LoginTC Integration Guide

Deployment Overview

LoginTC® provides cloud-based authentication through the RADIUS protocol.

This document describes how to integrate LoginTC two-factor authentication with a WatchGuard Firebox and the WatchGuard Mobile VPN with SSL client.

Test Topology

Before You Begin

Before you begin these procedures, make sure that you configure the user and client on the RADIUS server.

The user name on the RADIUS server must be the same as the user name in LoginTC Cloud and the WatchGuard Firebox.

Configure LoginTC Cloud

To configure LoginTC Cloud:

1. Log in to LoginTC Cloud.

2. Click Create Your First Domain.
   The Create Domain page opens.

3. In the Name text box, type the domain name.
4. In the Icon section, select an icon from the list, or to use a custom icon, select Upload from Computer.
5. Click Create.
   

6. Click Create User.
   

7. Click Create Your First User.
   

8. In the Personal Details section, type the Username, Name, and Email address of the user.
9. Click Create.

10. Click Issue Token.

11. In the Actions column, click Issue Token.

12. Use the code in the Activation Code column to activate your token. For information on how to set up your token, see the Testing section in the LoginTC documentation.

13. Click Create Application.

14. Type WatchGuard in the filter.
15. Select WatchGuard SSL VPN.

16. Click Configure Connector.

17. Copy and save the Application ID and Application API Key to use when you configure the RADIUS connector.

Install LoginTC RADIUS Connector

For LoginTC RADIUS Connector installation instructions, see the Installation section in the LoginTC documentation.

After installation, you must:

• Set the login Password.

• Configure the IP Address.

• Configure the DNS.

• Check that the Web Server starts.

To view the status of the configuration, select Status.

Configure the RADIUS Connector

To configure the RADIUS Connector:

1. Log in to LoginTC RADIUS Connector Web. The default user name is logintc-user.

2. Click Create Your First Configuration.

3. In the Application ID text box, type the Application ID you copied previously in the Configure LoginTC Cloud steps.
4. In the Application API Key text box, type the Application API Key you copied previously in the Configure LoginTC Cloud steps.
5. Click Test.
   If the test is successful, a success message appears.
   
6. Click Next.

7. In the First Factor section, select the first authentication factor to use with LoginTC. In our example, we select RADIUS.
8. In the Host text box, type the IP address of the RADIUS server.
9. In the Port text box, type the port number that your RADIUS server uses for communication. The default is 1812.
10. In the Secret text box, type the shared secret used by the RADIUS server and the LoginTC RADIUS Connector.
11. Click Test.
    If the test is successful, a success message appears.
    
12. Click Save.

13. To specify which users LoginTC challenges, select Static List.
14. In the LoginTC Challenge Users text box, type one or more user names. In our example, we use EcoTest as our user.
15. Click Next.

16. In the Name text box, type the name of the client.
17. In the IP Address text box, type the IP address of the client IP address of the Firebox Trusted or Optional interface.
18. In the Secret text box, type the shared secret used by the RADIUS client and the LoginTC RADIUS Connector.
19. For the other options, do not change the default settings.
20. Click Test.
    If the test is successful, a success message appears.
    
21. Click Save.

Configure the WatchGuard Firebox

To configure your Firebox for RADIUS authentication:

1. Log in to Fireware Web UI.

2. Select Authentication > Servers > RADIUS.
3. Click Add.

4. In the Domain Name text box, type the domain name. In our example, we use FreeRadius.
5. In the Primary Server Settings section, select Enable RADIUS Server.
6. In the IP Address text box, type the IP address of the RADIUS server. In this guide, we use the IP address of the LoginTC Radius Connector.
7. In the Shared Secret and Confirm Secret text boxes, type the shared secret used by the RADIUS client (Firebox) and the LoginTC RADIUS Connector.
8. In the Timeout text box, type 30.
9. For other options, do not change the default settings.
10. Click Save.
11. Select VPN > Mobile VPN.
12. In the SSL section, click Configure.

13. Select the Activate Mobile VPN with SSL check box.
14. In the Primary text box, type the IP address of your Firebox external interface.
15. Select the Authentication tab.
16. To make FreeRadius the default authentication server, select FreeRadius. Click Move Up.
17. In the Users and Groups section, from the Create New drop-down list, select FreeRadius and User.
18. Click Add.
    The Add User or Group dialog box opens.

19. In the Name text box, type the user name.
20. In the Description text box, type the description.
21. From the Authentication Server drop-down list, select FreeRadius.
22. Click Save.
    Your new user appears in the User and Groups list.

23. Click Save.
24. Select VPN > Mobile VPN.
    The Mobile VPN page opens.

25. To downland the Mobile VPN with SSL VPN client, in the SSL section, click Download Client.

Test the Integration

To test the integration:

1. Install and open the Mobile VPN with SSL client.

2. In the Server text box, type the FQDN or IP address of the Firebox external interface.
3. In the User name text box, type the user name.
4. In the Password text box, type the password.
5. Click Connect.
   Your LoginTC token receives a push request.

6. Click Approve.
   You are connected successfully.