Swivel Secure AuthControl Sentry Integration Guide

Deployment Overview

The Swivel Secure AuthControl Sentry® is RADIUS compatible and can be used as a RADIUS server. This document describes the steps necessary to integrate the WatchGuard Mobile VPN with the SSL client software download process and Mobile VPN with SSL client authentication with Swivel Security’s AuthControl Sentry two-factor authentication solution.

Swivel Secure AuthControl Sentry supports several user authentication methods. This integration uses email.

This diagram shows the workflow for two-factor authentication through integration with Swivel AuthControl Sentry:

1. A user initiates primary authentication to the WatchGuard Firebox.
2. The Firebox sends an authentication request to AuthControl Sentry.
3. AuthControl Sentry checks the password. If it is correct, it responds with a RADIUS challenge (one-time code) to the Firebox.
4. The user is prompted with a second dialogue box.
5. If the user types a correct passphrase and AuthControl Sentry is set to Dual Challenge On Demand, AuthControl Sentry sends a dual channel security string message as a one-time code to the user in a specified format (SMS text message, Turing image, mobile phone client application, or email).
6. The user submits their one-time code in the second dialogue box and sends a second authentication request to the Firebox.
7. AuthControl Sentry authenticates the user based on the password submitted in the first authentication request and the one-time code submitted in the second authentication request.
8. The Firebox receives the authentication results from AuthControl Sentry.
9. The Firebox grants the user access.

Test topology

Configure Swivel Secure AuthControl Sentry

Configure RADIUS Settings

To configure RADIUS settings:

1. Log in to Swivel Secure AuthControl Sentry web UI at https://X.X.X.X:8080/sentry.
2. From the left navigation bar, select RADIUS > Server.

3. From the Server enabled drop-down list, select Yes.
4. For the other options, do not change the default settings.
5. From the left navigation bar, select RADIUS > NAS.
6. Click New Entry.

7. In the Name text box, type a name.
8. In the NAS Identifier text box, type the NAS name.
9. In the Hostname/IP text box, type the trusted or optional interface IP address of the Firebox.
10. In the Secret text box, type the shared secret to use for communication between the Firebox and RADIUS NAS.
11. From the Vendor (Groups) drop-down list, select WatchGuard.
12. From the Two Stage Auth drop-down list, select Yes.
13. For the other options, do not change the default settings.
14. Click Apply.

Configure Dual Channel Settings

To configure Dual Channel settings:

1. From the left navigation bar, select Server > Dual Channel.

2. From the On-demand authentication drop-down list, select Yes.
3. For the other options, do not change the default settings.
4. Click Apply

Configure SMTP

To configure SMTP:

1. From the left navigation bar, select Messaging > General.

2. Expand the SMTP settings.
3. From the Destination attribute drop-down list, select email.
4. From the Strings Repository Group drop-down list, select SwivelSMTP.
5. From the Alert repository group drop-down list, select SwivelSMTP.
6. For the other options, do not change the default settings.
7. Click Apply.
8. From the left navigation bar, select Messaging > SMTP.

9. In the From email address: text box, type the email address used to deliver the email message.
10. For the other options, do not change the default settings.
11. Click Apply.
12. From the left navigation bar, select Server > SMTP.
    The SMTP Server settings page opens.

13. In the Hostname/IP text box, type the FQDN or the IP address of the SMTP server.
    This is the SMTP server that delivers email messages with a one-time authentication code.
14. From the Authentication enabled drop-down list, select Yes.
15. In the Username text box, type the user name of the SMTP server.
16. In the Password text box, type the password of the SMTP server.
17. For the other options, do not change the default settings.
18. Click Apply

Add a User

To add a user:

1. From the left navigation bar, select User Administration.
2. Click Add User.
   The user settings page opens.

3. In the Username text box, type a name for the authentication user.
4. In the Email address text box, type the email address for user authentication. This email address receives an email with the one-time code when the user authenticates.
5. In the PIN text box, type a PIN number for this user.
6. In the Password text box, type a password for this user.
7. In the Server groups panel, select SwivelSMTP.
8. In the Server groups panel, select SwivelSMS.
9. Click Apply.
   Dual authentication is enabled.

For Swivel to send an email message with a one-time code, you must enable Dual authentication. To enable Dual authentication, you must select SwivelSMTP and a second authentication method, in this case, SwivelSMS.

Configure the WatchGuard Firebox

Configure the RADIUS Server

To configure the RADIUS Server:

1. Log in to Fireware Web UI.
2. Select Authentication > Servers > RADIUS.
3. Click Add.

4. In the Domain Name text box, type the domain name. In our example, we use Swivel.
5. In the Primary Server Settings section, select Enable RADIUS Server.
6. In the IP Address text box, type the IP address of the RADIUS server. In this guide, we use the IP address of the Swivel Secure AuthControl Sentry.
7. In the Shared Secret and Confirm Secret text boxes, type the shared secret used by the RADIUS client (Firebox) and the Swivel Secure AuthControl Sentry.
8. In the Timeout text box, type 30.
9. For the other options, do not change the default settings.
10. Click Save.

Configure SSL VPN

To configure SSL VPN:

1. Select VPN > Mobile VPN.
2. In the SSL section, click Configure.

3. Select the Activate Mobile VPN with SSL check box.
4. In the Primary text box, type the IP address of the Firebox external interface.
5. Select the Authentication tab.
6. To make Swivel the default authentication server, select Swivel. Click Move Up.
7. In the Users and Groups section, from the Create New drop-down list, select Swivel and User.
8. Click Add.
   The Add User or Group dialogue box opens.

9. In the Name text box, type the user name.
10. In the Description text box, type the description.
11. From the Authentication Server drop-down list, select Swivel.
12. Click Save.
    A new user appears in the User and Groups list.

13. Click Save.

Download the SSL VPN Client

To download the SSL VPN client:

1. Select VPN > Mobile VPN.
   The Mobile VPN page opens.

2. To downland the Mobile VPN with SSL VPN client, in the SSL section, click Download Client.

Mobile VPN with SSL Client Authentication

After downloading and installing the Mobile VPN with SSL client on the computer, use the same authentication process to connect to the Firebox with the SSL VPN client.

To connect to the Firebox:

1. Launch the Mobile VPN with SSL client.

2. In the Server text box, type the FQDN or IP address of the Firebox external interface.
3. In the User name text box, type the user name.
4. In the Password text box, type the password.
5. Click Connect.
   An email is sent that contains the One-Time code.
6. When prompted, enter the One-Time Code from the email.