firewall with AuthPoint as an identity provider. Your Hillstone Firewall must already be configured and deployed before you set up MFA with AuthPoint.

Your Hillstone Firewall can be configured to support MFA in several modes. For this integration, we set up RADIUS authentication for the Hillstone Firewall.

This integration was tested with v5.5 of Hillstone SG-6000-C1000.

Hillstone Authentication Data Flow with AuthPoint

AuthPoint communicates with your Hillstone Firewall with the RADIUS protocol. This diagram shows the data flow of an MFA transaction for RADIUS.

Data flow for an MFA transaction with RADIUS authentication.

Before You Begin

Before you begin these procedures, make sure that:

  • You have installed and configured the AuthPoint Gateway (see About Gateways)
  • End-users can log in to the Hillstone Firewall
  • A token is assigned to a user in AuthPoint

Configure Hillstone Firewall

Configure a RADIUS Server

To use RADIUS authentication with Hillstone Firewall VPN, you must add a RADIUS server (the AuthPoint Gateway) in Hillstone.

  1. Log in to the Hillstone Networks' Firewall Web UI at https://<IP address of Hillstone >.
  2. Select the Object tab.
  3. From the side menu, select AAA Server.
  4. Select New > Radius Server.

  1. In the Server Name text box, type a name for the RADIUS server. In our example, we type AuthPoint Gateway.
  2. In the Server Address text box, type the IP address of the AuthPoint Gateway (RADIUS server).
  3. Leave the default values for Virtual Router and Port.

    The default port is 1812. If you already have a RADIUS server installed that uses port 1812, you must use a different port for the AuthPoint Gateway.

  4. In the Password text box, type a shared secret key (password) that Hillstone and the AuthPoint Gateway (RADIUS server) will use to communicate.
  5. In the Confirm Password text box, type the shared secret key again.
  6. From the Timeout drop down list, select 30.
  7. Make sure the Enable Account check box is not selected.

Screenshot of the settings in the RADIUS Server Configuration window.

  1. Click OK.

Screenshot that shows the RADIUS server added in the UI.

Configure an SSL VPN Address Pool

When a client connects to the VPN, an IP from an IP address pool is assigned to the client. An address pool must be created in the Hillstone Networks' Firewall.

  1. Select the Network tab.
  2. From the side menu, select VPN > SSL VPN .
  3. Click Address Pool.

  1. Click New.
    The Address Pool Configuration window opens.
  2. In the Address Pool Name text box, type a name for the address pool.
  3. In the Start IP text box, type the first IP of the pool.
  4. In the End IP text box, type the last IP of the pool.
  5. In the Mask text box, type the subnet mask of the address pool.
  6. (Optional) In the DNS text boxes, type the DNS for this pool.
  7. Click OK.

  1. Click Close.

Configure a Tunnel Interface

A tunnel interface is an interface that links between two locations through an untrusted network. To avoid man-in-the-middle attacks that could capture data being transferred between these locations, the data is encrypted.

  1. Select the Network tab.
  2. From the side menu, select Zone.
  3. Click New.
    The Zone Configuration window appears.
  4. In the Zone text box, type a name for the zone.
  5. For Type, select Layer 3 Zone.
  6. Leave the default value for other settings.
  7. Click OK.

  1. Select the Network tab.
  2. From the side menu, select Interface.
  3. Click New > Tunnel Interface.

  1. In the Interface Name text box, type a number between one and eight.
  2. For Binding Zone, select Layer 3 Zone.
  3. From the Zone drop down list, select the VPN zone that you created.
  4. In the IP Address text box, type the static IP address for the tunnel. The IP address must be in the same network segment as the SSL VPN address pool.
  5. In the Net mask text box, type the network subnet mask.
  6. Click OK.

SSL VPN Settings

  1. Select the Network tab.
  2. From the side menu, select VPN > SSL VPN.
  3. Click New.
    The SSL VPN Configuration window opens.
  4. In the SSL VPN Name text box, type the name for the SSL VPN.
  5. From the AAA Server drop down list, select the RADIUS server you configured.
  6. Click Add.

  1. Click Next.
  2. From the Egress Interface1 drop down list, select the interface connected to the external network.
  3. In the Service Port text box, type 4433.
  4. From the Tunnel Interface drop down list, select the tunnel interface you created in the Configure a Tunnel Interface section.
  5. From the Address Pool drop down list, select the SSL VPN address pool you created in the Configure an SSL VPN Address Pool section.

  1. Click Next.
  2. In the IP text box, type the internal network IP address.
  3. In the Mask text box, type the internal network subnet mask.
  4. Click Add.
  5. Click Done.

Configure an SSL VPN Policy

You must create an SSL VPN policy to allow specific users and groups to use the SSL VPN.

  1. Select the Policy tab.
  2. From the side menu, select Security Policy.
  3. Click New.
    The Policy Configuration window opens.
  4. In the Name text box, type the name for this policy.
  5. In the Source section, from the Zone drop down list, select the VPN zone you created in the Configure a Tunnel Interface section.
  6. In the Destination section, from the Destination> Zone drop down list, select the trust zone.
  7. For Action, select Permit.
  8. Click OK.

Configure AuthPoint

Before AuthPoint can receive authentication requests from Hillstone, you must specify Hillstone as a RADIUS client resourceIn AuthPoint, resources are the applications and services that your users connect to. in AuthPoint. You must also assign an access policyAccess policies specify which resources users in a group can authenticate to and which authentication methods they can use. for the Hillstone resource to the user group(s) that must authenticate and you must bind the Hillstone resource to the AuthPoint Gateway.

Add a Hillstone Resource in AuthPoint

From the AuthPoint management UI:

  1. From the navigation menu, select Resources.
  2. From the Choose a Resource Type drop-down list, select RADIUS Client. Click Add Resource.

  1. In the Name text box, type a friendly name for your RADIUS client resource.
  2. In the RADIUS client trusted IP or FQDN text box, type the IP address or the fully qualified domain name of your RADIUS client.
  3. In the Shared Secret text box, type the shared secret that you configured for your Hillstone Firewall.
  4. Click Save.

Add an Access Policy to AuthPoint

You must have at least one user group in AuthPoint for authentication with Hillstone, and you must assign an access policy for the Hillstone resource to that group. Access policies specify which resources users in a group can authenticate to and which authentication methods they can use.

If you already have a group, you do not have to add another group.

In the AuthPoint management UI:

  1. From the navigation menu, select Groups.
  2. To add a new group, click Add Group. If you already have a group that you want to use, click the Name of your group to edit it.

  1. In the Name text box, type a descriptive name for the group.
  2. (Optional) In the Description text box, type a description of the group.

  1. In the Access Policy section, click Add Policy.

  1. In the Add Policy dialog box, from the Resource drop-down list, select the resource you want to add an access policy for.
  2. (Optional) To require that users type their password before they authenticate for this resource, select the Require Password Authentication slider.
  3. Select the authentication options users in this group can choose from when they authenticate.

    For RADIUS resources, you can only choose OTP or Push. RADIUS resources cannot use the QR code authentication option.

  1. Click Add.
    The access policy for your resource is added to the list.

  1. Click Save.

Before you assign users to a group, you must add them to AuthPoint. You can manually add user accounts or import user accounts from your LDAP database. For more information on how to add user accounts, see Add User Accounts.

Bind the RADIUS Resource to a Gateway

The AuthPoint Gateway functions as a RADIUS server and must be installed somewhere on your network that has Internet access and that can connect to your RADIUS clients. For more information, see About Gateways.

To use RADIUS authentication with AuthPoint, you must assign your RADIUS resources to the Gateway in the AuthPoint management UI.

  1. From the navigation menu, select Gateway.
  2. Select the Name of the Gateway.
  3. In the RADIUS section, in the Port text box, type the port number used to communicate with the Gateway. The default ports are 1812 and 1645.
  4. In the Select a RADIUS resource drop-down list, select your RADIUS client resource.
  5. Click Save.

Test the Integration

To test AuthPoint MFA with Hillstone, you can authenticate with a mobile token on your mobile device. For RADIUS resources, you can choose one-time password (OTP) or push.

In this example, we show the one-time password authentication method.

  1. In a web browser, go to https://<External IP of the Hillstone Networks' Firewall>:4433.
  2. In the Username text box, type your AuthPoint user name.
  3. In the Password text box, type your AuthPoint password and the OTP shown for your token in the AuthPoint app. Do not add a space between your password and your OTP.
    Example: If your AuthPoint password is Password and your OTP is 123 789, then you type Password123789.

  1. Click Login.

  1. Download and install the Hillstone Secure Connect client.
  2. Open the Hillstone Secure Connect client.
  3. In the Server text box, type the external IP address of the Hillstone Firewall.
  4. In the Port text box, type 4433.
  5. In the Username text box, type your AuthPoint user name.
  6. In the Password text box, type your AuthPoint password and the OTP shown for your token in the AuthPoint app. Do not add a space between your password and your OTP.
  7. Click Login.

Give Us Feedback  ●   Get Support  ●   All Product Documentation  ●   Technical Search